Sergey Budaev

The machine stops: AI bubble must burst

2025-11-25T15:00:00+01:00

As more and more investments are poured into the current AI, there is a feeling in the industry that neural networks, large language models and other AI technologies—as they are construed now—are by far not as effective and useful as the the affectionate visionaries, tech prophets and evangelists try to convince us. Even though rather feeble voices of critics have been appearing from the start of the so called “AI revolution” (and even more from the moment of the Sam Altman’s resignation comedy in 2023), it became quite clear that the expectations from the technology largely surpassed its objective capabilities. The current AI and its obsession with greater, grander and more ambitious projects, such as the “General Artificial Intelligence” (promised to approach the human mind) cannot be fulfilled because of numerous causes and inherent limitations. We still know too little about the human cognition and mind. It is ridiculous how can they think to create an analogue of the human mind without first even trying to understand how did it come about, and without trying to make a functional analogue of a cockroach or a bee mind.

AI Incident Database: https://incidentdatabase.ai/
Bender, E. M., Gebru, T., McMillan-Major, A., and Shmitchell, S. (2021). On the dangers of stochastic parrots: can language models be too big?, in Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency, (Virtual Event Canada: ACM), 610–623. https://doi.org/10.1145/3442188.3445922
Bishop, J. M. (2021). Artificial intelligence is stupid and causal reasoning will not fix it. Frontiers in Psychology, 11, 1–18. https://doi.org/10.3389/fpsyg.2020.513474
Floridi, L. (2025). A conjecture on a fundamental trade-off between certainty and scope in symbolic and generative AI. Philos. Technol. 38, 93, s13347-025-00927-z. https://doi.org/10.1007/s13347-025-00927-z
Gibney, E. (2024). AI models fed AI-generated data quickly spew nonsense. Nature 632, 18-19. https://doi.org/10.1038/d41586-024-02420-7
Gundlach, H., Lynch, J., and Thompson, N. (2025). Meek models shall inherit the Earth. https://doi.org/10.48550/arXiv.2507.07931
Jaeger, J. (2024). Artificial intelligence is algorithmic mimicry: Why artificial “agents” are not (and won’t be) proper agents. Neurons, Behavior, Data Analysis, and Theory. https://doi.org/10.51628/001c.94404
Huang, L., Yu, W., Ma, W., Zhong, W., Feng, Z., Wang, H., Chen, Q., Peng, W., Feng, X., Qin, B., & Liu, T. (2024). A survey on hallucination in large language models: principles, taxonomy, challenges, and open questions. ACM Transactions on Information Systems, 3703155. https://doi.org/10.1145/3703155
Kafka, P. (2025). The godfather of Meta’s AI thinks the AI boom is a dead end. Business Insider. https://www.businessinsider.com/meta-ai-yann-lecun-llm-world-model-intelligence-criticism-2025-11?op=1
Kalai, A. T., Nachum, O., Vempala, S. S., & Zhang, E. (2025). Why language models hallucinate. https://openai.com/index/why-language-models-hallucinate/
Marcus, G., & Davis, E. (2019). Rebooting AI. Building artificial intelligence we can trust. Pantheon Books.
Mind Prison, We have made no progress toward AGI. (2025). Mind Prison. https://www.mindprison.cc/p/no-progress-toward-agi-llm-braindead-unreliable
Narayanan, A., and Kapoor, S. (2024). AI snake oil: what artificial intelligence can do, what it can’t, and how to tell the difference. Princeton Oxford: Princeton University Press.
Pearl, J. (2019). The limitations of opaque learning machines. In John Brockman (Ed.), Possible Minds: 25 Ways of Looking at AI. Penguin Press (https://ftp.cs.ucla.edu/pub/stat_ser/r489.pdf).
Roli, A., Jaeger, J., and Kauffman, S. A. (2022). How organisms come to know the world: Fundamental limits on artificial general intelligence. Front. Ecol. Evol. 9, 806283. https://doi.org/10.3389/fevo.2021.806283
Schlereth, M. M. (2025). AGI is impossible. here is the proof. https://philpapers.org/archive/SCHAII-17.pdf
Schlereth, M. M. (2025). AGI is mathematically impossible 2: when entropy returns. https://philarchive.org/archive/SCHAIM-14
Schlereth, M. M. (2025). AGI is impossible 3 compression vs. comprehension. https://philpapers.org/archive/SCHAII-18.pdf
Sikka, V., and Sikka, V. (2025). Hallucination stations: On some basic limitations of transformer-based language models. (arXiv:2507.07505) https://doi.org/10.48550/arXiv.2507.07505
Stiefel, K. M., and Coggan, J. S. (2023). The energy challenges of artificial superintelligence. Front. Artif. Intell. 6, 1240653. https://doi.org/10.3389/frai.2023.1240653
Xu, Z., Jain, S., and Kankanhalli, M. (2024). Hallucination is inevitable: An innate limitation of large language models. https://doi.org/10.48550/arXiv.2401.11817
Zhang, M., Press, O., Merrill, W., Liu, A., & Smith, N. A. (2023). How language model hallucinations can snowball (No. arXiv:2305.13534). arXiv. https://doi.org/10.48550/arXiv.2305.13534

But it is clear already that the current data driven, opaque, associative “deep” learning approach based on simple patter matching, interpolating big amount of data in a manner of statistical approximation has failed. Now, LLMs have access to most of the human produced texts and images—to a large extent because of massive copyright infringement, unauthorised web scraping, deceptive ToS aimed for data exploitation and similar dubious approaches. The expected amount of new genuinely human generated data goes to a diminishing return limit. But in spite of the gigantic amount of learning data and huge energy use costs, the newest models are only marginally better than those at previous iteration. An ancient rule-based ELIZA language modeli, a product of computer archeology, running on the weakest CPU from the 60s outperformed on the Turing test then revolutionary ChatGPT-3 that required huge datacenters to run.

Jones, C., & Bergen, B. (2023). Does GPT-4 pass the Turing Test? http://arxiv.org/abs/2310.20216.

But the negative effects abound. The web is poisoned with a growing amount of meaningless and grossly inaccurate digital waste generated by AI. Yet, instead of trying to focus on radical change of the architecture, The Big Tech invest even more in data centres, consuming even more electric power (therefore even greater carbon emission) and try to be even more intrusive in sucking out and exploiting human-generated content. For example: ☹ Gmail reads the users emails and attachments to train its “smart” features.☹ LinkedIn Is Training AI on User Data Before Updating Its Terms of Service. ☹ AI bots scraping the net are as malacious as DDOS attacks. ☹ Perplexity AI bots continue crawling the content explicitly blocked for access. ☹ AI scraper bots are responsible for 86% increase of invalid Internet traffic. ☹ AI bots disrupt scientific scientific databases and journals.

The verbiage surrounding the current AI is wrong and deceptive. Essentially, the currently popular AI is just seeking correlation patterns in a large amount of data. Therefore it cannot be described meaningfully as "generative" or "agentic." A program implementing a straight line regression model has the same level of "generativity" if it generates Y from a given X. A similar program that just gets a X values from a sensor and executes a program loop converting the Y into some action has the same level of "agency" as current AL agents, essentially, it does not exceed the level of a trivial thermostat. Yet, the key figures of the AI monopolies, OpenAI, Anthropic and Google, use words like "learning," "thinking," "reasoning" and "logic" to describe pattern matching and generation of statistically probable outputs. This is a deliberately deceptive and misleading strategy. It is a complete misrepresentation of the technology. And it is potentially dangerous. A computer program functioning like a regression model cannot "hallucinate" because it doesn’t have a mind, it can just malfunction and output wrong result.

The facts are that

AI is hugely unprofitable, too expensive and inefficient: ☠ Is OpenAI A Ponzi scheme?; ☠ You have no idea how screwed OpenAI actually is; ☠ Wall Street blows past bubble worries to supercharge AI spending frenzy
AI is still unreliable and untrustable: Bansal, V. (2025). Meet the AI workers who tell their friends and family to stay away from AI | Artificial intelligence (AI). The Guardian. https://www.theguardian.com/technology/2025/nov/22/ai-workers-tell-family-stay-away; ☠ Consumer surveys show a growing distrust of AI and firms that use it.
False information generated by AI tools creepis into formerly reputable scientific resources: van Rooij, I. (2025) AI slop and the destruction of knowledge.
AI models produce many false claims even on the sources they provided: Venkit, P. N., Laban, P., Zhou, Y., Huang, K.-H., Mao, Y., & Wu, C.-S. (2025). DeepTRACE: Auditing deep research AI systems for tracking reliability across citations and evidence (No. arXiv:2509.04499). arXiv. https://doi.org/10.48550/arXiv.2509.04499
AI chatbots give harmful medical advises: Andrikyan, W., Sametinger, S. M., Kosfeld, F., Jung-Poppe, L., Fromm, M. F., Maas, R., & Nicolaus, H. F. (2025). Artificial intelligence-powered chatbots in search engines: A cross-sectional study on the quality and risks of drug information for patients. BMJ Quality & Safety, 34(2), 100?109. https://doi.org/10.1136/bmjqs-2024-017476
AI "agents" fail at an alarming rate: Xu, F. F., Song, Y., Li, B., Tang, Y., Jain, K., Bao, M., Wang, Z. Z., Zhou, X., Guo, Z., Cao, M., Yang, M., Lu, H. Y., Martin, A., Su, Z., Maben, L., Mehta, R., Chi, W., Jang, L., Xie, Y., ? Neubig, G. (2025). TheAgentCompany: Benchmarking LLM agents on consequential real world tasks (No. arXiv:2412.14161). arXiv. https://doi.org/10.48550/arXiv.2412.14161
Even the best AI agents achieve no more than 2.5% automation rate: Mazeika, M., Gatti, A., Menghini, C., Sehwag, U. M., Singhal, S., Orlovskiy, Y., et al. (2025). Remote Labor Index: Measuring AI automation of remote work. https://arxiv.org/abs/2510.26787
AI tools can generally reduce company’s productivity: Niederhoffer, K., Rosen Kellerman, G., Lee, A., Liebscher, A., Rapuano, K., & Hancock, J. T. (2025). AI-Generated “workslop” is destroying productivity. https://hbr.org/2025/09/ai-generated-workslop-is-destroying-productivity
Despite skyrocketing investments in generative AI, 95% of companies get zero return: Challapally, A., Pease, C., Raskar, R., & Chari, P. (2025). The GenAI Divide: State of AI in Business 2025. MIT NANDA. https://mlq.ai/media/quarterly_decks/v0.1_State_of_AI_in_Business_2025_Report.pdf
AI is harmful for the environment: https://www.unep.org/news-and-stories/story/ai-has-environmental-problem-heres-what-world-can-do-about; https://news.mit.edu/2025/explained-generative-ai-environmental-impact-0117; https://theconversation.com/ai-is-bad-for-the-environment-and-the-problem-is-bigger-than-energy-consumption-247842
AI tools reduce developer productivity: Becker, J., Rush, N., Barnes, E., & Rein, D. (2025). Measuring the impact of early-2025 AI on experienced open-source developer productivity. https://metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study/; Uplevel Data Labs. (2024). Can Generative AI Improve Developer Productivity. https://resources.uplevelteam.com/gen-ai-for-coding
Using AI leads to increased amount of unneeded code, reduced code quality and tends to introduce severe bugs: Harding, W., & Kloster, M. (2024). Coding on Copilot 2023 data shows downward pressure on code quality. https://www.gitclear.com/coding_on_copilot_data_shows_ais_downward_pressure_on_code_quality; CodeRabbit. (2025). State of AI vs human code generation. http://www.coderabbit.ai/whitepapers/state-of-AI-vs-human-code-generation-report
Using AI tools adds more security vulnerabilities: Veracode. (2025). 2025 GenAI code security report. https://www.veracode.com/wp-content/uploads/2025_GenAI_Code_Security_Report_Final.pdf
Autonomous AI software development almost always fails: Husain, H., Flath, I., and Johno, W. (2025). Thoughts on a month with Devin. Answer.AI. Available at: https://www.answer.ai/posts/2025-01-08-devin.html
AI-based browser is a security disaster: https://venturebeat.com/ai/when-your-ai-browser-becomes-your-enemy-the-comet-security-disaster
Using AI-driven "vibe coding" can result in a catastrophic disaster: https://fortune.com/2025/07/23/ai-coding-tool-replit-wiped-database-called-it-a-catastrophic-failure/
AI tools can be destructive for learning: Bastani, H., Bastani, O., Sungu, A., Ge, H., Kabakcı, Ö., & Mariman, R. (2024). Generative AI can harm learning. SSRN. https://doi.org/10.2139/ssrn.4895486; Kosmyna, N., Hauptmann, E., Yuan, Y. T., Situ, J., Liao, X.-H., Beresnitzky, A. V., Braunstein, I., & Maes, P. (2025). Your Brain on ChatGPT: Accumulation of cognitive debt when using an AI assistant for essay writing task. arXiv. https://doi.org/10.48550/ARXIV.2506.08872; Lee, H.-P., Sarkar, A., Tankelevitch, L., Drosos, I., Rintel, S., Banks, R., & Wilson, N. (2025). The impact of generative AI on critical thinking: self-reported reductions in cognitive effort and confidence effects from a survey of knowledge workers. https://doi.org/10.1145/3706598.3713778; Elsayed, Y., & Verheyen, S. (2024). ChatGPT and the illusion of explanatory depth. Proceedings of the Annual Meeting of the Cognitive Science Society, 46; Abbas, M., Jam, F. A., and Khan, T. I. (2024). Is it harmful or helpful? Examining the causes and consequences of generative AI usage among university students. Int J Educ Technol High Educ 21, 10. https://educationaltechnologyjournal.springeropen.com/articles/10.1186/s41239-024-00444-7; Azeem, S., and Abbas, M. (2025). Personality correlates of academic use of generative artificial intelligence and its outcomes: does fairness matter? Educ Inf Technol 30, 18131?18155. https://link.springer.com/10.1007/s10639-025-13489-6.
Generative AI can cause "Generative AI addiction syndrome": Kooli, C., Kooli, Y., and Kooli, E. (2025). Generative artificial intelligence addiction syndrome: A new behavioral disorder? Asian Journal of Psychiatry 107, 104476. https://doi.org/10.1016/j.ajp.2025.104476
AI tools contribute to massive amount of fake news and misinformation: NewsGuard. (2025). Tracking AI-enabled Misinformation: Over 2000 Undisclosed AI-Generated News Websites (and Counting), Plus the Top False Narratives Generated by Artificial Intelligence Tools—NewsGuard. NewsGuard. https://www.newsguardtech.com/special-reports/ai-tracking-center/
AI tools supercharge scammers providing a cheap scam generator: FTC Announces Crackdown on Deceptive AI Claims and Schemes
AI tools involve large amount of invisible human labour: ☠ There are "digital sweatshops" in the Philippines or other poor countries where people work out of sight and behind the scenes to identify, sort and refine content for AI companies like OpenAI, Meta and Microsoft. ☠ How the AI industry profits from catastrophe in Venezuela.; ☠ Exclusive: OpenAI Used Kenyan Workers on Less Than $2 Per Hour to Make ChatGPT Less Toxic; ☠ Inside Facebook’s African Sweatshop. ☠ An "AI-powered" service Nate helping customers make purchases turned out to be a fraud scheme with all the work done by people from Philippines call centres.

The machine stops

Where are all these really big multi-billion money going to go? Chances are high that all the money that are currently inflating the AI bubble will be lost. The pain from the expected AI bubble crash is likely to be much greater than from the two and half decades ago dot-com crash. Few people remember, but it took a decade to recover the value of the assets lost at that time. Yet, the number of US households that invest exceeded 20%, surpassing the numbers before the dot-com crash. All these people should be prepared to lose their cash or withdraw before the burst.

Vogelstein, F. (2025). We remember the internet bubble. This mania looks and feels the same. https://crazystupidtech.com/2025/11/21/boom-bubble-bust-boom-why-should-ai-be-different/
Dooley, L. (2025). Reflexivity and the AI boom: A Sorosian analysis. Vincents. https://vincents.com.au/reflexivity-and-the-ai-boom-a-sorosian-analysis
Goldman Sachs. (2025). AI: In a bubble? Goldman Sachs Top of Mind, 143. https://www.goldmansachs.com/insights/top-of-mind/ai-in-a-bubble
Goldman Sachs. (2024). Gen AI: too much spend, too little benefit? Goldman Sachs Top of Mind, 129. https://www.goldmansachs.com/intelligence/pages/gen-ai-too-much-spend-too-little-benefit.html
Example: Despite multibillion investments into AI, Microsoft struggles to sell Copilot and return the investments, but the only strategy is desperately repeat doing the same thing hoping for a completely different result

It does not sound likely that the current AI will take over the planet and destroy human race etc. All the scary prophecies assume that it is a real and genuinely intelligent AGI, which is false. The false prophecies willingly or unwillingly play the role of the Alcibiades' dog tail, diverting attention from real dangers of AI to unrealistic imaginary, but appearing much scarier, dangers. The current AI is harmful for human learning, cognition, environment and investors' pockets. The dangers of AI are not caused by AI itself. They are, as most other calamities, are consequences of human actions. AI does not seem to add anything over the human sins. It just multiplies human-generated evils to higher speed, scale and scope.

Is the current AI a massive fraud scheme aimed to cover failed expectations like the disgraced Theranos?

All the prophecies about the imminent arrival of AGI are not based on a scientific prediction. It is rather the marketing bullshit, a strategic smokescreen, aimed to attract naive, uninformed and FOMO-nervous investors. The current "AGI" development has already hit a ceiling. The consequences for the world’s economy will be quite serious. While the AI is provided for free or nearly free (for a small fraction of real price), the users are happy to play around with even inferior quality service. But what will happen when the bubble has blown and they are forced to pay the real price for buggy, indeterministic, glitchy and defective product?

The machine slops. Then the machine stops.

Norwegian researchers develop digital twin model to optimize fish feeding

2025-08-16T10:00:00+02:00

Norwegian researchers develop digital twin model to optimize fish feeding.

Ivar Rønnestad and Sergei Budaev developed a proof-of-concept using digital twin models to explore smarter, more sustainable fish feeding strategies.

Led by University of Bergen (UiB) professor Ivar Rønnestad and researcher Sergei Budaev from the Department of Biological Sciences, FishMet is an early-stage proof-of-concept venture that is exploring how years of marine physiology and behavioral research can be translated into tools for the aquaculture sector.

FishMet originated from a collaboration between UiB researchers and Vestlandets Innovasjonsselskap (VIS). The initiative centers on a digital twin model for precision aquaculture feeding strategies, aiming to help salmon and trout farming operations optimize feeding, reducing waste and improving fish welfare. Although still at a low Technology Readiness Level (TRL 5), the concept has been made available for exploratory licensing opportunities through VIS.

Read more: aquafeed.com

See paper: Budaev, S., Cusimano, G., Rønnestad, I., (2025) FishMet: A Digital Twin framework for appetite, feeding decisions and growth in salmonid fish. Aquaculture, Fish and Fisheries, 5, e70064. https://doi.org/10.1002/aff2.70064

Microsoft Word for scientific texts? No, thanks.

2025-04-03T23:00:00+02:00

I am often using LibreOffice, which is far from ideal text editor. But it allows to work with genuine LaTeX equations, thanks to the TexMaths extension.

It allows to add and edit equations in the LaTeX format fairly easily. All the beautiful TeX typographic is retained. And the document can be shared with those who use Microsoft Word, frankly, the majority. Then, the equations appear as embedded graphics in the Word file. Not bad, because not everyone is ready to accept pure LaTeX files and work with them.

However, most of those using LaTeX will sooner or later face the challenge of developing a document in Word, because of the requirements of a project leader or funding organization, or just because there is no chance that some of the team members will use LaTeX in their collaborative writing effort. [1]

When this situation occurs, it is time to use LibreOffice with TexMaths and share the docx format document. (Another alternative not considered here is to use and share the Overleaf web-based LaTeX editor with nice visual mode and open source community edition.)

Weirdly enough, not all journals and publishers accept LaTeX files. Then, Word with TexMaths-generated equations as graphics work well during the peer review.

Once the manuscript is accepted, the production needs the final text with all equations in some editable format: if it is Microsoft Equation (in Word) or genuine LaTeX. But sometimes they do not accept LaTeX and ask for Word.

Microsoft Word now declares support for LaTeX equations. So converting equations from raw LaTeX code to the weird Microsoft format should be as easy as select and click. If there are many equations in the text, one needs to make sure nothing is missed. This can be trivially done by delimiting the LaTeX code into some symbols. Two dollar signs $$ look convenient because it is used by some software to delimit embedded LaTeX code and very unlikely to conflict with other text.

$$ MAPE=1/n  \sum ( \left\lvert  O_i-P_i  \right\rvert / \left\lvert O_i \right\rvert ) $$

Further, to make the LaTeX pieces to stand out, it is convenient to use highlighting or colour. In LibreOffice and all decent text editors, this is trivial to do using regular expressions. Just find and select the text pattern, then change formatting. (In LibreOffice this can be done in a single step with "Find All".)

The pattern to select is simple. To find any text within $$ but not including any $ symbol within, one can use this: \$\$ .[^\$]* \$\$.

Regular expressions is a super powerful tool to work with text. See LibreOffice documentation for details.

Converting LaTeX code back into nice rendered equations is super easy in LibreOffice: just find select regular expression text \$\$ .[^\$]* \$\$ and click for converting to equation (the 'pi' button):

(Although, unfortunately, converting equations must be done individually for each).

But this does not work in Microsoft Word, the "most advanced text processor." Nope.

Regular expressions cannot be searched in the Find menu. And this is despite Microsoft VBScript library supports regular expressions from years ago (it was part of Internet Explorer 5.5). Yes, there is an "Advanced Find", with "use wildcards" option. But this is not even close to regular expressions (too advanced for a typical Word user?).

Then, it is not easy to do without first highlighting all $$ delimited test in LibreOffice first. Fortunately, visually locating bright yellow highlights is easy even in the Microsoft product.

Now, it is the order to click for LaTeX!

Oh, no. Microsoft Word does support only the most trivial LaTeX code. If you need a matrix, then no, it does not work: "This expression is currently unsupported".

And the genuine TeX typographics is much better in LibreOfice:

... than in Microsoft Word:

What? Microsoft Office from multi-billion dollar company does not support regular expressions in 2025? And no LaTeX?

(Note that regular expressions for matching text patterns first appeared in computer-based text editors in ... the sixties!)

Microsoft Word for scientific texts? No, thanks.

References

Mamishev, A., Sargent, M., 2013. Creating research and scientific documents using Microsoft Word. Microsoft Press, Redmond.

FishMet: Digital twin for precision aquaculture

2025-03-14T10:00:00+01:00

FishMet: Digital twin for precision aquacultur.

Software model for optimized feeding and waste reduction for salmon and trout farming.

Background

The aquaculture industry, especially salmonid fish farming, is a significant contributor to global food security and economic development. As the pressure mounts to boost production while minimizing environmental impact, innovative solutions are critical.

Traditional feed management systems often fail to capture the complexity of fish feeding behavior and environmental variables. FishMet is an advanced digital twin platform that integrates biological and environmental data to predict fish appetite, feed intake, and growth. Unlike conventional feeding models or AI-driven systems, FishMet leverages biology-driven algorithms to deliver transparent, accurate, and fully explainable predictions. This innovation is the result of over a decade of research into fish physiology, metabolism, and growth regulation.

Read more at www.visinnovasjon.no

Fish & chips? Modellen som kan hjelpe oppdrettere med å optimalisere fôrstrategier

2024-12-11T10:00:00+01:00

Å kombinere biologisk forskning og matematisk modellering har åpnet døren for en ny tilnærming til fiskeoppdrett.

Vi møter professor i fysiologi, Ivar Rønnestad og forsker, Sergey Budaev på Høyteknologisenteret i Bergen. Begge jobber ved Institutt for Biovitenskap ved Universitetet i Bergen og står bak prosjektet FishMet. Som en del av dette prosjektet er det utviklet en simuleringsmodell med samme navn, som er resultatet av mange år med forskning i Rønnestads forskningsgruppe.

Les mer: www.visinnovasjon.no

The omnipotence paradox reduces to the omniidiota dilemma

2024-11-07T18:00:00+01:00

…sed evanuerunt in cogitationibus suis et obscuratum est insipiens
cor eorum dicentes enim se esse sapientes stulti facti sunt.

— Rom 21-22

There is an old—perhaps ancient—“puzzle” or “paradox” that is quite often used by atheists—even today—to prove that the concept of omnipotence is self-contradictory; ergo the existence of omnipotent being is logically impossible. One of the cornerstones of this reasoning is the paradox of the stone.

The paradox of the stone

Can God create a stone so heavy that He cannot lift it?

If He can, then He is not omnipotent because of inability to lift such a stone.
If He cannot create such a stone, then He is not omnipotent because of inability to create such a huge object

In either case, the conclusion is straightforward: an omnipotent being (God) cannot exist, it is a logically contradictory concept.

St Thomas Aquinas did not address the paradox of the stone directly. His treatment of the omnipotence (Summa Theologiae I Q XXV) is much more abstract, detailed and deeper than the stone paradox caricature. Nonetheless, St Thomas concedes that “Sed rationem omnipotentiae assignare videtur difficile.” (It is difficult to account omnipotence). Moreover, St Thomas considers whether negation capacities like “deny Himself” are consistent with omnipotence, e.g. (2) "… Sed Deus non potest peccare, neque seipsum negare, ut dicitur II Tim. 2,13. Ergo Deus non est omnipotens.” (… But God cannot sin, nor deny Himself as it is said in 2 Tim. 2:13. Therefore He is not omnipotent), and further, in (5) “Utrum Deus possit facere quae non facit” (Can God do what He does not?).

Moreover, further, he clearly states “Hoc enim omnipotentiae non subditur, non propter defectum divinae potentiae; sed quia non potest habere rationem factibilis neque possibilis. Quaecumque igitur contradictionem non implicant, sub illis possibilibus continentur, respectu quorum dicitur Deus omnipotens. Ea vero quae contradictionem implicant sub divina omnipotentia non continentur: quia non possunt habere possibilium rationem. Unde convenientius dicitur quod non possunt fieri, quam quod Deus non potest ea facere …” (For this is not submitted to omnipotence, not because of a lack of divine power; but because it cannot have a reason that is feasible or possible. All things, therefore, which do not imply a contradiction, are contained under those things which are possible, in respect of which God is said to be omnipotent. But those things which imply a contradiction are not contained under the divine omnipotence: because they cannot have the reason of the possible. Hence it is more appropriate to say that they cannot be done, than that God cannot do them.) Incidentally, there is a close similarity between this omnipotence attribute following St. Thomas and the concept of positive qualities—purely positive qualities that are not limited or negated—used by Kurt Gödel as the principal element in hist modal version of the “ontologisk bevis” (see Gödel, 1995, pp. 389, 401, 403).

The paradox of the stone stone has been considered by many modern philosophers, including Mavrodes (1963), Frankfurt (1964), Cowan (1965,1974), Plantinga (1967), Schrader (1979), Anderson (1984) and more recently Cogburn (2004), Hill (2014), Beall & Cotnoir (2017), Wreen (2022), Bassford (2023). The treatment of the paradox by these authors seems overtly inkhorn, over-complicated, confusing and deliberately verbose. The Wikipedia (2024) description of the “omnipotence paradox” follows the confusing line of the modern philosophy. It looks like the philosopher’ job is to make trivial things fully unintelligible. Basically, if one dares to make a winding way through the thicket of quantum entangled reasoning, the principal argument nearly repeats that in the St. Thomas’ wording: omnipotence does not entail arbitrary, logically impossible and contradictory things: inability to do a self-contradictory task does not imply that the agent is limited. [An alternative is the Cartesian view that God is above and not subject to logic, so free from any contradiction, (see Bassford, 2023), but this position is incoherent (Geach, 1973)].

Some go much further by arguing that there must be truth-value gaps not accounted for by classical logic (Beall & Cotnoir, 2017), that the omnipotence concept is useless in theology (Cowan, 1974), that the solution to the stone paradox is that “it proves nothing” (Schrader, 1979) or that God is not omnipotent even if we do not deny His perfections and power (Hill, 2014).

However, the simplest and best solution to the stone paradox in my view was provided by (Savage, 1967): “God can create stones of any poundage, and God can lift stones of any poundage” (p. 79). Strangely, this transparent phrase does not look like the conclusions most philosophers like to come to.

However, the paradox of the stone can be reduced to a trivial form which I call “the omniidiota dilemma,” with an instructive corollary. The argument is as follows.

The omniidiota dilemma

Definition. Idiot is defined as someone suffering from (in certain cases, perhaps enjoying) extreme intellectual disability, primarily an utmost form of acalculia.

Comments. Dyscalculia describes a deficit in processing numerical information, learning and recalling arithmetic, as well as making calculations (American Psychiatric Association, 2022). Its extreme form is well described in the psychiatric and psychological literature as acalculia (Dehaene, 1997; Nieder, 2025). A person with acalculia suffers from extreme challenges with even the most basic arithmetic operations, often as a consequence of severe brain damage or extreme developmental disorder. For example, if asked to add one to a given number, the he/she is unable to do such elementary calculation. It is important to note that the term “idiot” should not be understood pejoratively. The original meaning of ἰδιώτης in Greek is just a normal person. There is also a large literature on idiot savants who combine extreme deficit in one cognitive capacity or many diverse capacities with much above the average achievement in certain specific intellectual domain (Dehaene, 1997).

The omniidiota dilemma:

Can a person make such a big number that he/she cannot imagine a number greater than that?

If he/she can imagine such a number, then it proves he/she is an idiot, since the task of guessing a number that is greater than the given number (without any other conditions or restrictions) is trivial. It can be solved in any of many different ways, e.g. adding one or two to the big number, or just doubling this number. Incapacity to increase a number (big or small) points to severe cognitive deficit.
If he/she cannot imagine such a number, then he/she is an idiot, because just imagining any number is a trivial task: take any number and then imagine an even bigger number using any of the elementary arithmetic operations. Incapacity to create a number therefore points to severe cognitive deficit.

It follows from the omniidiota dilemma that you (the reader) and I (the writer) are all idiots: Being not an idiot is a logically contradictory proposition. The dilemma is then simple: everyone is either an idiot or … an idiot: tertium non datur.

Corollary. It follows from The paradox of the stone and The omniidiota dilemma that, if God’s omnipotence is considered self-contradictory, then everyone is necessarily an idiot.

References

American Psychiatric Association, ed (2022). Diagnostic and statistical manual of mental disorders: DSM-5-TRTM. American Psychiatric Association Publishing, Washington, DC, Fifth revised edition.
Anderson, C.A. (1984). Divine omnipotence and impossible tasks: An intensional analysis– Int J Philos Relig 15: 109–124.
Bassford, A.D. (2023). God and the problem of logic. Cambridge University Press.
Beall, J. & Cotnoir, A.J. (2017). God of the gaps: a neglected reply to God’s stone problem– Analysis 77: 681–689.
Cogburn, J. (2004). Paradox lost– Can. J. of Philosophy 34: 195–216.
Cowan, J.L. (1965). The paradox of omnipotence– Analysis 25: 102–108.
Cowan, J.L. (1974). The paradox of omnipotence revisited– Can. J. of Philosophy 3: 435–445.
Dehaene, S. (1997). The number sense: how the mind creates mathematics. Oxford University Press.
Frankfurt, H.G. (1964). The logic of omnipotence– Philosophical Review 73: 262–263.
Geach, P.T. (1973). Omnipotence– Philosophy 48: 7–20.
Gödel, K. (1995). Collected Works: Volume III: Unpublished essays and lectures– (S. Feferman, J. W. D. Jr., W. Goldfarb, C. Parsons, & R. Solovay, Eds.). Oxford University Press
Hill, S. (2014). Giving up omnipotence– Can. J. of Philosophy 44: 97–117.
Mavrodes, G.I. (1963). some puzzles concerning omnipotence– The Philosophical Review 72: 221.
Nieder, A. (2025). The calculating brain– Physiological Reviews 105: 267–314.
Plantinga, A. (1967). God and other minds. Cornell University Press.
Savage, C.W. (1967). The paradox of the stone– The Philosophical Review 76: 74-79.
Schrader, D.E. (1979). A solution to the stone paradox– Synthese 42: 255–264.
Wikipedia (2024, November 7). Omnipotence paradox. https://en.wikipedia.org/wiki/Omnipotence_paradox.
Wreen, M. (2022). The contradiction approach to solving problems about omnipotence– TheoLogica 6: 52533.

A slightly modified version of this text is available at:

Budaev, S., (2024). The Omnipotence paradox reduces to the omniidiota dilemma. Available at SSRN: https://ssrn.com/abstract=5017222 (November 07, 2024) [PDF].

Det er enkelt å dele

2024-11-03T23:00:00+01:00

Informasjonsdeling innenfor en liten gruppe er brukes ganske typisk. For eksempel, hvis barna dine er i en skole eller barnehage, må du gå inn i en klassegruppe for å dele forskjellig informasjon, meldinger osv. Ofte proprietære sentraliserte plattformer som Facebook eller Whatsapp (Å, begge er i bunn og grunn det samme uetiske selskapet, Meta!) eller noen ganger Telegram.

Mange ikke-IT-folk bruker bare det de pleide å bruke i dagliglivet. De som er mer bekymret for personvern og sikkerhet til dem og barna deres, vil ikke bruke noen av Meta eller andre store teknologiske apper. Men det er andre og det er en behov til å kommunisere. Valget er enkelt: Enten blir du med i foreldregruppen på Facebook eller så blir du ekskludert. Hvis ekskludert, vil du ikke få oppdateringer om arrangementer, bursdager og så videre. De andre foreldrene vil kanskje se på deg med en viss mistanke: er du en spion eller en narkohandler som prøver å gjemme deg i en skygge av darknet? Dette er hva Cory Doctorow kaller "the nettwork effect." Og det utnyttes og promoteres av de gigantiske plattformene. De gjør sitt beste for å manipulere deg til å se på plattformen og reklame deres så mye tid som mulig, ideelt sett 24 timer i døgnet, og de lokker deg til å gi ut så mye privat data som mulig. Ingen vet hvordan disse dataene vil bli brukt i fremtiden. Det er skjult i usikkerhet. Den eneste sikkerheten er at brukerne utnyttes for andres fortjeneste.

Mens Facebook og andre prøver å pålegge enorme byttekostnader for å holde deg på plattformen, er det en enkel løsning som er tilgjengelig for alle. Det er den gamle gode e-posten. Alle har det nå. Men noen bruker det kun til å registrere seg på nettsider, få lenker til tilbakestilling av passord og lignende. Nei, e-post er fortsatt i live og er faktisk bedre enn mange pleide å tro.

Epostlister

Maillister er velkjente. Vanligvis brukes de bare å spam deg med unødvendig informasjon, reklame kampanjer og så videre. Men epostlister kan brukes til bedre. Det er noe åpen kildekode-programvare for e-postlistebehandling som du (jeg antar at du er administrator for gruppen) kan bruke på din egen server. Deretter kan du abonnere alle i gruppen på listen (eller nyhetsbrevet ditt). Okay– nå får alle i gruppen oppdateringer. Enkelt. Folk kan ha muligheten til å abonnere seg på listen, eller avslutte abonnementet seg selv (uten din, administratorens, manuelle handling). Det er nyttig.

Et eksempel på denne programvaren er Listmonk: https://listmonk.app
Non-rofit group service https://groups.io/

E-post diskusjonsgrupper

E-postdiskusjonsgrupper eller listserv er egentlig en eldgammel (et bedre ord: moden) teknologi som har blitt brukt for flere tiår siden. Den brukes fortsatt mye av programvareutviklerfellesskapet med åpen kildekode. For eksempel det berømte Linux kernel prosjektet. Ideen er bare triviell:

Du abonnerer på e-postlisten
Du får gruppens e-post ("listserv") e-postadresse, f.eks. foreldre@din.fqdn
Alle meldinger sendte en melding til denne gruppeadressen (ja, foreldre@your.fqdn) spres til hver abonnents postkasse.

Deretter, hvis du abonnerer, svarer det å svare på gruppeadressen til å dele e-postmeldingen med alle medlemmer.

Den gode gamle e-posten konkurrerer ikke om oppmerksomheten din med irrelevante og irriterende varsler, manipulerer deg ikke til å blikk og dumscrolling. Alt kommer bare til postkassen din. Du kan svare når som helst fra hvilken som helst enhet, ingen spesielle apper er nødvendig.

Men slutt, for å bruke listserv trenger du din egen (eller kontrollerte) e-postserver, domenenavn, kompetanse og tid for konfigurering og vedlikehold. Hvis du er modig nok, kan du konfigurere din egen GNU Mailman:

GNU Mailman: https://www.gnu.org/software/mailman

Men hvis du liker å unngå bryet, er det flere åpne servere som tillater registrering og gratis hosting for små ideelle grupper.

Det er også en Listserv on steroids som er gratis for små ikke-rpfit-grupper (opptil 1000 abonnenter, som vanligvis er nok):

Gaggle mail: https://gaggle.email

Her kan du:

Registrer din (admin) konto
Legg til gruppe-e-poster
Del, svarer, videresend gruppe-e-poster, med arkiver og mye annen funksjonalitet.

Doctorow, C. 2023. The internet con: how to seize the means of computation. Verso.

Durov, Telegram and responsibility

2024-08-26T18:00:00+02:00

The founder and head of the Telegram messenger, multimillionaire Pavel Durov was detained by police immediately after arrival at Le Bourget airport. French law enforcement have long been unhappy with Durov’s refusal to moderate content and to cooperate with authorities in disclosing information about users suspected of distributing drugs, child pornography, fraud and other criminal activity. Moderation is nearly nonexistent on Telegram except the most severe cases like islamist terrorism: usually banning their public channels.

However, Telegram did also cooperate with Putin's Russia authorities in banning Navalny's "smart voting." Durov's own explanation for this was that "it is better to ban Navalny than ban Telegram in Russia." This is clearly a deceit because a few years before that, Russian authorities have demonstrated their inability to block Telegram.

Durov is positioning himself as a hardcore libertarian protecting all kinds of freedoms, especially the freedom of speech and expression (against evil state). Many believe it is true, hence the wave of public support: #FreePavel.

The real picture is, however, quite different. Apart from the very extravagant personality of Pavel Durov (many still remember as he threw rouble banknotes from his St. Petersburg head office balcony for personal amusement), neither the Telegram platform nor the company in fact have anything in common with protecting liberties. Telegram is quite a standard commercial walled garden platform with the main aim to monetize its growing user base. "Privacy" for Telegram is nothing more than a marketing ploy.

Telegram is advertised as "secure" and "private" although it has from the beginning been devised as a centralized platform aimed to get exclusive control over its users' communication. There is no end-to-end encryption by default. The MTProto protocol used by Telegram is a home-made thing, never seriously audited by cryptography experts. The Telegram client is open source (and is even available in blob-free open source version on F-Droid), but the server is not. So nothing is known about what actually happens with the user's communication data and metadata. This is not a minor thing because Telegram keeps all the data on its cloud servers for user's "convenience." This means that all the messages are unencrypted (for Telegram), and potentially accessible to the third parties.

Fun, soon after Durov's detention in Paris, bureaucrats from the administration of the president in Russia, the ministry of defence and large state owned corporations were instructed to delete their Telegram communications. No, this won't help if everything is kept on the cloud servers. It is well known that Telegram has a reputation of "inaccessible to FSB" and therefore widely used by a range of Russian governmental and military users. These people have been reluctant to use the official "safe" and "encrypted" tools that have full FSB certification because they believe (quite reasonably) that these are all wiretapped. Telegram is also the common communication tool for Russian troops attacking Ukraine. Now it is easy to guess how confused and scared they are!

Every user of Telegram is identified with and linked to the mobile number, which is really a mockery of privacy. Participants of Hong Kong protests were able to verify this: the mobile numbers and therefore personal identity of many of them were easily obtained from by the "private" Telegram by the mainland Chinese police. To access the account of most users (two-step auth is not enabled by default, there is no password for most users!) the attacker just needs... access to the SMS, which is a trivial task for the mobile operator and therefore the law enforcement (or in many cases even a hacker using social engineering to reissue the SIM-card). Then the content is not encrypted, except for the "secret chats" that only few actually use.

Some years ago, Russian authorities tried to access Telegram contents of quite a few members of Putin's opposition by secretly coercing the mobile operators to forward authentication codes sent by SMS. Admins of quite a few Russian and Belorussian opposition chats and even regular subscribers were also identified. There exist several OSINT tools that help identify Telegram chatters, some are available for just everyone for a moderate price.

Not only privacy and security, but even data integrity of Telegram is questionable. The company protocols of dealing with the data are questionable. There are rumors that some years ago Durov himself deleted Telegram chats of his personal rivals at will.

Telegram is "free" to users, but running it incurs huge costs. Who pays then? The users actually pay for it with their ever accumulating private data (their privacy), their increasing flock size, traffic and now also paid subscription and the TON cryptocurrency.

Telegram has always been a secretive non-transparent company. There are rumors that its major investors include Emirates' funds with the major beneficiaries from Russia. Even though Durov usually denies any links with Russia, Telegram very likely significantly depends on Russian oligarchs' money. But little is still known about the financial affairs at Telegram. Also little is known about the organizational structure of Telegram. Nonetheless, everything looks like a single person--the CEO Pavel Durov--has the complete control over everything, from technology to HR, finances and relations with investors.

It looks like Durov has created a platform advertised for "freedom" and "privacy," inviting everyone for whatever purposes, even the most evil and criminal ones. But Telegram was deliberately created as a single centralized platform, apparently to benefit from the full control for profit. Full control, however, involves full responsibility, including law enforcement access and moderation.

"Guardians of internet freedoms" say that accusing Durov of complicity in crimes the users do is equal to accusing the manufacturer of a hammer: everyone can use it for nailing as well as for killing, all outside of the maker's control or even knowledge. But this is not true. In the case of Telegram, the instrument is not given to the users. Users do not possess it. They are just allowed to hold it for a while. Durov's situation is equivalent to renting out a hammer for securing profits, without asking if it is actually used for nailing or killing. And even knowing that in many cases it is in fact used for killing, breaking into houses and other criminal purposes. The purpose is profit. Then, those who rent out the hammer are responsible for what their paying users do with it. Any benefits obtained from criminal abuse of the hammer are complicity, even if indirect.

The only way to protect liberties and freedom of speech and expression is through decentralized or federated platforms. Then, the end user is the owner of the decentralized unit and bears full responsibility for his/her own use. Decentralized technology is not only safer and more secure, but also more responsible.

Bruk F-Droid i stedet av Google Play Store

2024-04-15T09:30:00+02:00

Googles Android Play Store blir verre over tid. Det blir stadig mer strødd med ubrukelige apper som utelukkende tar sikte på å vise reklame. I navnet av "personvern" gjennomfører Google ytterligere hindringer for både utviklere og brukere, mens ekte skadelig programvare blomstrer på plattformen. Det ofte blir et mareritt for utviklere av åpne kilde programmer som er fokusert på personvern og sikkerhet. Den nylige de-listingen av Snikket—en sikker, personvernsentrert melding app—viser at personalet som er ansvarlig for applikasjonsvurdering på Googles side, er mentalt forsinket idioter. Sjekk ut hele historien her: https://snikket.org/blog/snikket-google-play-removal/.

Google, er det slik at ansatter med IQ<50 koster mindre? Eller alle mennesker på Google ble erstattet med en AI som mangler intelligens? Mange utviklere gir opp å slite med idioter på Googles applikasjonsvurdering og slutter å distribuere appene sine i Play Store (her kommer en annet eksempel).

Situasjonen kan være så absurd at åpne kilde Conversations appen som går ikke fri (NOK 47) på Google Play måtte forringe funksjonaliteten på denne distribusjonsplattformen. Den samme appen går gratis med fult funksjonalitet på F-Droid.

Men det er en løsning for alle Android-brukere: bare installer F-Droid, en appbutikk som publiserer åpne kilde programmer uten reklame, traking, datalekkasjer, skadevare og bakdører.

F-Droid: https://f-droid.org/

Den eneste garantien mot skadelig programvare er åpen kildekode som alle som helst kan sjekke og revidere: mange øyne oppdager problemer tidligere og bedre. F-Droid gjennomfører "reproducible builds" som sikrer at binær apk bloben er bygget av samme kildekoden som utvikler har publisert, så det finnes ikke noe uautorisert tilleg eller endringer (apk fra Google Play inkluderer Googles blober for reklame og tracking). Det anbefales å søke apper først på F-Droid og gå til Google Play kun når den ikke er tilgjengelig. Da skal Google Play brukes bare for apper som er klarert på forhånd, f.eks. banken.

A year with Mikrotik router

2024-03-19T23:00:00+01:00

I use NextGenTel with fibre broadband connection as my home Internet provider. The connection line works fairly well with no interruptions. I have been using a Mikrotik router for nearly a year now and have experienced no single interruption. No hanging internet, no problems at all. I nearly forgot that it is here.

Why I love Mikrotik is the Router OS, a professional operating system with tons of configurability and fine tuning. You can tweak any aspect and configure a variety of services. For example VPNs with different protocols for connecting into the local home network is easy to configure using the Mikrotik documentation. Queues are a nice configuration feature to control and manage bandwidth given to devices in the local network. There is also quite advanced scripting that can be used to do many interesting things. I do not recommend Mikrotik to an average user, however, because Router OS has a professional interface with too many options and details: you need to understand what you are doing. Mikrotik is a Latvian company that makes a lot of professional carrier-grade equipment, all run the same OS.

The previous router provided by the NextGenTel was pure disaster. I in fact used two different units of the same marque: Inteno.

This shit router tended to hung up at least one or twice a week, leaving no connection. The NextGenTel support was useless, with the routine advice to reboot router. Rebooting helped indeed until the next hangup, maybe the next day. It is not a solution to fix bad hardware. It is so weird that they supply their users with this shit when the competition between providers is so intense. Many people would not figure out that it is the router that is so bad and will blame NextGenTel as a whole and switch to another provider. Shame, NextGenTel.

But if you subscribe for the home telephone line with NextGenTel, then you are out of luck because telephone is served by the Inteno router which also includes a SIP service via built in Asterisk server pre-configured by the provioder. The only solution is then to torture NextGenTel with service requests and replacing the router. (But, of course, a better alternative is to set up your own asterisk-based SIP VoIP server with trunks from any of the many available SIP providers; this will be much more flexible and cost-effective solution).

Shit happens: det kommer garantert til å skje hvis dumhet gjentas

2023-12-31T10:00:00+01:00

Shit happens. Det er en triviell visdom. Ofte er det en direkte konsekvens av en enkelt stupid ting. I mange tilfeller kan lite gjøres for å forhindre det skal skje. Uansett, sannsynligheten antas veldig lav. Katastrofen er uforutsigbar. Det er en ulykke, helt tilfeldig. Ikke sant?

Det gjelder for en enkelt hendelse. Kanskje en enkelt hendelse av dumhet eller klønete... Men hvis toskeskap gjentas (f.eks. hvis det er en vane) er situasjonen en helt forskjellige. Sannsynligheten av shit som skal skje er nå

her er P(1|n) sannsynligheten for at shit skjer minst én gang i en gruppe av n hendelser; hver hendelse har sjansen p (veldig lav!) til å skje, og n er antall hendelser.

For eksempel, hvis sjansen for en singel ulykke er så lavt som 0.01 og antallet dumme handlinger er 365 (bare en gang om dagen i løpet av et år), blir sjansen for at shit skjer i løpet av denne tiden

Det er nesten sikkert at shit skjer minst én gang i løpet av et år.

Drikker du kaffe/brus/smoothie/vin på den bærbare datamaskinen til vanlig? Forberede for å erstatte tastaturet. Det vil skje.
Vant til å sende sms mens du kjører? Har du en god forsikring?
Løper ofte over veien foran lastebil/buss/bil? Det er på tide å bestille krykker (eller enda kiste) på forhånd.

Telefonen til et barn

2023-11-05T14:00:00+01:00

Både voksne og barn blir stadig mer avhengige av smarttelefonene sine. Et morsomt begrep for slike rusavhengige er smarttelefonzombie. Men dette er ikke morsomt. Faktisk, smarttelefoner dreper. For eksempel har det vært en økning i antall dødsfall hos barn fordi barna sitter klistret til telefonene sine

Smartphone zombies: Child road deaths spike because kids are glued to their phones

Stadig flere barn nå eier smarttelefoner. Nesten alle ungdommer eier en smarttelefon i Norge, Storbritannia, USA og mange andre land. Smarttelefonavhengighet er en verdensomspennende plage (Olson et al., 2022).

Imidlertid, forskning viser at smarttelefonavhengighet fører til en rekke alvorlige psykologiske, helse- og velværeproblemer, inkludert nevrologiske lidelser (e.g. Ratan et al., 2022; Achangwa et al., 2023). Mange undersøkelser viser at bruk av smarttelefoner påvirker studentenes akademiske prestasjoner negativt (e.g. Amez & Boert, 2020; Sapci etal. 2021).

Smarttelefonen din er en dedikert spionenhet, men enda mer bekymringsfull er det faktum at apper målrettet mot barn sporer, samler inn personlige data og laster dem opp til ukjente tredjeparter (e.g. Reyes et al., 2018). Men det handler ikke bare om data og reklame. Smarttelefoner kan direkte påvirke fysisk sikkerhet av barn. En russisk studie indikerte at nesten 50% av barna får nye bekjentskaper i sosiale medier og 36% av dem møter disse nye menneskene i virkeligheten etterpå (Kaspersky Lab, 2022).

Vi må løse en avveining mellom behovet for å kommunisere med barna våre, men unngå avhengighet. Så hva er løsningen? Jeg tror det er en kombinasjon av gammel stil (men ikke foreldet!) knapptelefon og et stort nettbrett.

Knappetelefoner er klassiske, men ikke udaterte!

Fordeler med knappetelefon, i tillegg til at det neppe forårsaker avhengighet, inkludere

BATTERI fungerer lange eller veldig lange, ingen grunn til å tenke på lading, det er liten risiko for å sitte igjen med en død, utladet telefon i det mest uleilige øyeblikket. Batteriet dør ikke i kulden. Batteriet er avtakbart og kan enkelt skiftes ut. Det er ingen risiko for at barnet vil lade ut batteriet på grunn av intens spilling på telefonen. Det vil ikke skje i verste øyeblikk, for eksempel når han eller hun trenger hjelp fra foreldrene
SIKKERHET: det er ingen konstant tilkobling til Internett, viktige data, passord, personlige dokumenter, kredittkortdata lagres ikke på telefonen: det er ingen risiko for lekkasje eller hacking, selv om telefonen er mistet eller stjålet. Plasseringen kan ikke spores og lekkes. Mange hackere og sikkerhetseksperter bær ikke smarttelefoner. Men knappetelefonen tjener sin hovedfunksjon, kommunikasjon, helt perfekt.
PRIS telefonen er billig, ikke bry deg om det, den er lett å erstatte hvis den er ødelagt, mistet eller druknet. Men dette er spesielt viktig siden du alltid har telefonen med deg. Barn er ofte uforsiktige og kan bryte ned ting.
FYSISK STYRKE: En liten skjerm, sterk telefon, går ikke i stykker med det minste fall, mindre utsatt for vann. Jeg har erfaring med at en telefon ble vasket i vaskemaskin og fortsatte å virke etterpå.
FYSISK KNAPPER er fortsatt et av de beste brukergrensesnittene, praktisk å bruke. Du kan konfigurere ett-tasts hurtigvalg. Knapper er også lettere å bruke med hansker i kaldt vær.
STØRRELSE en liten telefon passer lett i lommen. Det er bare praktisk.
IKKE FORELDET en trykkknapptelefon kan betraktes som en "fysisk app" som ikke blir foreldet og rett og slett alltid fungerer uten å kreve konstante "oppdateringer."

Knappetelefon blir ofte sett på som noe enkelt og kjedelig, selv om det ikke er helt utdatert. Men det finnes noen få moderne, elegante, designertelefoner, for eksempel Punkt (overpriset!).

Nettbrett gir mye bedre brukeropplevelse

Men vi kan ikke frata barna våre internett, spillkommunikasjon med venner og alt annet som en smarttelefon gir! Riktig nok, men det finnes et bedre enhet enn smarttelefon: nettbrett

STOR SKJERM: nettbrettet har en stor skjerm som gir mye bedre brukeropplevelse for alle bruksområder: Internett, video, spill, tegning, skriving og til og med lydsamtaler. En stor skjerm kan bare ikke sammenlignes med den lille skjermstubb på typisk smarttelefon. Det er mye bedre for alle slags kreative aktiviteter.
LAVERE ER BEDRE: Det er ikke så lett å ta en tablett med deg hele tiden. Med andre ord er tilgjengeligheten lavere og det er noen små kostnader forbundet med bruken. Faktisk må du gå til laderen eller et bord, ta nettbrettet og først deretter bruke det. Det er ganske stor forskjell fra smarttelefonen som ofte alltid ligger i lommen. Dette gjør det mindre sannsynlig at du blir avhengig av et nettbrett.
STOR OG MERKBAR: Bruk av nettbrett er lettere å legge merke til. Dette gjør det også lettere for foreldrene å overvåke og kontrollere barnas nettbrettbruk.

Konklusjon

Konklusjonen er denne: i stedet for en smarttelefon, er det tilrådelig å gi en grunnleggende knappetelefon til barnet ditt å bære med seg. Men de bør også eie et nettbrett hjemme for å bruke til internett, videoer, spill, studier og alt smarttelefonen som normalt brukes til.

Anbefalt lesing

Gabrielsen, Bjørn (2020) Skjermslaver: hva skjermene har gjort med oss, og hva vi kan gjøre med dem. Kagge (ISBN: 9788248925231).

Oppdatering: lenker

XMPP server on 1-2-3

2023-10-10T10:00:00+02:00

Messaging continues to be of rise. The new generation is more willing to send texts than to call. Communicating with an instant messenger has an unique advantage over the old good email: you can easily send replies over replies quickly, resulting in a dialogue. But there is a serious problem: many of the instant messengers are commercial products that work such that their "users" are in fact the exploitable resource having no control or choice.

Most corporations are fair providers of various products and services we can buy. But not these "Big Tech" that offer "free applications," including instant messengers. There is, obviously, nothing free on the Earth. Then, if you do not pay, then you are the product not the customer. The Big Tech corporations exploit the "end-users" to suck out private data, often for further resale. Nearly all of these messengers have centralised architecture and the user's account is linked to the telephone number, completely destroying privacy. The link to the telephone number is also very inconvenient because you cannot get several accounts easily, this requires obtaining several mobile subscriptions. It's just illogical, expensive and silly. Centralized architecture dictates that the communication is kept on the corporate servers so theoretically many employees can read messages by abuse.

Some of the products are advertised as end-to-end encrypted. But nearly all of them are closed source so there is no way to check how this is implemented and if and when the service owner can have access to private messages content. Moreover, we have evidence for the opposite. Many so called "end-to-end encrypted" messages are actually read by AI and human contractors. Even if communication is technically end-to-end encrypted, the company owns and fully controls the server, the client application and network traffic, so a man-in-the-middle attack by silently changing certificates is possible (e.g. in the context of lawful intercept, or unlawful abuse). Metadata (technical information information about all aspects of communication, including the addressees, their locations, IP addresses, telephone number etc.) is always accessible to the service. But metadata is often even more informative than the message content. How such metadata is used is typically unclear. The user has no authority here at all.

Nearly all of these messengering systems have closed proprietary protocol. This means that how you use the product is completely controlled by the owner company. The only way to use the product is with the official application. You cannot just choose for yourself which application program to use. This is cardinally different from the email, for example, where you can use the provider's web interface, its mobile app or any of the many available email applications such as Thunderbird or K-9 Mail. With such a third-party application you can easily consolidate several email accounts in one place and easily make use of the functionality the provider does not offer, such as end-to-end encryption. Another major problem is monopoly and lack of interoperability. The "users" (in reality, the exploited resource) are completely restricted to the owner's platform and are unable to communicate with the other (especially competing) platforms (e.g. Facebook to Snapchat) as a way to keep users within the silo. This is as if you were unable to call/send sms across different mobile operators. And this is silly. To break down monopoly, ensure fairer competition and interoperability across the services, the EU has developed the Digital Markets Act (DMA) regulation. This is a big step, but it does not solve many of the problems with centralization, privacy and regular security flaws.

Take back your freedom, privacy and security

So, why use the restricted, inconvenient, monopolistic, insecure and non-private platforms for the trivial task of sending instant messages? There are several ways to configure one's own privately controlled instant messaging system: XMPP and Matrix. XMPP is lightweight, easy to install, and more private and secure, yet covers all the typical instant communication purposes: text, file share and voice. Moreover, XMPP servers are by default federated: it is easy to send messages across the different servers like in the email. There are many different applications for all operating systems and platforms the user can choose. Update: XMPP can communicate with federated Matrix network because ejabberd now implements a Matrix gateway. (By the way, ejabberd also works with SIP, standard VoIP telephony protocol, and MQTT, an IoT protocol.)

A nice thing is that even if you use a particular XMPP server provider, you can easily migrate your whole account from it to a different one. Avoiding vendor or provider lock-in is a good thing for many reasons. You may not be satisfied with security, reliability or usability of your service, updated TOS, or anything else. Or may just decide to migrate from a public server to your own self-hosted solution. There are several tools, just check out the XMPP Account Portability project.

It is very easy to set up one's own XMPP server for a small group, company, the family or just an individual. You will need two things:

Server that will be the central hub for the communication network running 24x7. This can be anything, from a Rasberry PI in a cupboard to a Virtual Private Server (VPS) somewhere in a data centre or just an old PC running in your basement. A small scale VPS useful for an XMPP server can be very cheap, up to a three Euro per month. There exist even cheaper options, such as EUR 6 per year. There are also dedicated search engines to help locate cheap VPS, e.g. LowendBox and ServerHunter. A typical operating system running on the server is Linux (very secure, highly configurable, free and open source).
Domain name that needs to be used to connect to the XMPP server. Domain can be registered to the user (e.g. myname.no), which costs about 30 Euro yearly. But a sub-domain can be obtained for free using the https://freedns.afraid.org or similar "free DNS" services. In the later case you might have something like myownchat.mooo.com or myownchat.ptchat.net. Other free DNS options include Github pages, EU.org, is-a.dev, and DuckDNS. It is possible to run the XMPP server purely on IP address even without domain name, but it is much less convenient (e.g. then federation with other servers is lost).

Given you have got a server (VPS or dedicated machine) and the domain, configuring an XMPP server can be done on 1-2-3. There exist several Linux variants (distributives) with different management commands (usually for installing software). I assume Debian Linux is used below (the same commands also work for Ubuntu and other Debian-based Linux systems).

Grab a working configuration template and adjust according to your domain name and IP address:

Example configuration: ejabberd.yml

GitHub: https://github.com/sbudaev/xmpp-1-2-3

1. Install XMPP server software

Login. When you have got a server of any kind, you need tologin to it, typically with ssh:

ssh debian@1.2.3.4

here the user name on the server is debian and the server ip is 1.2.3.4. Typically, you may need to create the ssh key and upload it to the server to authenticate (refer the server documentation, e.g. this). I assume logging-in is not a problem.

Prepare server. First of all, update the software on the new server

sudo apt update -y && sudo apt-get upgrade -y

Install some useful monitoring and security-enhancing utilities

sudo apt install -y mc htop atop nload nmon tree zip pwgen fail2ban dnsutils iptables-persistent locate unattended-upgrades

Install certbot, a system that manages the TLS certificates for secure connection

sudo apt -y install certbot

Install the ejabberd server, which is is very reliable and light on resources. It is also very secure, with few vulnerabilities found for years (see this)

It is strongly recommended to install ejabberd package repository as explained here: https://repo.process-one.net/. Then ejabberd software will automatically update without need to download every new version from the site (use standard Debian command as sudo apt update && sudo apt upgrade).

sudo apt install ejabberd

Firewall. To allow incoming network access to this server by the XMPP clients and also third-party servers, the server needs to configure the firewall rules. This can be done differently in different installations. For example, some VPS may do this using a friendly web interface. The standard Linux firewall is done via iptables.

The XMPP system requires incoming acces via ports 5222, 5223, 5269, 5443, 5280, 3478. To determine the ports refer to the listen section of the XMPP configuration file below.

 sudo iptables -A INPUT -p tcp --dport 5222 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
 sudo iptables -A INPUT -p tcp --dport 5223 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
 sudo iptables -A INPUT -p tcp --dport 5269 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
 sudo iptables -A INPUT -p tcp --dport 5443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
 sudo iptables -A INPUT -p tcp --dport 5280 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

 # STUN is over udp
 sudo iptables -A INPUT -p udp --dport 3478 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

The port 7777 is used for a proxy for peer-to-peer (bytestream) file transfer. If peer-to-peer file sharing is intended for use, an additional rule should be set allowing incoming connections:

sudo iptables -A INPUT -p tcp --dport 7777 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

To see what firewall rules are in effect issue this:

 iptables -L --line-numbers

It makes sense to save the iptables rules so they are automatically get in effect after reboot

 iptables-save > /etc/iptables/rules.v4

2. Configure your XMPP server

Secure connection certificate. Get a free Let's Encrypt TLS certificate. I assume you have got a free domain myownchat.ptchat.net from https://freedns.afraid.org.

XMPP server will iideally need several subdomains (although may work with a single domain). In our case these are the following:

primary domain name: myownchat.ptchat.net
conference: conference.myownchat.ptchat.net
proxy: proxy.myownchat.ptchat.net
pubsub: pubsub.myownchat.ptchat.net
upload: upload.myownchat.ptchat.net

Note that ejabberd can manage (issue and update) TLS certificates on its own, but this needs some configuration as described in the acme configuration option: https://docs.ejabberd.im/admin/configuration/basic/#acme. An advantage of the standalone certificate management system (as here) is that it is slightly less tricky and can easily be used with a web server on the same machine. Why not also configure a web server for a small static web site here? Ejabberd is very lightweight and will happily coexist with many other servers running on the same machine. If a stand-alone XMPP server is required, check out the last section of this post on configuring acme. For now, do not configure TLS certificates certfiles: in the ejabberd.yml file, leave them as is with the default cerrtificates.

Before requesting certificate, you must be sure that incoming connections on the port 80 of the server are not blocked by firewall. If this is not so (port closed), use the following command:

sudo iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

Do not forget to save iptables rules with the iptables-save as above.

Now, it is time to request the certificate. Do this (minimal) command:

sudo certbot --standalone certonly -d myownchat.ptchat.net

or for all subdomains domains (strongly recommended!):

sudo certbot --standalone certonly -d myownchat.ptchat.net -d conference.myownchat.ptchat.net -d proxy.myownchat.ptchat.net -d pubsub.myownchat.ptchat.net -d upload.myownchat.ptchat.net

(note that the above is one line)

This command will ask a few questions and issue a TLS certificate.

The certificate files are located in /etc/letsencrypt/live/myownchat.ptchat.net/fullchain.pem directory.

For the sake of security, the certificate directories have by default no access to anyone except the admin (root) user. But this precludes the XMPP server ejabberd to access the certificate. This can be easily fixed with the following commands

First, add ejabberd to the root group

sudo adduser ejabberd root

Second, allow access to the certificate directories to the group

sudo chmod g+rx /etc/letsencrypt/live/myownchat.ptchat.net
sudo chmod g+rx /etc/letsencrypt/live
sudo chmod g+rx /etc/letsencrypt/

Configure ejabberd. Once the preparations are done, it is time to configure the ejabberd messaging server. Edit the configuration file (assuming the mcedit text editor is used)

Check out example configuration here: ejabberd.yml

sudo mcedit /etc/ejabberd/ejabberd.yml

This is a long configuration file that may look scary. But in fact only a few changes are required to make the server running with the default options. But note that the indents are important, try to keep them as in the original file.

Any line starting with # is considered a comment, this can be easily used to disable specific options by "commenting them out."

First, set up the host name that is used for the server, it is the same as the domain:

 hosts:
  - myownchat.ptchat.net

Second, configure the location of the TLS certificates that are used by the server:

 certfiles:
  - "/etc/letsencrypt/live/myownchat.ptchat.net/fullchain.pem"
  - "/etc/letsencrypt/live/myownchat.ptchat.net/privkey.pem"

Configure how user passwords are stored on the server. While the default is plain text plain, it is more secure to use scram:

auth_password_format: scram

(Check out the doc:https://docs.ejabberd.im/admin/configuration/authentication/#supported-methods)

Configure the admin users who can manage the XMPP server:

 acl:
   admin:
      user:
       - "my_user_name@myownchat.ptchat.net"
       - "@localhost"

Then, add configuration for http-file-upload module that will allow file sharing (sending files):

 mod_http_upload:
    put_url: https://@HOST@:5443/upload
    custom_headers:
      "Access-Control-Allow-Origin": "https://@HOST@"
      "Access-Control-Allow-Methods": "GET,HEAD,PUT,OPTIONS"
      "Access-Control-Allow-Headers": "Content-Type"

It is convenient to keep the latest messages on the server, it is done with the "mam" module:

 mod_mam:
   assume_mam_usage: true
   default: always

Ejabberd supports several other communication protocols in addition to XMPP. For example, it also works with MQTT that is typically used for IoT devices. If this functionality is not used, just comment out the MQTT module to disable it.

 # mod_mqtt: {}

The STUN and TURN protocol is mainly used for voice calls and needs the actual IP address of the server (replace with your server IP addfress)

 -
   port: 3478
   ip: "::"
   transport: udp
   module: ejabberd_stun
   use_turn: true
   ## The server's public IPv4 address:
   turn_ipv4_address: "1.2.3.4"

An important issue is wether to allow anonymous registrations of new users. I strongly recommend not allowing this for security reasons. For a small private server, you will normally add users manually and set them initial passwords. Every user can then change password within the client program. So, you need to disable access to the mod_register:

  mod_register:
    ## Only accept registration requests from the "trusted"
    ## network (see access_rules section above).
    ## Think twice before enabling registration from any
    ## address. See the Jabber SPAM Manifesto for details:
    ## https://github.com/ge0rg/jabber-spam-fighting-manifesto
    #ip_access: trusted_network
    ## Allow change password by users
    access: none

Start server! And that's all minimal configuration. Now it's time to start the server:

sudo systemctl start ejabberd

If there are any errors and the server fails to start, Linux logs can be inspected with this command:

sudo journalctl -xe

or logs for only ejabberd:

sudo journalctl -xe --unit ejabberd

Additional stuff. The above is enough to make the XMPP server running for text. If voice is required, you need to configure the DNS as described here: https://www.process-one.net/blog/how-to-set-up-ejabberd-video-voice-calling/. DNS is normally configured using the control panel of the domain registrar.

The TLS certificate that is managed by certbot is updated each 90 days. This is an automatic process, but the ejabberd server must know when certificate is changed. This can be done using the deploy hook. Just create the hook file reloadxmpp.sh (the file name can be anything):

 sudo mcedit /etc/letsencrypt/renewal-hooks/deploy/reloadxmpp.sh

and add the following commands:

 #!/bin/sh
 ejabberdctl reload_config

This file must be executable, so issue this command:

 sudo chmod ugo+x /etc/letsencrypt/renewal-hooks/deploy/reloadxmpp.sh

The last note on the server is that it should be regularly updated for bug fixes and security updates. This is done automatically by installing unattended-upgrades above. Yet, it is a good practice to log in regularly over the ssh, check logs and update the system:

sudo apt update -y && sudo apt-get upgrade -y

There is a web admin panel (enabled by request_handlers: "/admin": ejabberd_web_admin line in the configuration file at the address https://myownchat.ptchat.net:5443/admin. Only the admin user(s) have access to it. But it is very useful for controlling the system, such as adding new users or removing users.

3. Configure the XMPP users and client application

Register new users. First, you need to register the XMPP users. The quickest method is to use the command line on the server, the command ejabberdctl has advanced functions.

A secure random password can be generated withy pwgen, e.g. the following generates passwords with 18 symbols:

pwgen 18

It normally generates an array of possible passwords to choose from.

Now, to register the user myname, It is the admin user configured in the main configuration file /etc/ejabberd/ejabberd.yml above.

#                         user   domain               password
sudo ejabberdctl register myname myownchat.ptchat.net pee8chogh9Heel6hei

Other users can be configured similarly. Note that the full user name for XMPP has the same format se email: myname@myownchat.ptchat.net. This is due to the federated nature of both systems: you need to know both the user and the server with whom to communicate.

For this example let's register two additional users:

sudo ejabberdctl register john.dow myownchat.ptchat.net ohyeeLeefo9yief4gu
sudo ejabberdctl register anna.karenina myownchat.ptchat.net hejo7phiy2iFeW9She

Use! The final step is configure the client program on the user's device. The biggest difficulty at this step is the plenty of choice. For any major platform, one can choose any of the many available XMPP client programs. Some email programs, e.g. Thunderbird also support XMPP (although only a limited subset of features). Check out the https://xmpp.org. The configuration for the client is simple:

Server: your server, in the example above it is myownchat.ptchat.net
User name: your user name. In the example we used above, it can be myname

Note that the option to create new account must NOT be enabled as long as the account has already been created on the sever and the in-band registration (mod_register, see above) is disabled for security.

Some programs accept the full user name without specifying user and domain separately. Then the user is just myname@myownchat.ptchat.net. If you plan to use the peer-to-peer (bytestream) file transfer (but this is not mandatory), you should also find where the file transfer proxy is configured and set it with the proxy subdomain, for our example it should be proxy.myownchat.ptchat.net. And that is all for basic client configuration.

I recommend the Monocles XMPP application for devices running Android. Yaxim is the best option for minimalists, it is notoriously miniature (only a few megabytes) and works great even on the oldest and weakest devices. Gajim is perhaps the best XMPP client for Windows and Linux. Miranda NG is a powerful XMPP client program for Windows. There are also a few web-based clients: https://conversejs.org/ and https://web.xabber.com/ that you can try right away without installing anything. There is also a new cross-platform Fluux - check it out!

The final step is to fill the contact list (called roster) with the addresses of the people (or maybe devices, because XMPP can be easily configured for bots accepting commands). Just remember that the address is full name as in email: user@server.domain. One useful option is so called Shared roster groups: then you can configure a group of contacts without the need to add them manually.

Happy chatting!

Further

There are many advanced options and possibilities in ejabberd. Just check the documentation at the official web site: https://www.ejabberd.im/ and documentation https://docs.ejabberd.im/.

There are also a few useful tutorials that you may find useful e.g.

Secure connection for a stand-alone XMPP server

If you really like a stand-alone XMPP server that does not depend on certbot to get and update TLS certificates, ejabberd configuration can proceed slightly differently. Check outthis link:

https://docs.ejabberd.im/admin/configuration/basic/#acme.

First, XMPP server will request the certificate and automatically update it itself as needed. But server is normally running with limited rights and has no access to the local port 80. No problem, port 80 can be forwarded using a few different tools. The simplest is sslh.

Port forwarding with sslh. Install sslh with

 sudo apt install sslh

Configure sslh to forward ports as needed, edit /etc/default/sslh file:

 DAEMON_OPTS="--user sslh --listen 0.0.0.0:80 --listen 0.0.0.0:443  --http 127.0.0.1:5280 --ssl 127.0.0.1:5443 --xmpp 127.0.0.1:5223 --pidfile /var/run/sslh/sslh.pid"

This makes sslh listen on both ports 80 (unenctypted http) and 443 (encrypted TLS) and forward the traffic depending on the protocol to the appropriate software. Note that this configuration also forwards traffic from port 443 to 5223 for more resilient direct TLS connection.

To enable the new configuration, restart sslh with

 sudo systemctl restart sslh

Configure acme in ejabberd. Now it's time to go the ejabberd configuration 'ejabberd.yml'

Fixed certificates are not needed any more then, comment them out:

#ca_file: /opt/ejabberd/conf/cacert.pem

#certfiles:
#  - /opt/ejabberd/conf/server.pem

Now check go to the listen part of the ejabberd configuration

listen:

And make this config:

listen:

# other congigs there

  # confugure for acme
  -
    port: 5280
    #ip: "::"
    module: ejabberd_http
    tls: false
    request_handlers:
      /.well-known/acme-challenge: ejabberd_acme

Now go somewhere above module configurations (modules:) and place the following

# ACME is enabled
acme:
    auto: true
    contact: "mailto:postmaster@your_email.fqdn"
    ## Staging environment
    ca_url: https://acme-staging-v02.api.letsencrypt.org/directory
    ## Production environment (the default):
    #ca_url: https://acme-v02.api.letsencrypt.org/directory

This uncomments temporary staging environment for checking and comments out the working config. Use it for initial tessting only.

Restart server for the configuration change to take effect

 sudo systemctl restart ejabberd

Now check that certificate request is working

ejabberdctl  request-certificate all

This will request certificates for all domains and subdomains

If there are no errors, comment out the staging environment and enable the production environment in the acme section:

# ACME is enabled
acme:
    auto: true
    contact: "mailto:postmaster@your_email.fqdn"
    ## Staging environment
    #ca_url: https://acme-staging-v02.api.letsencrypt.org/directory
    ## Production environment (the default):
    ca_url: https://acme-v02.api.letsencrypt.org/directory

Restart server for the configuration change to take effect

 sudo systemctl restart ejabberd

Now get the certificates!

 sudo ejabberdctl  request-certificate all

Check the certificates with

 sudo ejabberdctl list-certificates

If everythig went okay, ejabberd will care about TLS certificate update itself in the future. It's all for this section.

Make file upload more resilent Make use of port forwarding by sslh 443 to 5443 for XMPP file upload. This will help share files in restricted environments that do not allow access to ports except 443.

For this, go to the mod_http_upload configuration and make a copy of the line with the put_url parameter as before and comment out the line with :5443

  mod_http_upload:
    #put_url: https://@HOST@:5443/upload
    put_url: https://@HOST@/upload
    thumbnail: false
    access: local
    custom_headers:
      "Access-Control-Allow-Origin": "*"
      "Access-Control-Allow-Methods": "GET, POST, PUT, OPTIONS, DELETE"
      "Access-Control-Allow-Headers": "Content-Type, Origin, X-Requested-With"

Restart server to make this change to take effect

 sudo systemctl restart ejabberd

Now try to connect and send file, if there are problems that are hard to fix, you can revert port 5443 use.

Simple web server

The stand-alone configuration of ejabberd allows slso to use it as a simple stand-alone web server. Then, one needs to add a reference to the mod_http_fileserver module in the appropriate 'listen' section request_handlers. Best use port 5443 that will forward from sslh 443. Then common URL can be used to access the content.

Here is an example, check out the last line. It shows that the URL starting with just / will be served by the mod_http_fileserver module, efficiently serving https://myownchat.ptchat.net:5443/.

  -
    port: 5443
    ip: "::"
    module: ejabberd_http
    tls: true
    request_handlers:
      "/admin": ejabberd_web_admin
      #"/api": mod_http_api
      "/bosh": mod_bosh
      #"/captcha": ejabberd_captcha
      "/upload": mod_http_upload
      "/ws": ejabberd_http_ws
      #"/oauth": ejabberd_oauth
      "/conversejs": mod_conversejs
      # Web server configuration
      /: mod_http_fileserver

Additionally, you also need to configure the mod_http_fileserver module. Below, the root will refer to the directory /opt/www (docroot parameter), allowing use the browser address https://myownchat.ptchat.net. Also, the index files are defined by directory_indices parameter: this is the name of the file that is returned and shown by default. Such a configuration is an easy way to make a launch page for the server with a hyperlink to the conversejs https://myownchat.ptchat.net/conversejs. Just place an appropriately written index.html into /opt/www.

  mod_http_fileserver:
    docroot:
      /: /opt/www
      directory_indices: ["index.html", "index.html"]

Check out documentation here: https://docs.ejabberd.im/admin/configuration/modules/#mod_http_fileserver

Example configuration file

Here you can download an example configuration file for a stand-alone XMPP server that controls the acme-based update of TLS itself. Adapt it to your needs.

Download example configuration: ejabberd.yml (or GitHub: https://github.com/sbudaev/xmpp-1-2-3)

Note that this configuration also enables conversejs web interface and http file server for the landing page.

Note that to make OMEMO end-to end encryption functional in the ConverseJS installation, you need to download the latest release from https://github.com/conversejs/converse.js/releases and place it somewhere on the server (the configuration uses path defined in conversejs_resources:, here"/opt/lib/conversejs/package/dist"). then make subdirectory /opt/lib/conversejs/package/dist/plugins and place all libsignal-protocol "js" files to plugins. Check out documentation here: https://docs.ejabberd.im/admin/configuration/modules/#mod_conversejs

###
###           ejabberd configuration file
###
### The parameters used in this configuration file are explained at
###
###       https://docs.ejabberd.im/admin/configuration
###
### The configuration file is written in YAML.
### *******************************************************
### *******           !!! WARNING !!!               *******
### *******     YAML IS INDENTATION SENSITIVE       *******
### ******* MAKE SURE YOU INDENT SECTIONS CORRECTLY *******
### *******************************************************
### Refer to http://en.wikipedia.org/wiki/YAML for the brief description.
###
### $Id: ejabberd.yml 1790 2026-03-14 15:30:37Z budaev $
###

hosts:
  - "myownchat.ptchat.net"

loglevel: info
log_rotate_size: 5242880
log_rotate_count: 4

# Default database type for a module lacking db_type option or if 
# auth_method option is not set.
default_db: mnesia

# The option defines in what format the users passwords are stored, plain text
# or in SCRAM format:
# scram: The password is not stored, only some information required to verify
# the hash provided by the client. It is impossible to obtain the original
# plain password from the stored information; for this reason, when this value
# is configured it cannot be changed to plain anymore. This format allows
# clients to authenticate using: SASL PLAIN and SASL
# SCRAM-SHA-1/256/512(-PLUS). The SCRAM variant depends on the auth_scram_hash
# option.
auth_password_format: scram

#ca_file: /opt/ejabberd/conf/cacert.pem

#certfiles:
#  - /opt/ejabberd/conf/server.pem

listen:
  -
    port: 5222
    ip: "::"
    module: ejabberd_c2s
    max_stanza_size: 262144
    shaper: c2s_shaper
    access: c2s
    starttls_required: true

  # Direct-TLS for C2S (XEP-0368). Good practice is to forward  traffic from
  # port 443 to 5223, possibly multiplexing with HTTP using e.g. sslh
  # [https://wiki.xmpp.org/web/Tech_pages/XEP-0368], so modern clients can
  # bypass restrictive firewalls (in airports, hotels, etc.).
  -
    port: 5223
    ip: "::"
    module: ejabberd_c2s
    tls: true
    max_stanza_size: 65536
    shaper: c2s_shaper
    access: c2s
  -
    port: 5269
    ip: "::"
    module: ejabberd_s2s_in
    max_stanza_size: 524288
  -
    ## s2s with tls enforced
    port: 5270
    ip: "::"
    module: ejabberd_s2s_in
    max_stanza_size: 524288
    shaper: s2s_shaper
    tls: true
  -
    port: 5443
    ip: "::"
    module: ejabberd_http
    tls: true
    request_handlers:
      "/admin": ejabberd_web_admin
      #"/api": mod_http_api
      "/bosh": mod_bosh
      #"/captcha": ejabberd_captcha
      "/upload": mod_http_upload
      "/ws": ejabberd_http_ws
      #"/oauth": ejabberd_oauth
      /conversejs: mod_conversejs
      /: mod_http_fileserver

  # confugure for acme
  -
    port: 5280
    #ip: "::"
    module: ejabberd_http
    tls: false
    request_handlers:
      /.well-known/acme-challenge: ejabberd_acme

  # needed for audio/video, see
  # https://gist.github.com/iNPUTmice/a28c438d9bbf3f4a3d4c663ffaa224d9#notes-for-server-admins
  -
    port: 3478
    ip: "::"
    transport: udp
    module: ejabberd_stun
    use_turn: true
    ## The server's public IPv4 address:
    turn_ipv4_address: "111.222.333.444"
    ## The server's public IPv6 address:
    # turn_ipv6_address: "2001:db8::3"

#  -
#    port: 1883
#    ip: "::"
#    module: mod_mqtt
#    backlog: 1000

## Disabling digest-md5 SASL authentication. digest-md5 requires plain-text
### password storage (see auth_password_format option).
disable_sasl_mechanisms:
  - "digest-md5"
  - "X-OAUTH2"

s2s_use_starttls: required

acl:
  local:
    user_regexp: ""
  loopback:
    ip:
      - 127.0.0.0/8
      - ::1/128
      - ::FFFF:127.0.0.1/128
  admin:
    user:
       - "my_user_name@myownchat.ptchat.net"
       - "@localhost"

access_rules:
  local:
    allow: local
  c2s:
    deny: blocked
    allow: all
  ## Only admins can send announcement messages:
  announce:
    allow: admin
  ## Only admins can use the configuration interface:
  configure:
    allow: admin
  ## Only accounts of the local ejabberd server can create rooms:
  muc_create:
    allow: local
  ## Only accounts on the local ejabberd server can create Pubsub nodes:
  pubsub_createnode:
    allow: local
  ## Only allow to register from localhost
  trusted_network:
    allow: loopback

api_permissions:
  "webadmin":
    from:
      - ejabberd_web_admin
    who:
      access:
        allow:
          acl: admin
    what:
      - "*"    
  "console commands":
    from:
      - ejabberd_ctl
    who: all
    what: "*"
  "admin access":
    who:
      access:
        allow:
          acl: loopback
          acl: admin
      oauth:
        scope: "ejabberd:admin"
        access:
          allow:
            acl: loopback
            acl: admin
    what:
      - "*"
      - "!stop"
      - "!start"
  "public commands":
    who:
      ip: 127.0.0.1/8
    what:
      - status
      - connected_users_number

shaper:
  normal: 1000
  fast: 50000

shaper_rules:
  max_user_sessions: 10
  max_user_offline_messages:
    5000: admin
    100: all
  c2s_shaper:
    none: admin
    normal: all
  s2s_shaper: fast

max_fsm_queue: 10000

# ACME is ensabled
acme:
    auto: true
    contact: "mailto:postmaster@your_email.fqdn"      
    ## Staging environment
    ca_url: https://acme-staging-v02.api.letsencrypt.org/directory
    ## Production environment (the default):
    #ca_url: https://acme-v02.api.letsencrypt.org/directory

modules:
  mod_adhoc: {}
  mod_admin_extra: {}
  mod_auth_fast:
    token_lifetime: 14day
  mod_announce:
    access: announce
  mod_avatar: {}
  mod_block_strangers:
    log: true
  mod_blocking: {}
  mod_bosh: {}
  mod_conversejs:
    websocket_url: auto
    #conversejs_css: https://cdn.conversejs.org/12.0.0/dist/converse.min.css
    #conversejs_css: https://cdn.conversejs.org/12.0.0/dist/converse.css
    #conversejs_script: https://cdn.conversejs.org/12.0.0/dist/converse.min.js
    #conversejs_script: https://cdn.conversejs.org/12.0.0/dist/converse.js
    conversejs_resources: "/opt/lib/conversejs/package/dist"
    conversejs_plugins: ["libsignal-protocol.min.js"]
    #conversejs_plugins: ["libsignal-protocol.js"]
    # File path is: /opt/lib/conversejs/package/dist/plugins/libsignal-protocol.min.js
    conversejs_options:
      default_domain: "myownchat.ptchat.net"
      embed_3rd_party_media_players: true
      enable_smacks: true
      auto_away: 30
      auto_reconnect: true
      synchronize_availability: false
      message_carbons: true
      omemo_default: true
      show_images_inline: true
      clear_cache_on_logout: false
      i18n: "ru"
      locked_domain: "@HOST@"
      message_archiving: always
      auto_list_rooms: true
      auto_join_on_invite: true
      theme: dracula
  mod_caps: {}
  mod_carboncopy: {}
  mod_client_state: {}
  mod_configure: {}
  mod_disco: {}
  mod_s2s_bidi: {}
  mod_fail2ban: {}
  mod_http_api: {}
  mod_http_upload:
    #put_url: https://@HOST@:5443/upload
    put_url: https://@HOST@/upload
    docroot: "/var/ejabberd/upload"
    thumbnail: false
    access: local
    custom_headers:
      "Access-Control-Allow-Origin": "*"
      "Access-Control-Allow-Methods": "GET, POST, PUT, OPTIONS, DELETE"
      "Access-Control-Allow-Headers": "Content-Type, Origin, X-Requested-With"
  # Configure fileserver serving lounching page
  mod_http_fileserver:
    docroot:
      /: /opt/www
    directory_indices: ["index.html", "index.html"]
    accesslog: /var/log/ejabberd/access.log
  mod_last: {}
  mod_mam:
    ## Mnesia is limited to 2GB, better to use an SQL backend
    ## For small servers SQLite is a good fit and is very easy
    ## to configure. Uncomment this when you have SQL configured:
    db_type: mnesia
    assume_mam_usage: true
    default: always
  # mod_mqtt: {}
  mod_muc:
    access:
      - allow
    access_admin:
      - allow: admin
    access_create: muc_create
    access_persistent: muc_create
    access_mam:
      - allow
    default_room_options:
      allow_subscription: true  # enable MucSub
      mam: true
  mod_muc_admin: {}
  mod_muc_log: {}
  mod_muc_occupantid: {}
  mod_offline:
    access_max_user_messages: max_user_offline_messages
  mod_ping: {}
  mod_privacy: {}
  mod_private: {}
  mod_proxy65:
    access: local
    max_connections: 50
  mod_pubsub:
    access_createnode: pubsub_createnode
    plugins:
      - flat
      - pep
    force_node_config:
      #"eu.siacs.conversations.axolotl.*":
      #  access_model: open
      ## Avoid buggy clients to make their bookmarks public
      storage:bookmarks:
        access_model: whitelist
  mod_push: {}
  mod_push_keepalive: {}
  mod_register:
    ## Only accept registration requests from the "trusted"
    ## network (see access_rules section above).
    ## Think twice before enabling registration from any
    ## address. See the Jabber SPAM Manifesto for details:
    ## https://github.com/ge0rg/jabber-spam-fighting-manifesto
    #ip_access: trusted_network
    ## Allow change password by users
    access: none
  mod_roster:
    versioning: true
  # mod_s2s_dialback: {}
  # mod_s2s_bidi: {}
  mod_shared_roster: {}
  mod_stream_mgmt:
    resend_on_timeout: if_offline
  # mod_stun_disco -- needed for audio/video, see
  # https://gist.github.com/iNPUTmice/a28c438d9bbf3f4a3d4c663ffaa224d9#notes-for-server-admins
  # and also https://www.process-one.net/blog/how-to-set-up-ejabberd-video-voice-calling/
  mod_stun_disco: {}
  mod_vcard: {}
  mod_vcard_xupdate: {}
  mod_version:
    show_os: false

### Local Variables:
### mode: yaml
### End:
#

XMPP: en ideell direktemeldingssystem for et familie

2023-02-06T17:00:00+01:00

Forskjellige meldingssystemer ble populær de siste tiårene. Den meste kjente eksempler er Whatsapp, Facebook Messenger, Snapchat eller Discord. Mange bruker dem uten å tenke bare fordi de ser praktiske ut og er gratis. Kostnadene er imidlertid alvorlig: den er personvernkatastrofe. Brukere har ingen egenkontroll, så eieren kan endre alle funksjoner uten at brukerne vilje. Disse tjenstene (platformene) er laget og fullstendig kontrollert av store monopoler fokuserte på å suge alle slags av brukerdata. Personvernkostnaden til store kommersielle direktmeldingssystemer av er mye høyere enn brukervennligheten. De er bevisst laget for å være gjensidig uforenlige. En bruker av Whatsapp kan ikke sende en melding til noen på Telegram eller Facebook. Bare se for deg at du hadde Telenor men kunne ikke sende sms til noen på Telia, kun til sin eget system Telenor. Eller se hvis du kunne ikke sende en epost fra Gmail til Yahoo. Det er helt dumt.

Nå, blant de populære systemene er det bare epost det eneste systemet på internett som har ikke vært monopolisert. Og det er fortsett fordi epost ikke er en plattform (eller 'ecosystem'), men åpen og federert protokoll etter eget design. Alle kan konfigurere og kjøre egen mailserver og meldinger skal sendes mellom evt. Alle kan velge mellom mange epost apper. Alle kan legge til ytterligere funksjonalitet, slik at ende-til-ende kryptering, men interoperabilitet opprettholdes.

Protokoll betyr et sett med regler og konvensjoner for interoperabilitet, ikke et enkelt komplett produkt.

Men, det finnes en direktemeldingssystem som er like enkel å bruke som Whatsapp, men mangler de fleste av problemene. Faktisk, er det XMPP. Det er en åpen og federert protokoller som epost. Alle kan ha egen server, så kan ha kontakt med noen på alle serverer som helst, akkurat som epost eller mobil. I tillegg, kan alle også velge mellom ulike app etter vilje: foretrekker du funksjonalitet, eller skjønnhet eller bare det å være veldig lett... Det finnes også flere XMPP serverer programvare å velge mellom, de fleste er gratis og åpen kildekode. Med XMPP kan du få alt: direktemeldinger, filer, tale, video, gruppechat, flere enheter. Det er også flere typer av ende-til-ende kryptering (OMEMO, GPG, OTR) og mye mer. Det finnes enda en XMPP-basert sosialnettverk: Movim.

XMPP er ikke alene. Det finnes også en alternativ åpen og federert protokoll: Matrix. Men sammenlignet med XMPP, har den flere mangler: (a) problemer med personvern (selv om mange ikke bryr seg om det), (b) alvorlige ytelsesproblemer: mens XMPP fungerer fint selv på den minste og billigste VPS, Matrix server krever mange gigabyter med RAM og stor diskplass, på denne grunn er det dyrere i drift, også krever Matrix mye mer oppmerksomhet (f.eks. se her). Det kan være berettiget i bedrifts- eller stororganisasjonsbruk, men ikke i hjemmebruk.

Så XMPP er ideell for å lage et helt privat kommunikasjonssystem for et familie. Du trenger bare dette: (a) en server: billigste VPS eller enda en Rasberry Pi boks vil fungere fint (f.eks ejabberd skal støtte hundrevis brukere med dette nivå); (b) server programvare som kjøres alt: sjekke ut flere og velge selv, de mest populære er ejabberd og Prosody; (c) domenenavn slik at brukere kan konnektere til: domenenavn er også en del av brukernavn, som i epost, f. eks alexander@johansson.me (enkelt DNS oppsett trenges for å støtte tale og video); (d) hver bruker kan velge hvilken klientapp som skal brukes (f. eks Monal eller Siskin IM på iPhone). Og det er det.

Nå må serveren konfigureres. Så kontrollerer du systemet fullt ut! Du kan registrere så mange brukere at du trenger, men for en familieserver anbefaler jeg ikke å tillate åpen registrering av alle som helst. For eksempel du kan registrere flere kontoer for en enkelt bruker hvis nyttig (å bruke med forskjellige formål). Ingen mobilnummer kreves: f.eks. trenger du ikke fem SIM-korter for fem brukere, faktisk ingen er nødvendig. Det også anbefales å konfigurere ‘Shared roster group’ (delt brukerliste) for å unngå å legge til familiekontakter manuelt for alle familiemedlemmer. Ende-til-ende kryptering er ikke avgjørende for din egen private server fordi transportkryptering (TLS) brukes alltid; men det er lettere å konfigurere hvis du bruker flere enheter (mobil, nettbrett, desktop, laptop, web-basert). Men det er bedre og sikrere å bruke ende-til-ende kryptering til å kommunisere med noen på andre offentlige servere.

Og nå, når flere grupper har sine egne private servere, kan de kommunisere fritt og sikkert. For eksempel, det er nå lett for pappa@johansson.me å sende melding (eller video-ringe) til mattias@johansson.me (samme familier og på samme privat server) eller til en venn john@dowfamily.info eller enda alle som bruker hundrevis av åpne gratis offentlige serverer f. eks maria@jabber.no (på Jabber Norge), christian@jabber.de, oyvindharaldsson@tigase.org eller nikolaibode@riseup.net.

Det kan være vanskelig å velge den beste offentlige serveren. Men det finnes et verktøy som viser hvilke funksjoner serverne støtter. For eksempel hvis serveren du sjekker støtter "XEP-0363: HTTP File Upload", noe som er avgjørende for å kunne dele filer enkelt. En annen viktig funksjon er "XEP-0384: OMEMO Encryption".

Sjekk kompatibilitet og funksjoner her: https://compliance.conversations.im/
Liste over offentlige serverer med 100% kompatibilitet: https://compliance.conversations.im/api/compliant_servers/
Offentlige XMPP tjensteleverandører
Se her for litt mer informasjon om XMPP.

Lenker

XMPP server på 1-2-3
Hvordan å konfigurere XMPP server ejabberd
Useful configuration steps for ejabberd
Hvordan å konfigurere XMPP Server Prosody eller Install Prosody eller Install Prosody on your Raspberry Pi
Disroot.org - en åpen XMPP server (100% standarder)
Jabjab.de en åpen XMPP server med transporter til andre meldingssystemer (100% standarder)
Jabber Norge - en åpen XMPP server fra Norge (anbefales ikke lenger pga manglende overholdelse av standarder og funksjoner)

Intervju kristendom

2022-11-01T17:00:00+01:00

Jeg hadde en intervju med studenter av St Paul gymnas. Her er noen svar.

Hvordan å praktisere religionen?

Å praktisere religionen betyr at du leve med Gud i hjertet ditt. Først, det er viktig å bare være god i livet og unngå noe som er dårlig. Unngå synd og dårlige ting som er enda uten av synd. Men det er ikke nok å bare ikke gjøre noe. Det er viktigste å gjøre god ting i livet for God hjelper oss når vi gjøre det som er godt. Jeg tror det er den Guds ligning:

her E er effekt som vi får, i er menneskers innsats og G er Gods nåde. Hvis innsats er null, helt effekt er null selv når Gud er enig å hjelpe den største (f.eks. G = 1,000,000). Tå eksempel av Jesus og følge Kristus i hverdagen aktivt. Tenke om dette: I velkjente miraklet tok Kristus få brød og fisk fra folk og multipliserte dem til flere tusen. Det var i stedet av å skape brød ut av ingenting. Den hovedbetingelsen for miraklet var en gratis gave og samarbeid fra få enkle mennesker. Vi vet ikke hvor mange mirakler som ikke skjedde fordi noen bestemte seg å gjøre ingenting. Den G-leddet i den formelen er det viktigst del. Så vi kan ikke gjøre mye uten av Kristus nåde. Det betyr at vi trenger sakramenter og be å få den G-ledder. Vi lever i verden og Gud er transcendent, Jesus er i himmelen, ikke her med oss nå. Det betyr vi ikke får direkte opplevelse av Gud og kan ikke se, spørre og kjenne hva er som Guds vill. Men vi har masse informasjon i skriften og den hellige tradisjon. Kirken får det i kirkelige dokumenter, Codex juris, og mange teologiske og filosofiske verk. Vi kan lære mye av dette hellige vitenskap ved hjelp av vår egen sunn fornuft.

Kort fortalt: å praktisere religionen inkluderer dette: (1) å få Guds nåde ved sakrament og be, (2) lære hva er som god og Guds vilje ved hellige vitenskap og rasjonalitet, (3) vare aktivt å følge det som er god i hverdagen.

Hvilke sakramenter påvirker ditt liv mest og hvordan?

Nattverd, Eukaristen, er den sakrament vi kan få og har oftest. Det er også det sakramentet som forbinder oss med Gud fysisk. Det er den eneste sakrament som tillater oss å se på Gud, streife på Gud og akseptere Gud fysisk. Men det er også den vanskeligste sakrament vi har.

Det kan være vanskelig å forstå hvordan et lite stykke brød kan være Kristi legeme. Men tenk om enkelt ting, f.eks. så enkle ting som en stol vi seter på. Det kan vare laget av tre, eller jern eller plastikk eller glass. Men hva vi se som materialet er helt uviktig. Hvordan vi behandler og bruker stolen er helt uavhengig av materialet, men bare faktum at det er an stol. Å forstå hva stolen er og av hvilken grunn det brukes og hva det brukes, må vi resonnere ved hjelp av kognisjonen og abstraksjonen vår. Det trenger litt høyere nivå av tenking enn bare se på det ytre utseende. Men vi hittil ikke forvirrer en tre stol med vedtre. Nå tenke om en dyr som ikke får slik abstraksjonsevnen. En fly eller maur som seter på en tre stol og etterpå har en opplevelse av en plastikk stol skal tenke at denne er helt forskjellige ting og har ingenting til felles. Men vi kan få det rart: vi finner det helt åpenbart at denne to objekter tilhører til samme kategori.

Samme skjer med hvordan kan vi se på Eukaristen. Gud er transcendent og ikke en del av denne verden. Så vi selv kunne ikke se på, eller på annen måte oppleve Gud. Vi selv kan ikke ha denne kapasiteten. Men Kristus kommer til oss i denne sakrament fysisk, bruker den vanligste ting som er en del av vår verden, så vi kan vi kan kommunisere og enda forene med transcendent. Men for dette, vi ikke har vårt eget konsept og må abstrahere å forstå.

Å vare et menneske betyr å forstå hva er den naturen av verden og tinger vi lever med. Hvordan vi forstår det påvirker hvordan vi lever livet vart.

Hvis gud er allmektig, hvorfor tror du det er så mye ondt i verden?

Nøkkelen å forstå dette er frie vilje av mennesker.

Det var en metafor av Gud som skaper, i ekstrem form Gud som urmaker. Her Gods allmakt og allvitenhet kunne se ut til å peke at verden som Gud skapte er idealt som en maskin. Da er det Gud som er den eneste skuespilleren. Dette synet blir spesielt populært da mennesker utviklet enkelt fysiske vitenskap, Newtons fysikk som er basert på streng årsak og virkning. Tenke om dette: årsaken A forårsaker B. Her A bare styrer en fiksert og helt bestemt effekt B, men B ikke har noe rolle. Da Gud er tenkt som den første og hovedårsaken av alle ting i verden. Konsekvens av dette er at Gud tar alt ansvar. Så bare faktum at det ar noe galt i verden betyr det er Gud som har forårsaket dette.

Men God som bare skaper eller urmaker er en feil metafor. Dessuten, motsier det det bibelske synet. I bibelen Gud er tenkt om som en far. Noen kan tror det er et utdatert og primitivt syn, ikke vitenskapelig som vi nå trenger. Men konsept av faren, den forelderen, tar den eneste essensen av Guds rolle.

En urmaker lager maskinen for et bestemt formål. Maskinen gjør kun det som er urmakers formål, ingenting mer. Maskinen er ikke en uavhengig "agent" med egen aktivitet. Det også finnes ikke en rolle av kjærlighet.

Forelderen er helt motsatt av det synet. Forelderen føder ut av kjærlighet, ikke for en funksjon. Barnet er ikke en programmert robot, men en uavhengig agent som bare lever sitt eget liv. Det betyr at barnet har egen frie vilje som forelderen skal respektere og helt verdsette. Det også betyr at barnet har lov til å feile og lære av sine feil. Dessuten, barnet har likt lov å ikke lære av sine feil og enda å gå helt galt. Forelderen kan ikke gjøre har, men gi råd og kanskje lide over barnets feil. Fordi barnet har frie vilje, det kan ikke fikses, kun kureres.

På samme måte, Gud lar oss å leve vårt eget liv slik vi bestemmer selv. Det betyr våre feil har lov til å være enorme. Men det at vi har fri vilje skaper vår verdi som mennesker. En programmert robot med liten selvstendighet og kreativitet er en helt kjedelig og dumt skapning.

En del av frie vilje er ikke en ting Gud har gatt oss mennesker. Hele verden er skapt til å være uavhengig, ikke som en klokke eller noe andre maskin. Verden er ikke skapt som en endelig ideell ting, men det kan utvikle seg selvstendig. Det finnes eksempler i kvantefysikk: elementærpartikler kan fungere uten noe streng årsakssammenheng. Men den beste eksempel er Darwins evolusjon. Her levende former utvikler seg kreativt uten Guds kontroll. Uavhengighet og fri vilje er Guds plan og gaven, men det er også et tungt ansvar.

Goodbye Gmail

2022-04-22T00:57:00+02:00

The old good email remains the most critical digital communication tool. What makes the venerable email so useful and sustainable over the long time is its openness and standardization. Email is radically different from the modern "apps" which integrate all pieces of technology--the server, the client, and the protocol--by a single monopolist provider. With email, we are free to choose the server (provider) and client with any combination. It provides enormous flexibility, added privacy and security. Indeed, the provider does not control my client and cannot add backdoors; there is no monoculture of client software with all the related security risks (any security vulnerability is global). Email is one of the few pieces of technology that is very resistant against internet censorship. Repressive state can easily block a web site and even force an app store to remove an app (as the Navalny's "Smart Voting"). Also, an app store can delete it for any other bizarre reason. But it is much more difficult to block a mailing list: it is easy to redeploy and recreate it on a different server (without the users even noticing anything). Furthermore, The user can easily create several different email-based identities (e.g. a separate one for politically sensitive activity) which adds anonymity. And anonymity means physical security in some countries.

It is not surprising that many internet services use the email address to register users, authenticate, restore password and other similar purposes. Open, standardized and decentralized email is one of the most critical technology everything else depends on. After all, the flexibility offered by the email technology--the freedom to choose all pieces (provider, client etc.) is just very very handy, at least for an advanced user (you can add new features on top of what the provider realized, even against the provider's will--isn't it convenient?).

The whole email technology is build around open protocols rather than a centralized platform. This facilitates competition, makes for better and fairer service and reduce possible impacts of malicious monopolists (Masnick, 2019).

Google's Gmail has long been one of the main pillars of email, millions used to rely upon every day. We should praise Google for popularising email as the basic mainstream technology among the masses. I started using Gmail many years ago when it was in its "beta" and available only by invitation. At that time Gmail openness and unrestricted nature was just blazing. The web interface was lightweight and not really cluttered with ugly banners, unlike other email providers. There were ads but they were small and unobtrusive. Gmail had long supported all the basic protocols (POP, IMAP, SMTP) that allowed to use any standard compliant client software, and that was available for free (some other providers were more greedy and allowed this only on paid plans). Google's POP, IMAP and SMTP implementations have been (and still remain!) quite idiosyncratic, incomplete and not really standard-compliant which caused various glitches (e.g. message deletion and default sorting are weird, I always hated Gmail's labels). But this was bearable.

The serious privacy problems and threats of Gmail, such as user email scanning for context-specific advertising (until 2017) or AI tool which could provide access to some pieces of data to third-party developers. That is nearly a disaster that cannot be fixed because spying on the user's data is at the heart of Google's business model. But who cares as long as it is free! I have long been using and promoting PGP encryption which could fix many of the privacy (and security) problems. Yes, PGP is crucial for individuals and businesses and yes, a motivated user can encrypt.

Gmail still remained free and relatively open while an alternative of deploying private email server is time-consuming and tedious (e.g. ensuring that emails from a tiny private server don't end up in spam folders of intended recipients). I used to pay with some of my privacy to get the usability and stability of Gmail.

But over time I became increasingly concerned about the clear trend taken by Google to make the open email more and more difficult to use outside of the Google monopolistic ecosystem. There are signs of the famous embrace, extend, and extinguish strategy. Gmail API is featureful and powerful... but only if you really need the complexity and like to play with the Google rules. If you don't like to see ads, for example, and for this use a standard IMAP mail client of your choice, your must suffer. If you need full PGP support on a mobile client, never offered by Google, you are out of luck and have to use an IMAP-based mobile app like Android K-9 Mail that requires sacrificing some usability.

Google tends to draw its users by all means into its browser, its own apps and APIs to get more user's private data and show ads. For that matter, Google's security usability has become just terrible. The intrusive access-blocks when a mobile user with an IMAP client moves across IP addresses can drive anyone crazy... Access can be blocked even if the user switches just to the next IP address within the same provider's IP pool.

I have to use VPN with fixed IP address to avoid these stupid blocks!

To help keep your account secure, Google will no longer support the use of third-party apps or devices which ask you to sign in to your Google Account using only your username and password. Instead, you’ll need to sign in using Sign in with Google.

The Google's insistence on rather complicated and heavyweight OAuth2 mechanism for basic email client access (remember, most email programs do not require you to enter your password every time, diminishing the risk of phishing) is understandable only as a means to limit all uncontrollable third-party clients. Yes, OAuth2 is logical for complex workflows of data access delegation across multiple web-based services with different login/password combinations (the "Auth" stands for authorization, not authentication). Whenever I need access to my own emails I need to authenticate my identity granting full access. But isn't OAuth2 client secret kept on the device just as the username/password combination? Yet, limiting the (power) users access to their own data provides just an illusion of security at a large cost to usability and compatibility.

The Google's move to OAuth2 authorization seem to point that the Gmail-hosted emails do not belong to me any more. My emails are now owned by Google, who just "authorizes" (delegates) me access to some of the data without trusting me. This is not what I need from my private communication. Does Google pretend to "zero-trust" any third-party apps? Maybe it doesn't trust its users (the owners of their data), assuming they are all idiots?

If you think your users are idiots, only idiots will use it [your service]. --- Linus Torvalds

And there is another side effect: as Google increasingly deployed more and more heavyweight frameworks and technologies, Gmail became very sluggish and bloated. It is cluttered and confusing, especially to those who don't use it often enough to remember all the idiosyncrasies. And it's still poorly adaptable to the user's needs. How can I get a fixed-width font for my plain text message? Where is my favourite basic (and very fast) HTML web interface?

Enough is enough. I now go away from Gmail, and primarily not because of big privacy concerns (which is quite expectable) but because of deteriorating usability and growing incompatibility. It looks like the people at Google have forgotten their old motto "Don't be evil." While I have been paying Google with my privacy currency in the past to get functionality and usability, the benefits of Gmail continuously went lower and now reached an unprofitable level.

Migadu is my choice

There are many hosted email providers, some are focused on privacy and security. For example, Protonmail is a fantastic project that makes it nearly trivial to use PGP even for an uninitiated. But its drawbacks are that it is non-standard and has too high publicity making it quite undesirable in certain authoritarian countries. Simply said, if you use Protonmail in some countries you may be suspected; Protonmail can be blocked by the authorities, and worse still, blocked in quite idiosyncratic way. Some services may also reject registration using this service.

What I have finally chosen is Migadu. It is not yet another standard email hosting provider. It is a domain-based service. Once you have got your own domain name (domains are now cheap), you can make your own email service for your domain. That simple. This makes it super useful for companies, families, groups and NGOs without large budgets. For a reasonable price you get nearly your own mail server with many configurable features (any custom mailboxes, aliases, forwarding, regexp, webmail, etc.) but without the need to maintain all this complex system.

If you have a web site, you necessarily get a domain name for it. Now it's easy to get your own email identity. True that some hosting providers also do host email. But if you decide to switch to a different hosting it will create a trouble: you need to move also email and this fact strongly limits your next choice. Having a completely indpendent email system for your existing domain avoids such hoster lock-in and makes life much easier.

By the way, the Migadu standard webmail interface is sleek and very simple. Looks modern but lightweight and quite fast. No bloat whatsoever, only the most crucial functionality. I am not big fan of web-based email, but use it from time to time. And there is even some very basic support for PGP! (But remember that web-based PGP is not a very secure solution.)

I found the mail server configuration (including more esoteric stuff like DNS setup and DKIM signatures) very easy. In my view you do not need an IT degree to configure your email server with full functionality. I like the admin panel, it is minimalist and easy to use, no stupid and distracting visual effects. And Migadu is advertised as fully open standard compliant service without proprietary glitches and limitations. So any standard (open source or closed source) software is very likely to be fully usable. This freedom is very important. And they are also clear and honest about the limitations and drawbacks.

Finally, goodbye Gmail.

Masnick, M. 2019. Protocols, not platforms. A technological approach to free speech. Knight First Amendment Institute https://knightcolumbia.org/content/protocols-not-platforms-a-technological-approach-to-free-speech.

PS: Disclaimer: I have no links with Migadu.

This post is also published on Substack and Medium

How to use open source openconnect for UiB VPN

2021-11-10T14:19:00+01:00

Cisco AnyConect is an unethical software. First, it is proprietary and closed source code, although the nature of its functioning makes it capable to control all the user's network traffic. Even worse, Cisco AnyConnect implements controversial functionality making it technically a kind of malware: the so called "posture" (HostScan) service is scanning the user's device and (steals?) sends various information out (Cisco said this is done "to improve security," e.g. to avoid non-certified and unauthorized devices), Cisco VPN client can officially download and install spyware trojan on the user's device (Cisco also advertises the trojan as a tool to "improve security"). Also, the VPN client can reroute the network settings in arbitrary way without the user's consent and knowledge. All this is a serious security and privacy threat. (And Cisco products have a bad history of serious security flaws that look like backdoors.)

It can be justified to run Cisco AnyConnect on a corporate-owned machine (understanding the consequences for the user's privacy and security). But installing it on the user's owned private devices should be avoided.

Openconnect

Openconnect is an open source SSL VPN client that supports several protocols including Cisco AnyConnect. It can be used as an alternative to proprietary Cisco software that may in some installation include controversial and undesirable functions such as uncontrollable network re-routing, proprietary scanning module, installable spyware trojan etc.

For more information go to the Opeconnect web site: https://www.infradead.org/openconnect/.

Install openconnect from the standard Linux repository, e.g. in case of Ubuntu/Debian use:

apt install openconnect network-manager-openconnect \
            network-manager-openconnect-gnome

Server settings

To connect to the vpn, go to the network configuration entry, then add a new VPN connection, choosing Cisco AnyConnect Compatible VPN (openconnect) in the list.

To connect to the UiB VPN one needs this:

Server gateway: vpn3.uib.no
UiB username (short name, in the following examples zzz000)

Basic connect using command line

The simplest command to connect to UiB network is:

sudo openconnect --user zzz000 vpn3.uib.no

Note that sudo is required to set up the tun device (It is, however, possible to configure openconnect to run as unprivileged user, see http://www.infradead.org/openconnect/nonroot.html).

There are also a few useful options:

--background run openconnect at the background
--syslog send messages to the system log
--pid-file /var/run/openconnect.pid use specific pid file, then it is easy to switch off the background vpn using this command: kill $(cat /var/run/openconnect.pid) assuming process pid is saved to /var/run/openconnect.pid

These options result in this command:

sudo openconnect --background --syslog --pid-file /var/run/openconnect.pid  \
                 --user zzz000 vpn3.uib.no

Connect using graphical user interface

Most Linux desktop environments (e.g. Gnome, xfce etc ) have graphical utility that is accessible in the system tray. To configure it use:

VPN protocol: Cisco AnyConnect
Software token authentication: TOTP

Other options should be left intact.

At login, the GUI program will ask the University user name and password. Enter and press Login

Then, Microsoft authentication code will be sent via SMS on the mobile phone.

There may be a caveat: DNS might not work with the default configuration (web sites are inaccessible by their http names). If this is the case, go to IPv4 settings and manually configure DNS servers, such as Google DNS 8.8.8.8 and 8.8.4.4

and then to IPv6 settings and enter DNS servers manually, e.g. Google DNS 2001:4860:4860::8888, 2001:4860:4860::8844

Now UiB VPN should work in a private way. Openconnect turns out to be a useful tool to connect to the UiB network in a simple and straightforward way.

Microsoft Windows

Openconnect also works on Microsoft Windows. If you are using Chocolatey then there is a port that can installed be using this command:

choco install openconnect-gui

Disclaimer: I did not try it.

References

Opeconnect web site with source code, documentation etc: https://www.infradead.org/openconnect/.
Microsoft Windows port: https://openconnect.github.io/openconnect-gui/
Tim Hårek Andreassen had a similar howto in his blog: https://timharek.no/blog/uib-vpn-without-cisco/ Note: My openconnect was experience even more straightforward, e.g. in my case no certificate configuration was necessary.

Are we going to work in a paper jail?

2021-10-25T10:00:00+02:00

Main points

Any major university IT infrastructure is huge and heterogeneous, it is used by lots of people, many of whom are experimenters and explorers, who like challenge, rather than office robots. Most users are busy, focus on research and study and hate additional (and especially sudden) hassle. This is why consideration of the usability cost is absolutely critical for IT security strategy.
Creating a walled "trusted" area by a firewall--the perimeter model--is an outdated approach to security at the age of universal zero-trust deployment. Instead of following an already outdated approach, a more sensible strategy is to start implementing components of the zero-trust model, including score-based trust and wide use of personal identity hardware tokens.
Major focus in security should be shifted from solely technology components to the end users, creating incentives to use more secure technology, rather than making additional hassle.

The great firewall

There was a very rapid trend towards an increasingly restrictive IT policies at the University of Bergen implemented from October this year. While the aim of “Increasing security” is laudable, I think the planning and implementation of the policies has several flaws which may compromise its declared aim. The biggest problem is that the UiB IT is huge and heterogeneous. There is a variety of services with different levels of security risks, many users, with diverse needs, user cases and environments, competences, personal backgrounds and personalities. This requires a more sensible, flexible and inclusive approach. If this is not the case, rigid policies will not make the IT environment significantly safer. Instead, it may hamper normal work for some users, and in the long run compromise both security and privacy contrary to the declared aim.

Security, including the computer security, is not a fixed state, it is rather a continuous process. Security is not limited solely to the IT technology. Technology alone cannot bring security. Security is primarily a human rather than technical problem. Indeed, most dangerous security breaches did not target encryption algorithms, many even only partly involved exploitation of software and hardware vulnerabilities. They typically make use of human factors, such as social engineering, trust exploitation, human mistakes and so on. Successful tracking and catching cyber criminals do not often primarily target technology, but usually depends on exploiting human errors, negligence, laziness and other similar factors. This is why the current primary focus on just technological restriction of the IT environment, aimed barely to its isolation from the outside networks, is neither sufficient nor efficient. A more balanced, flexible and holistic approach is needed.

Security can only work at a balance with usability. Moreover, there is often a trade-off: technological security restrictions often make for worse usability. A completely “sealed” environment would be just too restricted to be usable. Usability is indeed a primary factor: research shows that many security problems and users’ hesitance or unwillingness to make use of (more) secure tools is caused by their imperfect usability. Furthermore, within a hugely heterogeneous environment, there would be no single optimal balance between security and usability. An important consequence of this is that a flexible and inclusive approach to security, aimed at different degrees of balance with usability, is important.

The technical part of security should start and primarily respond to specific threat model(s), not theoretical or vaguely possible risks. And the threat model(s) should be connected with the real life statistics, e.g. how many breach attempts usually occur, to which of the services, from which IP addresses etc. It does not make sense to install solid steel screens on all windows in our department building to make it “more secure” from any kind of possible breaches; even if there are crowds of hungry zombies walking outside, it is just enough to protect the first floor.

Blanket unconditional restriction of the UiB IT network environment as is being implemented does not seem to respond to specific consideration of threat model(s), the variety of users, needs, sub-environments etc. It looks like a desperate attempt to seal everything in a hope that a jailed environment, isolated from the outside, will be more secure. This is a wrong assumption.

Some specific problems

Multi-factor authentication via TOTP: Not a panacea.

KI 0780 introduced multi-factor authentication policy. This is generally a crucial component to improve security, if implemented sensibly. However, not all implementations would automatically improve security or provide a sufficient balance between security and usability. What is called “multi-factor authentication” may not even be really multi-factor. The definition of multi-factor authentication involves the use of several things for authentication, typically something you know: password, plus something you own, e.g. a mobile device (SIM) and something you are e.g. fingerprint. If the password is entered using the password manager software saved on the mobile device and the “multi-factor” SMS comes to the same mobile device (or password entered and SMS read on the same computer that links to the smartphone as is now the norm within the Apple ecosystem), the whole idea of two factors is ridiculed: the smartphone becomes the single authentication device. It can be at best called “two-step authentication,” a weaker mechanism. The SMS (and anything based on phone-line or phone-number) is actually one of the poorest authentication means due to the long known and essentially unsolvable vulnerabilities in the GSM, SS7 and other related protocols. SMS can be hijacked by malicious smartphone apps (e.g. Google Play store does not even approach 100% safety, there are occasional scandals with malware in apps with very substantial audience) or even basic GSM dumb phones (there are reports about quite a few Chinese-made GSM button-phones having factory-installed malware). Worse still, some of the modern and widespread multi-factor mechanisms such as push-based popups are also easily exploited (even worse, they make for a bad habit of clicking “approve” without thinking). If authentication is done on a web page, it is usual to save the authentication cookie to avoid repeated two-factor invocation. However, cookies are not necessarily secure, long kept cookies might be hijacked by malware, there is a well known mechanism of CSRF attacks, there is also a big privacy drawback (e.g. tracking). The current industry trend is to go away from the cookie mechanism in the mainstream browsers (e.g. Google Chrome will not allow any third-party cookies from 2022). A sensible user policy is to reduce the lifetime of any cookie. However, it makes the “two-step” authentication as is currently implemented at the UiB a hassle. Indeed, the user then has to go via the SMS code process nearly every time he or she logins, even if it is done from the same IP address and the same device.

The ssh access to the login.uib.no server have apparently disabled the best-practices secure mechanism of ssh-key authentication (incidentally, if the key is combined with a passphrase then it is actually a two-factor authentication itself!) and forced the potentially week password-based mechanism with SMS code. There seems to be no other TOTP mechanisms except SMS at the time of writing!

A better mechanism is to use the time-based one-time password code (TOTP) authenticator application on the mobile phone. This is in fact recommended at the Microsoft and UiB web pages as a more secure alternative (via Microsoft authenticator app). While TOTP is better than SMS, it is far from perfect because it is potentially vulnerable to phishing and the MITM attack and the secret seed should be kept on the authenticator application as well as on the server to make synchronised generation of TOTPs possible.

Personal hardware tokens

There is a much better and stronger two-factor authentication mechanism: U2F and FIDO2/WebAuthn that use hardware security device keeping the private key. The security token, in the form of a small USB or NFC key can both authenticate on the server and authenticate the server itself with strong asymmetric crypto, making phishing and many other attacks virtually impossible. Many such devices also implement biometric (e.g. fingerprint) identification with privacy-respected way (e.g. biometric data is not sent from the user's device). This is now a mature technology that is implemented in all major web browsers, can be used with ssh key-based authentication, GPG-enabled email etc.

The best known hardware token is probably the Yibikey and there are a few others on the market (e.g. Google Titan, FEITIAN, Token2, Thetis etc.). They can be not very cheap, but not prohibitively expensive either.

VPN needed for all, even the most essential everyday services

The UiB IT services have previously used several open and industry-standard VPN mechanisms (IPsec, OpenVPN) so that different users could easily find a solution working for them individually. Now, there is a single closed and proprietary mechanism: Cisco AnyConnect including both unique protocol (SSL-based) and the software client. This mechanism may work for many but not necessarily for everyone (e.g. unlike open solution, it may not be available on some computing platforms, some enthusiasts of the open source might find restriction to a single proprietary tool unethical, etc.). There are rumors about unreliable connections with Cisco AnyConnect, and that OpenVPN was previously more stable for some users. It is indeed likely if Cisco AnyConnect is used over certain restrictive environments with DPI that block connections to certain ports or UDP traffic even at the 443 port, or otherwise censor VPNs (e.g. some public WiFi networks may have such limitations). Some implementations of the OpenVPN, in contrast, can be configured to mimic normal SSL web traffic (e.g. shadowsocks) and work even under the Great Chinese firewall. There is a clear benefit at not prohibitively high cost to provide at least some limited support for such a mechanism for certain users (e.g. special needs or during travel). It might even be provided only on special request with some substantiation. Also, the reliability statistics internally used by the IT department might be biased if not all users report minor and transient VPN issues. So there is a case to deploy and support alternative VPN solutions, perhaps even on a smaller scale.

It sounds quite reasonable that providing and supporting a wider choice of VPN solutions for a minority of users would not be economically feasible. However, it is certainly not the case when just all the services become available only from within the UiB internal network jail. Then, there should be more flexibility and inclusion, several ways to get into a jailed environment comfortably by a variety of users in different environments. It is just too unbalanced limitation to mandate the use of a single restricted VPN to get email from home or from an airport, for example. A better alternative is of course to relax the policy moving at least the most essential but inherently secure services out of the jail.

Is the universal jail really essential for everything?

One issue with unconditional moving of all the UiB IT services into a jailed environment is that this would not reflect sufficient balance between security and usability. It is of course good to keep potentially less secure services (e.g. RDP) jailed. But are real threats substantial enough to hide just everything into such a jail?

Are there any real-life statistical or other data evidencing that accessing the university email system from an IMAP client with normal SSL/TLS protection can be dangerous? The user in such a case does not need to enter the UiB password for login (it is saved into the software, often encrypted on devise), so phishing risk is near zero. The authenticity of the IMAP server certificate is usually checked through the standard SSL mechanism. So is there any real security advantage to move such essential everyday tool as email into the jail, does this just induces additional hurdle?

Another example is connecting the UiB login.uib.no ssh server. Many (presumably less advanced) users can use the ssh with their default password. Then, the “two-factor” authentication is a serious security improvement of course, even if it is in fact used in the weakened two-step authentication mode. However, some other users can configure ssh-key authentication, which is a much more secure mechanism. Will the manual entry password with two-factor authentication really provide sufficient security improvement in such a case? Will it provide anything beyond a negligible effect if the user has already authenticated with SMS on the same device, or a different device from the same IP address shortly before? Is there any improvement in security that substantiates such degradation of usability?

The question is this: is the same level of restriction and jailing really essential for all services, often and rarely used, potentially less secure and highly secure, easy and difficult to exploit, those with documented attacks and those that present little interest to intruders? Does not it just provide usability costs not balanced by any security improvement?

Human ingenuity: Is the jail actually made of paper?

It is clear that equally and unconditionally restricting just everything, especially, without considering usability costs, will not automatically increase security. The situation can well be worse: lower security as well as compromised privacy.

For example, to avoid all the nuisance, users may switch to using third-party commercial providers, such as increasingly use private gmail.com accounts, Dropbox etc. Users may use smaller, more cryptic online tools and applications (e.g. file sharing sites, communication tools, some advertised as encrypted) with uncontrollable and unknown security. Some of them might be owned and run by community and volunteers, some could be compromised or deliberately devised to gather data, track users and spy.

Some of more qualified "insider" users might successfully hack the system to get nuisance-free access to the UiB jailed environment from outside. It is actually not a hard problem. One possible solution is to use the reverse ssh proxy. It does not even require administrative rights and can be done by a motivated average level computer user after 20 min of reading the ssh manual. More advanced users can create stable backdoors implementing such things as proxy jump and port forwarding that will sustain reboots, logouts etc. It is also easy to add various layers for plausible deniability and obfuscation.

There are much more tools, ways and possibilities to implant and efficiently hide a backdoor into the UiB jailed environment. All that is required is various open source components freely available on the net and an incentive to do such unauthorized actions. It is not just an abstract theoretical threat but real and serious risk left behind the current jailing policy.

Imposing a jailed environment without considering trade-off of flexibility and usability has this biggest problem: It may create an incentive to break the rules to make life more hassle-free. A related and serious problem is that the IT department would not be able to control this and in most cases will remain unaware of the issue. It is virtually impossible to detect that users communicate and share sensitive medical or personal data over a private google mail account, for example. A cryptic backdoor implanted on the computer within the UiB jail with sufficient plausible deniability can remain long undetected without costly and tedious forensic analysis. But such an analysis will be conducted only by the police after a catastrophic break-in has occurred, too late.

There are many advanced users, smart students, at the university. Many well understand (and they do discuss!) the inconsistency of the restrictive jail policies. Some people may find it quite fun to overcome the silly rules imposing unneeded hassle. It can indeed be an interesting challenge but, unfortunately, an additional incentive.

A further problem is that many users usually do not bother to report smaller or transient problems at the normal issue tracking channels such as hjelp.uib.no. They may not be acquainted with it or just consider it a hassle if they are very busy (and they are very busy with real things to hang at tangential IT problems). A quite typical way of action is to ask someone nearby for a help or workaround. Therefore, if the knowledge of the ways for implanting backdoors and the obvious fact that it is quite easy and just solves the problem, is spread within the student and staff, it can create a real security disaster. Unfortunately, backdoor skills are very likely to spread if the IT department continues to create more and more restrictive jail and provide more incentives to break the rules. Then, it would be essential to further tighten the jail: inspect all devices on entry and refuse entry to everyone with IQ > 0.60. The simple fact is that the jail that is being happily built is not made of rock and steel, it is paper.

The situation at the UiB is quite different from a typical commercial organization that the standard security recipes are based upon. There are many brilliant students and staff out here, many are young and like challenges. There can be those who would not hesitate to take risk, given the benefit of making one’s own hassle-free environment is high, the cost is zero while expected risk is rather low. Making a backdoor is indeed a way of learning technology that is fun and another added incentive. Many folks are already aware of various software tools and know how to use their black magic. People are ingenious, and people at UiB are on average much more ingenious than outside. What is the threat model for developing the jailed IT environment? Is to protect the UiB from outside hackers? It is a wrong model because many such hackers are already within the jailed environment and are ready and to get the challenge to punch its feeble paper walls from inside.

What should be done?

Inconsiderate and inflexible jailing of the UiB IT networks should certainly be slowed down before it is too low and people started using third-party tools and making their own unauthorized solutions. There should be a serious analysis on what must be implemented and over which time scale so the users can get acquainted and do not just suddenly get huge hassle. As to now, the “analysis” seems to be mainly focused on “what is suddenly broken down once we put everything into a jail”; this is not acceptable. The policies should not be based mechanistically on some manual made for a different type of environment, they should be inclusive, flexible enough to adapt to the complex, diverse and heterogeneous UiB environment. The main focus should switch from technology to people: how to reach most of them (they are busy!), make security improvements minimally obtrusive, teach very busy people sufficient security skills without much hassle. Specifically, the most important information should not be sent by global mailing list that may disappear in user’s mail filter, but must be directed personally to each user (it isn’t prohibitively hard to write a script for this, substituting %NAME% with the real user’s name).

The technological part of the solution should develop sensible threat models based on attack and usage statistics. It should be governed by real risks rather than desire to just protect everything quickly and at all costs. Some of the restrictions already applied can be relaxed. A reasonable solution is to apply more sensible score-based security mechanism, e.g. including IP based rules for two-factor or two-step authentication. Some of more secure services, can for example, be available without firewall restriction if the user comes from his/her frequently used Norwegian home IP address (to improve usability while still reducing potential attack surface). This efficiently transforms a jail into a continuum adapting for the threat and uncertainty level. It will also pay back to demonstrate the practical benefits of client-side certificate authentication, OAuth2 and similar more phishing-resistant security token mechanisms (e.g. they can relax the need in TOTP/SMS authentication) to all users. The university should also facilitate much wider use of hardware-based authentication devices, such as YubiKey, for proper two-factor authentication, perhaps even distribute such devices freely in some groups if universal deployment turns out expensive. Such personal identity verification hardware devices are actually a crucial component of modern zero-trust security approaches.

The crucial element of the whole policy is to create incentives for using more secure tools. For example, the use of hardware personal identity verification tokens should allow to bypass all or most restrictions, perhaps even the need in VPN. There would currently be little added risk with such a policy, but the users would be much happier to do their work securely whenever they need without hassle. This would require hard work, additional integration and funding. But educating, helping and cooperating with users—not restricting and obstructing them—would be the only viable strategy to achieve increased security in the University environment in reality, not just on paper.

XMPP direktemeldinger

2020-11-01T13:14:00+01:00

Hva er XMPP?

XMPP (Jabber) er en åpen protokoll for direktemeldingskommunikasjon som har vært under utvikling fra 1999. Alle tekniske detaljer er beskrevet av XEPs. Det finnes mange applikasjoner som bruker denne standarden, men alle er kompatibel med hverandre.

De viktigste fordelene med XMPP fremfor alle andre direktemeldingssystemer er at XMPP er åpent, gratis, ikke tilhører eller styres av ett selskap. Det er også føderert (distribuert), slik at alle kan kjøre sine egne meldingsserver. Hvis ønskelig, kan serveren lukkes (så kommunikasjon med andre servere er ikke tillat) eller fullt sammensatt så kommunikasjon går mellom tvers av eksisterende servere (som i e-post). XMPP har mange innebygde personverns- og sikkerhetsfunksjoner som gir sterk kryptografi ved hjelp av standard og offentlige revidert algoritmer og programvarekomponenter. For eksempel ende-til-ende-kryptering kan bruke GPG / PGP, OTR og OMEMO protokoller (se wiki.404.city).

Muligheten til å kjøre sin egen private server og mange offentlige servere (se offentlige serverer) som er åpne for gratis, anonym registrering, gjør XMPP best egnet for høyt personvern og sikkerhet. En moderner åpen direktmeldingsløsning er Matrix. Men Matrix har dårligere personvernfunksjoner med høyere oppblåsthet (se her og Matrix personvernproblemer). For eksempel, flere år siden den personvernplattformen Disroot har bestemt å flytte tilbake fra Matrix til XMPP.

Sjekk ut forskjellige problemer med Matrix:
Bli med i XMPP nettverket med en av offentlige serverer.

Hvorfor ikke WhatsApp, Skype, Snapchat, Telegram osv?

De fleste andre meldingssystemer har alvorlige personvernfeil og sikkerhetsproblemer. Obligatorisk bruk av den eneste "offisielle" programvare skaper en monokultur der sikkerhetsproblemer påvirker alle brukere. Lukkede kildekoden tillater ikke å revidere disse systemene offentlig. Men produsentene kan implementere skjulte udokumenterte funksjoner, reklamesporere og bakdører.

En av de viktigste sårbarhetene er push-varslingsmekanismen i både Android og IPhone plattformer. Dette påvirker alle apper som bruker push-varsleringmekanismen, selv de som posisjonerer seg som "krypterte" og "sikre." XMPP kan fungere uten pushvarsler.

Flere eksempler

Er Signal åpnekilde? Hva er feil med det?

Anbefalte programvareklienter

Desktop PC
- Pidgin: Fungerer med mange meldingsprotokoller, f.eks. Telegram, Discord, Slack, Hangouts
- Miranda NG: Fullt utstyrt (kun Microsoft Windows), det beste for XMPP
- Gajim: Fullt utstyrt, det beste for XMPP
- Psi and Psi+: Fullt utstyrt, det beste for XMPP
- Swift
- Epost programvare, f.eks. Thunderbird og eM Client
Android
- Conversations: Fullt utstyrt og kraftig programvare (Gratis på F-Droid)
- Monocles (eller på f-droid) — Conversations fork
- Snikket (eller på f-droid) — Conversations fork
- Xabber: Fullt utstyrt og kraftig programvare
- Yaxim: Veldig lett programvare
- Quicksy: En enkelt-oppstart kodegaffel av Conversations
  NB: telefonnummer brukes for kontoregistrering, dette er usikkert
  (pga iboende SS7 sårbarheter) og kompromitterer personvernet.
iOS and MacOS
- Siskin IM og Beagle IM: kanskje den beste klienten
- Monal: Fullt utstyrt og kraftig programvare
- ChatSecure
Nettleserklient
Mange andre klientprogramvare kan finnes på XMPP.org

Mer informasjon

Mer informasjon om XMPP finnes på Wikipedia, XMPP wiki og XMPP.org

Også: XMPP, A Comeback Story: A 20 Year Old Messaging Protocol For Robust, Private and Decentralized Communications

Lister over offentlige serverer: Det finnes mange offentlige servere på Internet som er åpent for bruk av alle. Her ar noen få av disse:

Ikke gratis tjenesteleverandør: jmp.chat er en betalt XMPP-basert tjenesteleverandør som inkluderes direktmeldinger, VoIP, SMS, MMS, telefonnumere, osv.

Også se https://soprani.ca/ og https://cheogram.com/ prosjekter for forening av åpne kommunikasjon nettverker.

Using Subversion to manage Office files

2020-10-23T09:47:00+02:00

Because Subversion works best (and can track) plain text files, it is not well adapted for versioning normal Microsoft Office or LibreOffice/OpenOffice documents. However, both are actually zipped XML files. Therefore, it is possible both directly (binary) and using flat XML text (full version control/merge support).

Microsoft Office

For Microsoft Office, there are extensions for Subversion: Msofficesvnf, OfficeSVN and MagnetSVN.

Also, TortoiseSVN can use native Microsoft Word "compare versions" tool to check for differences between versions. Check out the Diff-Scripts in the TortoiseSVN installation directory. Note that these scripts are js and can be blocked by corporate or university security policy: ask the IT!

Subversion keywords

Subversion keywords (properties) can be managed in Microsoft Word files using SvnProperties4MSOffice.

For more information see https://gotomation.info/2019/01/svn-version-control-office-documents/.

If special software for adapting Office files is not used, it is recommended to use Microsoft uncompressed XML formats for all outputs. While they take more disk space (because it is unzipped), these are plain text XML, so Subversion treats them very efficiently. Also, svn keywords/tags can be used within the text without any additional tools.

LibreOffice or OpenOffice

For LibreOffice, the easiest way is to use .fodt format for saving the document (instead of .odt or .docx), FODT is a flat XML format. A drawback is that it is unzipped and takes much more disk space. But Subversion does not store all versions of the whole file, it saves effectively differences between the versions. Therefore, there is little or no overhead within the version control system of working with fodt files.

Quite importantly, it is then trivial to add keywords to the fodt file on the svn system. Then, it is easy to include normal svn keywords/tags] such as $Revision 1234$ into whenever needed into the fodt file and it will autoupdate on every commit without any additional tools. But note that the whole tag $Revision 1234$ must have the same formatting (i.e. no bold/italic/other font within and including the $ $ delimiters).

For more information see https://wiki.documentfoundation.org/Libreoffice_and_subversion and https://wiki.documentfoundation.org/Svn:keywords.

Conflicts

To avoid conflicts when several people are working concurrently with svn-tracked files, use svn locks. This is because the files are like binary and cannot be easily merged, unlike normal plain text code. In fact, they could be merged, but do not always expect merge to work as expected because the text file includes complex tags and these may be broken at merge.

It is also difficult to resolve conflicts visually. A useful trick is to set this property on the file: svn propset svn:needs-lock "true" file_name.fodt. Then, any svn update will result this file becoming read-only. To allow editing, file lock must be enabled. This ensures that only one user can edit the file at a time.

How differences between versions can be checked?

Because the Libreoffice files are not just text, checking differences is not trivial. Normal diff tool will result in lots of messy XML differences.

But there is a Linux bash script that helps comparing the files through converting FODT to PDF and then running diffpdf utility:

https://git.app.uib.no/Sergey.Budaev/lo_svn/-/blob/master/diffodt

There is also a Windows/DOS batch script that does this trick:

https://git.app.uib.no/Sergey.Budaev/lo_svn/-/blob/master/diffodt.bat

The script requires diffpdf program that is found in most Linux distributions. A Windows version is open source but id not normally distributed in the binary ".exe" form

How to use diffodt script

Compare working copy with the latest revision from svn: diffodt paper.fodt
Compare the working document with r9925: diffodt 9925 paper.fodt
Compare two specific versions of the document: diffodt 9925 9987 paper.fodt

Integrating Subversion into LibreOffice User Interface

Lo_SVN is a LibreOffice extension that adds a basic Subversion functionality into the LibreOffice interface. Then, basic svn commands are available from the LibreOffice menu.

Source code: https://git.app.uib.no/Sergey.Budaev/lo_svn.
Official LibreOffice extension repository: https://extensions.libreoffice.org/en/extensions/show/4071
User manual for Lo_SVN is here: https://budaev.info/pub/doc/Lo_SVN.pdf.

Is Zoom safe to use? Is the company marketing and other information correct and can be trusted?

2020-04-03T11:10:00+02:00

Zoom privacy and security problems

Zoom has demonstrated significant negligence with respect to cybersecurity. Additionally, the company has shown aggressive marketing campaigns and was caught at providing false information to its end users.

Zoom aggressively forces the user to download and install native application rather than use web browser for videoconferencing even though videoconferences will work in the web browser. This is a little suspicious. Browser-based conferences are more convenient for an occasional user and is safer due to browser sandboxing of network applications.
Serious security deficiency on the Apple Mac platform allowing any unauthorized remote attacker to activate web camera, connect to a conference and execute denial-of-service attack. Zoom tried to ignore and deliberately hide information about the very serious security vulnerability and was slow to fix it. See here for more details, and here (technical information is here and here). Zoom management response seem to point to quite irresponsible corporate culture.
More recently it appeared that Zoom was sending users' data to Facebook servers without the user's consent. This is now fixed. See Vice paper and this follow-up.
Zoom was caught at providing false and misleading information that the videoconference has "end-to-end" encryption while this was not so. Check out this. The explanation for this provided by Zoom is unsatisfactory.
Zoom had a serious security vulnerability that could lead to user password leak in Microsoft Windows. See here for details.
Zoom has a strange privacy policy that, even though states that "privacy is very important to us," requires quite large collection of private user's information. There is little explanation about to why this information is collected. Unlike many other similar companies, Zoom does not release transparency report(s). See here: https://zoom.us/privacy
Electronic Privacy Information Centre has filed complaint to FCC
- alleging that the videoconferencing company Zoom has committed unfair and deceptive practices in violation of the FTC Act. According to EPIC, Zoom intentionally designed its web conferencing service to bypass browser security settings and remotely enable a user's web camera without the knowledge or consent of the user.
See more details here
There is a growing concern on the privacy deficiency in Zoom, for more details see this and this. Also see The Guardian.
Recently SpaceX has banned Zoom because of privacy concerns, see here for details.
Zoom has close links with China. Even though the intellectual property, management and marketing are based in the USA, many if not most developers and engineers are bsed in China (see Form S-1 registration statement). This can potentially lead to serious privacy and cybersecurity issues, given the Chinese regime tightening of Internet regulation (censorship, privacy etc.). One example is MLPS 2.0 legislation, 2019 mandating China residents and any foreign companies unrestricted access to user data. (In China, Zoom has a network of agents acting under different names but using the same platform. )

Updates: More on Zoom problems

Vulnerabilities:
- https://objective-see.com/blog/blog_0x56.html
- https://www.bleepingcomputer.com/news/security/zoom-lets-attackers-steal-windows-credentials-run-programs-via-unc-links/
Privacy holes:
- https://www.nytimes.com/2020/04/02/technology/zoom-linkedin-data.html
- https://techcrunch.com/2020/04/03/zoom-calls-routed-china
CitizenLab Report on Zoom:
- CitizenLab published a detailed report on Zoom security and privacy. Here are a few hlights:
  - Zoom documentation claims that the app uses “AES-256” encryption for meetings where possible. However, we find that in each Zoom meeting, a single AES-128 key is used in ECB mode by all participants to encrypt and decrypt audio and video. The use of ECB mode is not recommended because patterns present in the plaintext are preserved during encryption. The AES-128 keys, which we verified are sufficient to decrypt Zoom packets intercepted in Internet traffic, appear to be generated by Zoom servers, and in some cases, are delivered to participants in a Zoom meeting through servers in China, even when all meeting participants, and the Zoom subscriber’s company, are outside of China. Zoom, a Silicon Valley-based company, appears to own three companies in China through which at least 700 employees are paid to develop Zoom’s software. This arrangement is ostensibly an effort at labor arbitrage: Zoom can avoid paying US wages while selling to US customers, thus increasing their profit margin. However, this arrangement may make Zoom responsive to pressure from Chinese authorities.
  - See the full report here: Move Fast and Roll Your Own Crypto A Quick Look at the Confidentiality of Zoom Meetings
Google now banned Zoom for its employees: Google has banned the popular videoconferencing software Zoom from its employees’ devices, BuzzFeed News has learned. Zoom, a competitor to Google’s own Meet app, has seen an explosion of people using it to work and socialize from home and has become a cultural touchstone during the coronavirus pandemic. Read here.
Zoom zero-days for sale: People who trade in zero-day exploits say there are two Zoom zero-days, one for Windows and one for MacOS, on the market. See here for more detail.
Zoom is using the microphone even when not in meeting on MacOSX. Why is the Zoom app listening on my microphone when not in a meeting? An update fixed the problem... but NOT with microphone being activated, but with interface: microphone indicator. Zoom nevertheless continues to activate microphone on MacOSX. Is CCP listening?

How to increase privacy and security of using Zoom on Linux

Sandboxing. On the Linux platform, one solution is always to run Zoom videoconferencing software only in a limited sandbox. Then, Zoom client would not have access to user's files and other processes running on the system.

Update: This recipe works for Zoom v. 3.5.361645.0301, but not for some later versions, e.g. 3.5.374815.0324, see update below on this.

Disable any unauthorized update/upgrade of Zoom client. Do not install Zoom software via the standard reopository. Use static tar.gz archive instead. Select Other Linux OS for installation. Uncompress the static distribution in a safe directory. Disadvantage of this is that update is only manual, check out Zoom web site for new releases and read changelog. But advantage is that zoom cannot silently install any unauthorized update or software on the system.

It also makes sense to register at Zoom with the institutional email but separate password, so Zoom does not use the main institutional login (SSO login). This might help against credentials leak in case of Zoom software vulnerability. Using the institutional email to register would ensure Zoom is registered as "licensed."

Install firejail sandboxing. https://firejail.wordpress.com/:

sudo apt install firejail.

Firejail is a SUID program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf. ... Firejail can sandbox any type of processes: servers, graphical applications, and even user login sessions. The software includes security profiles for a large number of Linux programs: Mozilla Firefox, Chromium, VLC, Transmission etc. To start the sandbox, prefix your command with “firejail.”

Make a configuration file for Zoom in .config/firejail/. Here is the configuration file named as the main Zoom run executable: ZoomLauncher.profile (given the running executable is ZoomLauncher):

# Note: to delete all firejail profiles for all local trusted apps
#  run sudo firecfg --clean
# ----------------------------------------------------------------
# Duplication of zoom configs in noblacklist and whitelist
# sections fixes login credentials no save problem:
noblacklist ${HOME}/.config/zoomus.conf
noblacklist ${HOME}/.zoom
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc
whitelist ${HOME}/bin/zoom
whitelist ${HOME}/.config/zoomus.conf
whitelist ${HOME}/.zoom
whitelist ${HOME}/.cache/zoom
whitelist ${HOME}/downloads
include /etc/firejail/whitelist-common.inc
caps.drop all
netfilter
nodvd
nonewprivs
noroot
notv
protocol unix,inet,inet6
seccomp
private-tmp
# Needed for latest versions of Zoom and perhaps certain other Qt/QML apps
env QML_DISABLE_DISK_CACHE=1

Now Zoom client can be started from the firejail sandbox:

firejail /path_to_safe_install_location/bin/zoom/ZoomLauncher

To make it possible to use standard graphical menus, one need to make a zoom.desktop startup file in the user's directory .local/share/applications. The Exec entry of the file must include the firejail-based startup:

[Desktop Entry]
Name=Zoom Desktop [Jailed]
GenericName=Zoom videoconferencing
Comment=Zoom Desktop Client jailed
Exec=firejail /path_to_safe_install_location/bin/zoom/ZoomLauncher %f
Icon=zoom.png
Terminal=false
Type=Application
Categories=Network;Internet;Education;Qt;
X-SuSE-translate=false

Firejail caveats

Firejail can start serving all user's applications in its jail, which is often too restrictive (e.g. settings are not saved).

To force reconfiguring all application to run in firejail do (do not do this if you are unsure) this:

sudo firecfg
To disable configuring all local applications to run in jail, do this:

sudo firecfg --clean
Do this (sudo firecfg --clean) if you have problems starting applications after installing firejail.
To check if an application is by default starting in a jail, run it from the terminal. If terminal shows several lines like Reading profile /etc/firejail/disable-common.inc then the application runs in a jail.

A newer version of Zoom client (3.5.374815.0324) refused to run in a jailed environment and hanged.

A workaround for running recent Zoom in jail:

add the below line env QML_DISABLE_DISK_CACHE=1

to the firejail config file.

QML_DISABLE_DISK_CACHE Disables the disk cache and forces re-compilation from source for all QML and JavaScript files. (from QML Documentation)

How to increase privacy and security of using Zoom on Microsoft Windows

Here is a link on sandbox in Windows 10: How to use Windows sandbox.

I have not tested how this works.

Android sandbox

For Android, one solution is to use the open source Shelter application, then mobile Zoom can run in a secure container.

I have been running several programs that I do not like to give access to my data within Shelter. It works fine for me.

Advantages:

Contacts (address book) are not leaked to Zoom if a separate address book is used within shelter
All apps can be frozen to avoid them run all the time at the background, this reduces the chances of data leaks as well as battery drain. Freezing can be done automatically, after timeout.

Links

Google Play: https://play.google.com/store/apps/details?id=net.typeblog.shelter.
F-Droid: https://f-droid.org/en/packages/net.typeblog.shelter/.
Source code of Shelter is here: https://github.com/PeterCxy/Shelter.

How to make an array and initialize it with a sequence of values in Fortran?

2019-11-20T10:19:00+01:00

How do you make an array and initialize it with a sequence of values? For example, I want a list from 0.25 to 1.5 that is separated with 0.25. In other words I want something similar to seq(0.25,5,0.5) in R.

Equally spaced real array with fixed increment in Fortran

Producing an equally spaced array from V₁ to V_N with increments ΔV

1. Each of the values in the above vector can be calculated as:

2. The total number of values N in the array ending with a fixed known V_N is equal to

3. It is not possible to use a simple piece of code like this to produce real type array in Fortran:

Array = [V1:VN:Incr]

4. Such a construction cannot be used in modern Fortran, even though old versions could accept a similar construction based on implied loop with real type index counter:

real :: r ! Index must be integer in loops!
print *, (r, r=V1,VN,Incr)

5. In modern Fortran standard do loops can only have integer indexing variable. Real indexing in do loops is one of the very few features that had been deleted from the language because it can create lots of problems in float point computations due to finite precision in computer hardware.

The old code might work with modern compilers but it may require special legacy compiler options. The printing-only code as above may still work but would issue a compiler warning.

6. Initialising such equally spaced real type arrays in Fortran implied loops must use the formulas defined in 1. and 2.

# Produce exactly N_VALS values starting from INIT with increments INCR
Array = [( INIT + INCR * (i-1), i=1,N_VALS )]

Where the number of array elements N_VALS is calculated as:

N_VALS = floor( (END - INIT) / INCR + 1 )

N_VALS = ceiling( (END - INIT) / INCR + 1 )

The floor and ceiling functions convert real value to integer as the lower or upper nearest integer; they can give different values when division cannot be done without the remainder

# All values starting from INIT with increments INCR and up to the limit END
Array = [( INIT + INCR * (i-1), i=1,floor((END-INIT)/INCR+1) )]

7. This code does not seem to be a very simple and elegant solution. Ideally, the code should be packaged into a function returning the desired grid array. But such function could not be used in declarations of array parameters. In the later case the one-liner code should be used as above.

Integer arrays

By the way, it is quite easy to produce an integer array, e.g. here is an initialisation for array from 1 to 100 (|1,2,3,...,100|). This can be useful for indexing arrays.

integer, parameter, dimension(*) :: IDX_ARRAY = (/(i,i=1,100)/)

Examples:

A. Produce an array of 10 values starting from 1.0 with increments 0.1

Array = [( 1.0 + (i-1) * 0.1, i=1,10 )]

Result:

1.00000000 1.10000002 1.20000005 1.29999995 1.39999998
1.50000000 1.60000002 1.70000005 1.79999995 1.90000010

Declaration of a parameter array:

real, parameter, dimension(*) :: Array = [( 1.0 + (i-1) * 0.1, i=1,10 )]

However, note that not all compilers may support assumed array size dimension(*) in such array declaration statement, this requires newer Fortran standard (fortunately, recent versions of Intel and GNU Fortran do support assumed size arrays). In such a case declaration must explicitly set the number of array elements:

real, parameter, dimension(10) :: Array = [( 1.0 + (i-1) * 0.1, i=1,10 )]

B. Produce an array of starting from 1.0 to 2.0 with increments 0.145; note that lower value (floor) for the array size is used:

Array = [( 1.0 + 0.145 * (i-1), i=1, floor((2.0-1.0)/0.145 + 1) )]

Result:

1.00000000 1.14499998 1.28999996 1.43499994 1.57999992
1.72499990 1.87000000

C. The same as (B) but the upper value (ceiling) for the array size is used:

Array = [( 1.0 + 0.145 * (i-1), i=1, ceiling((2.0-1.0)/0.145 + 1) )]

Result:

1.00000000 1.14499998 1.28999996 1.43499994 1.57999992
1.72499990 1.87000000 2.01499987

D. In the case B., declarations of parameter arrays can be done like this:

real, parameter, dimension(*) :: Array =                                  &
                 [( 1.0 + 0.145 * (i-1), i=1, floor((2.0-1.0)/0.145 + 1) )]

or, if the compiler does not support assumed size arrays (*), with explicitly calculated array size:

real, parameter, dimension(floor((2.0-1.0)/0.145 + 1)) :: Array =         &
                 [( 1.0 + 0.145 * (i-1), i=1, floor((2.0-1.0)/0.145 + 1) )]

Test program

! This program illustrates how to produce equally spaced real vectors with
! fixed increment in Fortran.
!
! 1. Produce exactly N_VALS values starting from INIT with increments INCR
! Array = [( INIT + INCR * (i-1), i=1,N_VALS )]
!
! 2. All values starting from INIT with increments INCR and up to the limit END
! Array = [( INIT + INCR * (i-1), i=1,floor((END-INIT)/INCR+1) )]
!-------------------------------------------------------------------------------
program spaced_array

    ! Integer counter for implied loops defining vectors.
    integer :: i

    ! Example A. Produce an array of 10 values
    ! starting from 1.0 with increments 0.1
    real, parameter, dimension(*) :: Array1 = [( 1.0 + (i-1) * 0.1, i=1,10 )]


    ! Example B. Produce an array of starting from 1.0 to 2.0
    ! with increments 0.145.
    ! Note that lower value (floor) for the array size is used.
    real, parameter, dimension(*) :: Array2 = &
    [( 1.0 + 0.145 * (i-1), i=1, floor((2.0-1.0)/0.145 + 1) )]

    ! Example C. The same as (B) but the upper value (ceiling) for the
    ! array size is used.
    real, parameter, dimension(*) :: Array3 = &
    [( 1.0 + 0.145 * (i-1), i=1, ceiling((2.0-1.0)/0.145 + 1) )]

    ! Print the sizes of the arrays that were declared above.
    print *, "Array sizes (Array1, Array2, Array3)", &
    size(Array1), size(Array2), size(Array3)

    ! Print the parameter arrays that were declared above.
    print *, "Array1", Array1
    print *, "Array2", Array2
    print *, "Array3", Array3

end program spaced_array

PDF Card

A PDF version of this document is available here: https://budaev.info/images/spaced-array.pdf.

How to produce a reverse of a vector in Fortran?

2019-11-20T10:19:00+01:00

Let's we have a vector A, e.g.

A = [1,2,3,4,5]

How to produce a vector with reverse indices, e.g.

B = [5,4,3,2,1]

The answer is this:

B = A( size(A):1:-1 )

To reverse A itself do

A = A( size(A):1:-1 )

Gaussian random numbers in Fortran

2018-06-13T13:22:00+02:00

The HEDTOOLS tools library has a module for working with random numbers BASE_RANDOM. There is, in particular, a set of procedures for generating Gaussian random values: RNORM and RNORM_ARRAY. These are based on the Kinderman & Monahan, augmented with quadratic bounding curves method (Leva, 1992: algorithm 712, Trans. Math. Software, 18, 4, 434-435).

I have made a quick comparison of the quality of the Gaussian random numbers generated by the simple Box-Muller method (Box & Muller, 1958)

Classical (ancient) Fortran code:

normrand_number = dsqrt(-2.*dlog(drand(0)))*dcos(2.*pi*drand(0))

that has been used in TEG codes so far...

and the algorithm 712 as implemented in HEDTOOLS using this test program (see attachment).

Fortran code for the test program:

program test_bm
  use csv_io
  use base_random, rand_x => rand     ! Alias rand() as rand_x() for ifort.
  !use IFPORT, only : rand_x => rand  ! This is the Intel Fortran tweak.

  integer, parameter :: prec = 8, arrsize=100000
  character(len=255), parameter :: filename1="file_01.csv", filename2="file_02.csv"
  real(kind=prec), dimension(arrsize) :: norand1, norand2
  real :: timer_start, timer_end
  !-------------------------------------------------------------------------------
  ! Generating Box-Muller random numbers
  call cpu_time(timer_start)  ! START
  do i=1, arrsize
    norand1(i) = sqrt(-2.*log(rand_x(0)))*cos(2.*pi*rand_x(0))
  end do
  call cpu_time(timer_end)    ! END
  print *, "Box-Muller took: ", timer_end - timer_start
  ! Write random normal data to CSV
  call CSV_MATRIX_WRITE(norand1, filename1)
  !-------------------------------------------------------------------------------

  !-------------------------------------------------------------------------------
  ! Generating based on algorithm 712
  call cpu_time(timer_start)  ! START
  call RNORM_ARRAY(norand2)
  call cpu_time(timer_end)    ! END
  print *, "Alg. 712 took: ", timer_end - timer_start
  ! Write random normal data to CSV
  call CSV_MATRIX_WRITE(norand2, filename2)
  !-------------------------------------------------------------------------------

end program test_bm

Comparison of Box-Muller and A712

The alg. 712 looks slightly faster than the simple Box-Muller transform.

alg. 712 is much better, as the Box-Muller significantly deviates from the normal distribution, alg. 712 does not (using the Anderson-Darling test from the nortest R package).

  # Gaussian random numbers by Box-Muller deviate from the Normal distribution:
  > ad.test(data_bm$X1)
      Anderson-Darling normality test
  data:  data_bm$X1
  A = 581.7, p-value < 2.2e-16
  # Gaussian random numbers by Kinderman & Monahan's A712 do not deviate from the Normal distribution:
  > ad.test(data_a712$X1)
      Anderson-Darling normality test
  data:  data_a712$X1
  A = 0.46975, p-value = 0.2474

So, the alg. 712 procedure implemented in HEDTOOLS should be used instead of the Box-Muller method.

References

Box, G. E. P., & Muller, M. E. (1958). A note on the generation of random normal deviates. The Annals of Mathematical Statistics, 29(2), 610–611. http://doi.org/10.1214/aoms/1177706645
Leva, J. L. (1992). Algorithm 712; a normal random number generator. ACM Transactions on Mathematical Software, 18(4), 454–455. http://doi.org/10.1145/138351.138367

About me

2018-05-06T21:30:00+02:00

I am a researcher at the Theoretical Ecology Group, the University of Bergen, Norway. My current research focuses on animal and human behaviour in the adaptive and evolutionary perspective. How cognition, behaviour and personality have evolved through adaptation and natural selection? In my work I try to integrate both proximate and ultimate causation and use both experimental and modelling approaches.

Cognition and behaviour

The current work concerns developing a large scale simulation model that implements a general decision-making architecture in evolutionary agents. Each agent is programmed as a whole virtual organism including the genome, rudimentary physiology, the hormonal system, a cognitive architecture and behavioural repertoire. They "live" in a stochastic spatially explicit virtual 3-D environment with physical gradients, predators and prey. The primary aim of the whole modelling machinery is to understand the evolution of decision making, personality, emotion and behavioural plasticity within a realistic ecological framework.

I believe that understanding and modelling complex adaptive behaviour requires both extraneous factors and stimuli as well as endogeneous architectural mechanisms (genetic, hormonal, cognitive etc.) that produce the behaviour. Explicit proximate representation of the motivation and emotion systems, prediction-oriented cognition provides a better approach to understand the behaviour, adaptation and evolution of the whole organism. Ultimately, such an approach can help us understand the evolutionary emergence of consciousness and complex cognition.

For more details, links to source codes etc. see The AHA Model web page.

Animal personality

Although I am interested in any species, most of my work so far has been conducted on fish. Using series of tests we have shown that individual fish of several species have consistent personality traits that translate to a variety of different adaptive contexts. Individual fish with different personalities, such as shy and bold, may behave quite differently in their natural environment, e.g. prefer different social strategies (school or not to school) and different local habitats. Shy and bold fish choose their mates based on personality, personality also significantly affects their parental care tactics. Personality in fish can be linked to the operant learning performance. For example, shy fish may be more susceptible to the development of the conditioned fear, providing a link between emotion and personality in such "lower" vertebrates. It is also possible to trace the development and the appearance of consistent personality traits during the ontogeny. Certain environmental effects, like exposure to light, acting early in the ontogeny could significantly affect fish personality via the involvement of specific brain structures, such as the photosensitive habenula. Personality in fish and other species could be linked with lateral asymmetries via the involvement of the morphologically asymmetrical habenula. I am also interested in the adaptive and evolutionary mechanisms that bring about patterns of consistent personality and alternative strategies. We have shown that gender differences in personality follow from sex-related adaptive strategies in humans. In another study we have shown how a trade-off between parental food provisioning and the fry's own individual experience of searching for cryptic food creates a range of parental strategies in a cichlid fish. This reflects my specific interest in the evolution of mate choice and parental care in fish, and their potential role in sympatric speciation. Currently, we are developing models linking emotion and decision making to understand the proximate and ultimate factors governing the evolution of consistent personality.

Ecology and conservation

I am also interested in complex biological interactions at various levels, e.g. competitive interactions between multiple cladoceran species and their predators, and relationships between various associates and the host within a symbiotic community. The former is closely linked with conservation and species invasion. We have developed a model that allows to predict the population dynamics and the invasion success among freshwater cladocerans in various conditions. I took part in several conservation projects, ranging from coral reef and freshwater conservation in Vietnam to fish monitoring and protection in subarctic Siberian rivers and optimising sturgeon hatcheries. We have developed a series of quick low-technology tests for rapid assessment of the coral reef health. Additionally, we have developed hydroacoustic methods for the assessment of the fish populations in very shallow water bodies, such as large Siberian floodplains.

Evolution again

2009-11-15T11:00:00+01:00

This is a copy of a letter published in Mass of Ages November 2009.

Critics of the evolutionary theory (ET) are struggling against windmills. ET is a specific biological theory based on a precise mechanism, natural selection. When understood in its duly limited scientific context, it has nothing to do with the spiritual, does not translate to the evolution of the Universe, evolutionism in philosophy or theology. ET is not intrinsically atheistic either.

ET does not contradict the Genesis and the Catholic doctrine. The Church has never condemned or even questioned scientific ET. “Evolution is scientifically proven to be impossible and continues to lose credibility on scientific grounds.” Wrong, ET has huge support in genetics, ecology, paleonthology, mathematics etc. “Alternatives like the Creation science or Intelligent Design are not religiously affiliated, and provide arguments against the ET.” Wrong, these so-called “theories” are the invention of protestant fundamentalists. They lack credibility and are not even considered seriously by most biologists. ET “has brought us the mass murder of the unborn,” evolutionism in theology etc. Wrong emotional argument, should we then question the scientific validity of modern physics because of Hiroshima?

ET is not incompatible with the Magisterium, but it is incompatible with the false theology of fundamentalist protestants: impossibility of any creative activity of the matter, synergism between the Creator and the created (hence total depravity as a result of the fall, sola fide salvation, predestination), sola scriptura and literate interpretation etc. Do not allow these false doctrines to creep into the Catholic teaching.

Sergey Budaev

The machine stops: AI bubble must burst

The facts are that

The machine stops

Norwegian researchers develop digital twin model to optimize fish feeding

Microsoft Word for scientific texts? No, thanks.

References

FishMet: Digital twin for precision aquaculture

Fish & chips? Modellen som kan hjelpe oppdrettere med å optimalisere fôrstrategier

The omnipotence paradox reduces to the omniidiota dilemma

The paradox of the stone

The omniidiota dilemma

References

Det er enkelt å dele

Epostlister

E-post diskusjonsgrupper

Durov, Telegram and responsibility

Bruk F-Droid i stedet av Google Play Store

A year with Mikrotik router

Shit happens: det kommer garantert til å skje hvis dumhet gjentas

Telefonen til et barn

Knappetelefoner er klassiske, men ikke udaterte!

Nettbrett gir mye bedre brukeropplevelse

Konklusjon

Anbefalt lesing

Oppdatering: lenker

XMPP server on 1-2-3

Take back your freedom, privacy and security

1. Install XMPP server software

2. Configure your XMPP server

3. Configure the XMPP users and client application

Further

Secure connection for a stand-alone XMPP server

Simple web server

Example configuration file

XMPP: en ideell direktemeldingssystem for et familie

Lenker

Intervju kristendom

Hvordan å praktisere religionen?

Hvilke sakramenter påvirker ditt liv mest og hvordan?

Hvis gud er allmektig, hvorfor tror du det er så mye ondt i verden?

Goodbye Gmail

Migadu is my choice

How to use open source openconnect for UiB VPN

Openconnect

Server settings

Basic connect using command line

Connect using graphical user interface

Microsoft Windows

References

Are we going to work in a paper jail?

Main points

The great firewall

Some specific problems

Multi-factor authentication via TOTP: Not a panacea.

Personal hardware tokens

VPN needed for all, even the most essential everyday services

Is the universal jail really essential for everything?

Human ingenuity: Is the jail actually made of paper?

What should be done?

XMPP direktemeldinger

Hva er XMPP?

Hvorfor ikke WhatsApp, Skype, Snapchat, Telegram osv?

Flere eksempler

Anbefalte programvareklienter

Mer informasjon

Using Subversion to manage Office files

Microsoft Office

Subversion keywords

LibreOffice or OpenOffice

Conflicts

How differences between versions can be checked?

How to use diffodt script

Integrating Subversion into LibreOffice User Interface

Is ​Zoom safe to use? Is the company marketing and other information correct and can be trusted?

Zoom privacy and security problems

Updates: More on Zoom problems

How to increase privacy and security of using Zoom on Linux

Firejail caveats

How to increase privacy and security of using Zoom on Microsoft Windows

Is Zoom safe to use? Is the company marketing and other information correct and can be trusted?