Mi blog lah! Το ιστολόγιό μου

10Aug/100

Announcing the Certificate Watch (CertWatch) Firefox addon

CertWatch is a Firefox add-on that helps you control how digital certificates are used when you visit secure websites. While there exist tools that help control how, for example, scripts like Javascript are executed (NoScript addon), there has not been a tool for digital certificates.

The closest Firefox addon to the functionality of CertWatch is Certificate Patrol, which keeps track of website certificates and notifies when a revisited website has a different website certificate. CertWatch collects more information than Certificate Patrol and keeps track of root, intermediate and website certificates, plus visit details.

Once you install CertWatch and restart Firefox, CertWatch will take up to 30 seconds to parse all root certificates that your Firefox comes with. Every secure website that you visit is vouched for by some root certificate that pre-exists in Firefox. Your Firefox has about 150 of those root certificates, and you can traditionally view them in Edit»Preferences»Advanced»Encryption»View Certificates»Authorities.

Screenshot of CertWatch 1.0 running for the first-time

Screenshot of CertWatch 1.0 running for the first-time

This is Firefox 4 (beta1) with a new profile. Both Firefox 4 and Firefox 3.6.8 (as found in Ubuntu 10.04) come with 149 root certificates. If you have more than 149, then you accepted yourself extra root certificates which are fully enabled and can vouch for secure websites. As you browse, your Firefox collects intermediate certificates (I plan to explain all these in future posts at certwatch.simos.info). These are added to Firefox without user interaction, as long as the respective root certificate is in Firefox as well.

Screenshot of CertWatch 1.0 Preferences

Screenshot of CertWatch 1.0 Preferences

These are the preferences, accessible from Tools » CertWatch Preferences. When you visit a secure website, there is a process where the website certificate is vouched by the root certificate that Firefox already knows. Between the website and root certificates there could be intermediate certificates, creating what is called a certificate chain.

What the preferences do is specify when you should get a notification while you visit a secure website. The default preferences say that for the certificate chain of a secure website, show the certificate details if any of the website, intermediate or root certificates are encountered for the first time.

Let’s visit https://addons.mozilla.org/ with CertWatch installed.

Screenshot of CertWatch 1.0 - certificates at addons.mozilla.org (animated GIF)

Screenshot of CertWatch 1.0 - certificates at addons.mozilla.org (animated GIF)

Each tab correspond to a certificate. All these three certificates are the certificate chain that verifies the secure website https://addons.mozilla.org/. The numbers at the tab names indicate how many times CertWatch encountered these certificates. It’s the first time, so they all show 1. The black star ★ indicates whether the CertWatch Preferences apply for each certificate. Since the preferences indicate first time only, then all tabs get a star.

From the list of root certificates, only a handful of them will be ever used during your browsing and with CertWatch you now have the facility to figure out which ones are actually being used. At this stage I would consider this as the first most important use of CertWatch; keeping track on how many times certificates are used. If you encounter a new certificate when you visit a revisited website, then this is something to investigate.

CertWatch keeps its copy of certificates in an SQLite database in your Firefox profile. For Linux, the path is ~/.mozilla/firefox/YOURPROFILENAME/CertWatchDB3.sqlite. You can read the database with any SQLite client such as the Firefox Addon SQLite Manager or sqlitebrowser (Packaged in Debian and Ubuntu as sqlitebrowser). In the SQLite database you can view the root/intermediate certificate table, the website certificate table, and the website visits table. In all cases the full certificate is stored in case you want to contribute to the EFF SSL Observatory.

CertWatch is developed on Ubuntu Linux 10.04, with Eclipse 3.6 (Helios) and the JSDT environment.

Install the latest version of CertWatch, which is available from the addons.mozilla.org (AMO) CertWatch page.

Follow the progress of CertWatch at the http://certwatch.simos.info/ CertWatch blog.

Here are some secure websites for testing, https://www.google.com/, https://www.paypal.com/, https://www.facebook.com/, https://twitter.com/

20May/095

Αναβαθμιστείτε από hotmail σε GMail.com

Ενημέρωση: Μπορείτε να δείτε το περιεχόμενο του άρθρου αυτού και μέσα από το Google Docs, http://docs.google.com/Doc?id=dccdrjqk_14czzrvdcn

Έχετε λογαριασμό hotmail και θέλετε να περάσετε στο GMail για όλους τους γνωστούς λόγους και πλεονεκτήματα που παρέχει η υπηρεσία της Google. Πως μπορείτε να κάνετε τη μεταφορά;

Πριν λίγους μήνες ήταν εφικτό να προωθούμε αυτόματα την αλληλογραφία που λαμβάνει ένας λογαριασμός Hotmail σε άλλο τρίτο λογαριασμό ηλ. αλληλογραφίας, και αυτό ήταν κάτι που έκανε τη μετάφορά προς GMail ή αλλού πολύ εύκολη. Ωστόσο, η Microsoft αποφάσισε να περιορίσει αυτή τη λειτουργικότητα με το να επιτρέπει μόνο τη προώθηση προς άλλους λογαριασμούς των υπηρεσιών της ίδιας εταιρίας (όπως hotmail.com, live.com, κτλ). Αυτός ο περιορισμός είναι παράξενος και θα μπορούσε να πει κανείς ότι είναι προσπάθεια για να μην αφήσει τους χρήστες να μεταβούν σε άλλες υπηρεσίες.

Από τα μέσα Μαρτίου 2009, η Microsoft παρέχει πρόσβαση POP3 σε λογαριασμούς live.com και hotmail.com. Φαίνεται ότι η Microsoft αναγκάστηκε να προχωρήσει στη ρύθμιση αυτή διότι υπάρχουν χρήστες με φορητές συσκευές και κινητά τηλέφωνα που μπορούν να λαμβάνουν την αλληλογραφία μόνο με πρωτόκολλα όπως το POP3.

Οπότε, πως μπορείτε να μεταφερθείτε από το hotmail.com ή live.com προς GMail;

  1. Στο GMail, κάντε κλικ στο Ρυθμίσεις→Λογαριασμοί και δείτε προς το τέλος της σελίδας την ενότητα Λήψη μηνυμάτων ηλεκτρονικού ταχυδρομείου από άλλους λογαριασμούς.
  2. Κάντε κλικ στο Προσθήκη άλλου λογαριασμού ηλεκτρονικού ταχυδρομείου που διαθέτετε.
  3. GMail Add your accountΘα δείτε ένα νέο παράθυρο που σάς ζητά να δώσετε το νέο λογαριασμό από τον οποίο θέλετε να λαμβάνετε την ηλεκτρονική αλληλογραφία. Εδώ βάζουμε το λογαριασμό Hotmail.com
  4. GMail My account Settings
  5. Όταν πατήσετε στο Προσθήκη λογαριασμού », το GMail θα ελέγξει εκείνη τη στιγμή αν μπορεί, με τα στοιχεία που δώσατε, να συνδεθεί με το λογαριασμό σας του Hotmail. Αν υπάρξει κάποιο πρόβλημα, θα αναφερθεί μαζί με την ακριβή αιτία του προβλήματος. Για παράδειγμα, παρατήρησα ότι το Hotmail δεν επιτρέπει τη σύνδεση μέσω POP3 αν δεν περάσουν δεκαπέντε λεπτά από την τελευταία σύνδεση. Οπότε, όταν προσθέτετε περισσότερους λογαριασμούς Hotmail, αφήστε ένα χρονικό περιθώριο, τουλάχιστον ένα τέταρτο.
  6. GMail IdentityΣτην επόμενη εικόνα έχετε την επιλογή αν θέλετε να δημιουργήσετε μια νέα ιδιότητα (ταυτότητα) χρήστη για το λογαριασμό του Hotmail που ρυθμίζετε. Με την ιδιότητα χρήστη Hotmail, μπορείτε (αν το επιθυμείτε) να απαντάντε και να στέλνετε γράμματα από το GMail ενώ ο παραλήπτης θα βλέπει ότι το γράμμα ήρθε από το Hotmail! Κατά τη σύνταξη ενός γράμματος, με την παραπάνω επιλογή, έχετε τη δυνατότητα να καθορίσετε τον αποστολέα! Εδώ προτείνω να ενεργοποιήσετε την επιλογή αυτή, με την προϋπόθεση να τοποθετήσετε το λογαριασμό GMail στο πεδίο Reply-To. Αυτό σημαίνει ότι από προεπιλογή, όταν απαντάτε σε γράμματα που ήρθαν από το Hotmail, ο αποστολέας θα είναι ο λογαριασμός σας του GMail. Έτσι, κατά επιθυμία, θα είστε σε θέση να επιλέγετε για κάποια γράμματα να απαντάτε με την ιδιότητα του λογαριασμού Hotmail. Αυτή η διαδικασία επιτρέπει τις επαφές σας να μαθαίνουν σταδιακά ότι έχει αλλάξει η διεύθυνσή σας με το λογαριασμό σας στο GMail. Για τις επαφές σας που συνεχίζουν να στέλνουν αλληλογραφία στο λογαριασμό Hotmail.com μπορείτε να τους υπενθυμίζεται ποια είναι η τρέχουσα διεύθυνσή σας.

5May/092

Migrate from Hotmail to GMail

So you have this Hotmail account and you want to migrate to GMail for all the obvious reasons. How can you do that?

A few months ago it was possible to forward your Hotmail e-mails to another e-mail account, which made it very easy to migrate to any other e-mail provider. However, Microsoft decided to limit this functionality so that you can only forward within the Microsoft e-mail services (such as hotmail.com, live.com, etc). This limitation looks like a desperate attempt to limit the drain of e-mail users.

Since mid-March, Microsoft provides POP3 access to your live.com or hotmail.com e-mail account. It looks like Microsoft had to let this go because users want to receive their e-mails to their mobile devices, etc.

Thus, how do you migrate from Hotmail.com or Live.com to GMail?

  1. In GMail, click on Settings→Accounts and scroll down to Get mail from other accounts.
  2. Click on Add a mail account you own.
  3. GMail Add your account

  4. GMail My account Settings

  5. When you click on Add Account », GMail will check on the spot if it can access the Hotmail account. If there is a problem, you will be prompted with the precise error. For example, I noticed that Hotmail does not like logging on in POP3 twice with 15 minutes. So, when you add two Hotmail accounts, space it out to over a quarter of an hour.
  6. GMail Identity

    On the next screen, you are prompted if you want GMail to setup an e-mail identity for this Hotmail account. What this does is that it allows you to reply to the received e-mails using your Hotmail e-mail address while you are inside GMail! Here I recommend to enable this feature, but select your GMail address in the Reply-To field. This means that by default, when you reply to your Hotmail mails, the sender will be your GMail account. However, on demand, you have the option to select the identity of your Hotmail e-mail account when composing a new e-mail. This process helps in your contacts learning gradually that your e-mail address is actually your GMail one. For those that continue to send mails to your Hotmail.com account you can remind them which is your current address.

19Nov/080

Rendering bug in Firefox, threat level: annoyance

There is this rendering bug in Firefox that currently can be classified as an annoyance.

It was discovered during a discussion at the Ubuntu-GR mailing list and reported in June 2008, and at that time it would cause Firefox to crash. Therefore, it was deemed as a security issue, and the bug report was not made public. Just recently, the issue was revisited, current versions of Firefox do not crash, and the security tag was removed. It is quite possible that there is some existing report on the issue, and not being classified as a security bug, it will be easier sort out. Thus, have a look at bug report #441307.

The source of the rendering bug is the HTML code

<HR WIDTH=143165425 ALIGN=RIGHT>

So, you send an HTML e-mail and you add the above code. The code says to show a Horizontal line, with some huge width (here, you simply put 143165425).

If you received such an annoying e-mail, here is how it may look like (Yahoo WebMail)

If you received such an annoying e-mail, here is how it may look like (Yahoo WebMail)

How GMail might look like when you receive such an HTML email.

How GMail might look like when you receive such an HTML email.

Some versions of Firefox respond differently to this rendering bug, which probably relates to a different set of linked libraries. For example, the Firefox 3 found in Ubuntu Linux 8.10 is able to show the e-mail in GMail just fine (though it messes up with other pages). The above screenshots are by Minefield 3.1b2pre (64-bit). The Windows version of Firefox is also affected.

To try out yourself, create a file /tmp/mypoc.html with contents

<!DOCTYPE HTML PUBLIC “-//W3C//DTD HTML 4.0 Transitional//EN”>
<HTML>
<HEAD>
</HEAD>
<BODY BGCOLOR=”#ffffff”>
<TABLE WIDTH=100% BORDER=0 CELLPADDING=2 CELLSPACING=2 BGCOLOR=”#e0e0e0″>
<TR>
<TD>
<HR WIDTH=143165425 ALIGN=RIGHT>
</TD>
</TR>
</TABLE>
This is a test.
<HR WIDTH=143165425 ALIGN=RIGHT>
Some more text.
</BODY>
</HTML>

Load it up in Firefox. Click to Select All, then Copy. You can then paste in your mailer, when you compose as HTML (for example, with Thunderbird).

Just to reiterate, this issue is currently at level annoyance, unless someone manages to produce an HTML file that can crash Firefox. If you manage to do so, please file a bug report at http://bugzilla.mozilla.org/ and specify the security settting so that the bug gets high priority.

22Aug/080

Practical UPnP in Linux

UPnP is a set of protocols that allow the automatic configuration of devices. One of those protocols, the Internet Gateway Device (IGD) protocol, allows software to configure routers for NAT traversal without user-intervention. In other words, with UPnP/IGD, the long and error-prone manual configuration for port-forwarding can be done automatically.

When tasks are done automatically, they are less visible to the user, and users are not comfortable that they are in charge of the process.

For the case of UPnP/IGD, we look into the open-source (LGPL) GUPnP library and the companion tool gupnp-universal-cp. You can install these from source (pick the packages gssdp, gupnp, gupnp-tools, and install in this order), or just install the package gupnp-tools from your package manager (for Debian and Ubuntu, these packages reside in Debian unstable).

Once you have installed the tool, you can start it from Application→Programming→UPnP Universal Control Point. This tool can be used for all things UPnP, however we focus on IGD here.

Screenshot of gupnp-universal-control-point, showing one UPnP router found.

Screenshot of gupnp-universal-control-point, showing one UPnP router found.

Once we start the UPnP Universal Control Point, we get the above screen. The tool sends discovery requests to the local network for UPnP-capable devices, and automatically the list gets populated. In the screenshot you can see that a router has been detected, and general information is shown.

If your router does not appear in the list and you are sure that UPnP is enabled on the device, then you might have hit on a known bug, Bug 1078 – Some devices may not work due to User-Agent field in requests. In this case, you need to make a minor edit in the source code and recompile.

Going through the available functions that the router exports, and allows to configure remotely.

Going through the available functions that the router exports, and allows to configure remotely.

Going through the available functions that the router exports, and allows to configure remotely.You can easily distinguish the functions that allow to perform port-forwarding. The one we have highlighted can be used to list the details of the currently active port-forwarding rulers. We right-click and select Invoke, which leads us to…

Action invocation in GUPnP Tool

Action invocation in GUPnP Tool

We just pressed the Invoke button, and since there was a rule with Index 0, the details get filled in for us. Here we can see that Skype has opened a port-forwarding rule for us; when someone from the Internet is connected to port 18210 of this router, the network connection is mapped to the local system with IP address 192.168.1.67.  In the mapping description it shows that Skype was the program that set this rule.

You would normally increase the Mapping Index and click on Invoke, in order to see any additional port mappings. Skype generally opens a few more ports, so there is more to see.

For all the shortcommings, UPnP/IGD is an important network configuration protocol. Due to the lack of an open-source library, applications had to implement UPnP support from scratch. Now with GUPnP, it is much easier to write UPnP-enabled applications.

UPnP/IGD is very important for applications such as Ekiga, Pidgin (file transfers!), Empathy, XChat (for DCC). This has to be done in order to raise the bar in terms of connectivity, and so that it Just works.

13May/080

thersa.org.uk, infected.

Probably through SQL injection, this page of thersa.org.uk links to a javascript file from some server in China

The screenshot shows the thersa.org.uk website has been infected, and users that visit it end up running in their browsers malicious JavaScript code. The code loads Javascript files from the .cn and the .la domains.

There is a reference in one of the files to a cookie named killav (Kill Antivirus?) that may disable some antivirus programs.

In addition, one of the JavaScript files checks which browser you have. If you have Internet Explorer 6 or 7, it loads some exploit which attempts to run binary code. If this succeeds, you are infected. If you have Firefox, it does not attempt to perform an infection, and it goes to the next phase.

The next phase is to open up pages to sites in China. It appears to me that the bussines plan in that case is to generate revenue from ad hits.

The worst thing however is if you get infected. Unpatched windows systems are at the mercy of these attackers.

One way to mitigate such risks is to use Mozilla Firefox, and have the NoScript add-on installed.

Update 5 June 2008:

The RSA updated their website by moving it away from Windows and ASP, to open source software. They are using Centos Linux, Apache, and an open-source CMS. Therefore, the above security risk does not apply any more.

18Apr/070

Connecting to Bluetooth devices between Linux and Windows

A common issue that arises when you connect your laptop to your Bluetooth device (such as mobile phone), is that the device forges a unique authentication with the Bluetooth stack of the operating system. What that means is that if I pair my laptop with my phone in Linux, the pairing works only in Linux. When I boot in Windows, I have to remove the pairing from the phone and establish it again in Windows. Then, when I connect to Linux I need to remove the pairing and establish it again, and so on.

The reason for this problem is that we use a single USB device (whether a dongle or module) that has a single MAC address. The mobile phone differentiates between pairings based on the MAC address.

Therefore, how can we solve this issue? A search with Google shows that it is a known issue with no answer yet. There are two avenues to fix this problem;

  1. get the Linux bluetooth stack to change the MAC address so that a second pairing will be possible. I am not sure if it is possible as some of the security functions probably take place on the Bluetooth hardware. Currently hciconfig does not offer an option similar to ifconfig eth0 hw ether 00:11:22:33:44:55.
  2. find the authentication data of the pairing on Windows and convert to the format that the Linux stack understands and accepts. In this way, a single pairing will work for both operating systes.

I do not have a solution yet. If someone can looking into these it would be great!

5Sep/064

Freenigma (PGP) firefox extension for your GMail

The image “http://www.freenigma.com/img/encrypt.jpg” cannot be displayed, because it contains errors.

Freenigma is a Firefox extension that adds PGP support to GMail. You install the Firefox extension and when you are about to write an email in GMail, it rewrites the page code to add the PGP support.

Using public-key cryptography is generally cumbersome when you take in account the management of the public keys of the other people you communicate with, and also keeping around your private key to decrypt the mails you receive. Freenigma, currently at beta, helps alleviate these problems.

I would like to see a security researcher look into the implementation of Freenigma, and especially for any sources of vulnerability.

15May/060

Free Alaa!

The image “http://static.flickr.com/56/142869951_0ce7433c56_o.gif” cannot be displayed, because it contains errors.

Alaa is a young prominent Egyptian blogger that was arrested and jailed among 47 activists on 7th May 2006 during a peaceful demonstration in Cairo.
His personal website and blog, shared with his wife Manal, is http://www.manalaa.net/ has the latest news about his condition.

There is a petition by Hands Across the Mideast Support Alliance (HAMSA) to free Alaa, which I copy:

Demand Egyptian Regime Release Alaa from Tora Prison

Alaa Abd El-Fatah is one of Egypt’s most prominent bloggers and free speech advocates. He and his wife Manal run the popular blog BitBucket, which collects posts from dozens of Egyptian blogs and which won a “Best of the Blogs” award in December from Reporters Without Borders.

On Saturday (May 7), Alaa was arrested with a group of activists during a peaceful demonstration outside a Cairo courthouse. The rally denounced disciplinary hearings for two reform judges and arrests of protestors at previous demonstrations. Alaa and a group of other demonstrators were cornered by Egyptian police, and security agents then apparently handpicked individual protestors for arrest.

Alaa seems to have been targeted because of his high profile: he helps organizes the protests and spread the information through the blog aggregator he runs. He is now being held in notorious Tora Prison — and his arrest seems designed to both shut down his blog aggregator and scare other Egyptian bloggers. But you can send a message to the Egyptian government through the petition below (you can edit the petition text), which will generate an email to political leaders who can secure Alaa’s release.

The petition will be sent to:

  • Egypt’s Ambassador to the US Nabil Fahmy
  • Egyptian Prime Minister Ahmed Nazif
  • Egypt’s Interior Minister Habib El Adly
  • US Ambassador to Egypt Francis Ricciardone
  • US Assistant Secretary of State David Welch

This campaign has been signed 1047[check page for latest figure] times. Click here to see who’s signed.

Join the Campaign

Alaa is speaking (has the mic) at an event about Open-Source software for NGOs in Africa.

9Mar/062

Taxis and security

It is quite encouraging that citizens taxed in Greece are able to file their tax reports through the Web, at the Taxis Website. Sadly, it has been reported that standard-compliant Web browsers are not supported by the Taxis Website. If you are affected, do complain about it! If you file taxes and you are affected, file a report.
Let’s see some more issues.

A. The main login page is not configured properly with regards to the autocomplete feature found in modern browsers; as is, your username and password get saved by default in your browser. If your computer is stolen or a trojan horse gets installed on your computer, your tax details are gone! :(

The Web developer should modify the HTML code from

< span class=“textblue2″>< b>user name: b>span>
< input type=“text” name=“username” maxlength=“40″ size=“15″ value=“testing”>
< P>< span class=“textblue2″>< B>password:B>span>
< input type=“password” name=“password” maxlength=“40″ size=“17″ value=“testing”>

to

< span class=“textblue2″>< b>user name: b>span>
< input type=“text” name=“username” autocomplete=“off” maxlength=“40″...
< P>< span class=“textblue2″>< B>password:B>span>
< input type=“password” name=“password” autocomplete=“off” maxlength=“40″...

B. The page http://webtax.gsis.gr/taxisnet/login.do claims that users are protected by Verisign (SSL/TLS). Quite sadly, the intent has probably been that users will connect through the proper URL, at https://webtax.gsis.gr/taxisnet/login.do. Dear Taxis, you should place an HTTP redirection to move all users to the SSL/TLS-protected URL. You are in breach of your Verisign license!

The image “http://static.flickr.com/55/110197352_d60be48ab3_o.png” cannot be displayed, because it contains errors.

I will follow on the above report here.

Actually, it would be much better if the web server is SSL/TLS only (no plain HTTP version available). The web server should be configured at any access to a URL under http://webtax.gsis.gr/… should redirect to https://webtax.gsis.gr/.
C. What is worst of all, the website provides content in the 8859-7 8-bit legacy encoding. It is much better to convert to Unicode and UTF-8. I do not know if users have to write text in Greek for their tax forms…
I don’t file taxes so I am not sure if there are more issues once you logon.

Update: The http://webtax.gsis.gr/taxisnet/login.do URL does not work anymore (it forwards to another Website which is down). I did not hear back from Verisign; it’s possible that the two events are linked together.

23Oct/052

The return

I just arrived back home. I was flying with Ali.
The trip was quite tiring but we managed to pull through.

Rustam was really helpfull, he picked us up on time at midnight (there was an city electricity cut) and we reached the airport swiftly.

There, we waited a bit at the queue to check in. While waiting, a certain “semi-official” person came towards me and asked for my passport. For those who do not know, this is a leading question to give me your money.
I remembered Marek’s story and quickly employed the response style Who are you to ask for my passport?. He lost a bit of steam and Ali took over talking in Persian/Tajik. He said we are both Iranians and that guy lost all interest and left. :)

We got front row seats, overlooking the grey wall of the aircraft, just before the pilot cockpit. The window seat of the row was allocated to a Tajik cardio-surgeon (perhaps a famous one?) who was going to Moscow for a conference. He was nice and talkative.

After four hours on the air, we reached Domodedovo and proceeded to the Transit Area, the dreadful place of eternal wait. You need to wait there for several hours before actually checking in. The wait depends on the time of your connecting flight. Our connecting flight was in 10 hours.

For the uninitiated, I include some shots
Domodedovo airport Transit Area
General view of Transit Area

The tiles at the airport
Detail of the tiles. (Tile obsession? No, just read on).

Scales and drinks dispenser
View of the refreshment machine and precision scales.

One window is shattered
View of shattered window (was still like that on the incoming leg). It’s double-glazed and the outer layer is damaged but not broken, so it does not look like an emergency to fix.

Security guard
The security officer. Oh, “no photos in Transit Area”.

As seasoned Domodedovo Transit Passengers, Ali and I wrote down some tips on what to do to kill time while waiting. Ali did most of the work and also provided the cheat list.

34 things to do at Domodedovo Airport Transit Area while waiting

  1. Open a packet of baby wipes and start cleaning a difficult smudge on the floor; finish all tissues.
  2. Go to bathroom, change outfit and return. Ask where the transit area is.
  3. Make houses of cards using Demodedovo Transit information booklets. Compete with fellow passengers for tallest building. Organise competition between passengers and officers.
  4. Switch on laptop, when noticed, smile cunningly and rub palms together. Exclaim “free access!”.
  5. Take off shoes and belt while in Transit Area. When asked, reply you want to be ready for body search.
  6. Ask repeatedly where your checked-in luggage is.
  7. Enter staring contest with security officer. Hi-five fellow passengers when you win.
  8. Measure dimensions of shattered window; make estimate of cost to replace and start cookie jar fund.
  9. Sneeze near shattered window; start crying and apologise for shattering it.
  10. Weigh yourself at precision machine in the Transit Area. Make loud remarks that it does not report the correct weight.
  11. Count the number of steps at the staircase leading to transit area (15+15).
  12. Count the number of steps on elevator leading to transit area (62, 26 showing at any time).
  13. Count the number of dark blue tiles at the Transit Area (limit to those legally accessible by passengers: 60).
  14. Use every restroom in area.
  15. Annoy officers at Transit Area by walking up and down a la goose walk.
  16. Try to learn Russian by reading aloud the signs.
  17. Learn to tell the time in Russian (hint: ask security officer every ten minutes)
  18. Take a photograph of the shattered window (normally not permitted, mmm not encouraged).
  19. Persuade security officer to take photo of you at the shattered window (normally not permitted).
  20. Play hop-scotch.
  21. Close your eyes and walk in the Transit Area; avoid obstacles.
  22. Ask for help to fill in declaration forms (not required for transit passengers).
  23. Time the cleaning ladies with stopwatch. Congratulate at end in Russian.
  24. Examine suspiciously the fruit juice dispenser.
  25. Use foreign coins (not rubbles) at fruit dispenser. Complain if cans are not dispensed.
  26. Walk across Transit Area making sure you do not step on white blue tiles.
  27. Time how long the automatic escalator requires to pause; complain if anyone uses the escalator, show the direction to the stairs.
  28. Ask “Do you speak English?” to security officer. Observe expression when he says “No”.
  29. Establish the purpose of strange wire that leads to smoking station.
  30. Walk behind terminal desks; press random buttons when no one is watching.
  31. Find blind spots behind the pillars; so that the security officers or administrators cannot see you. Hide all waiting passengers in bling spots.
  32. Observe closely shattered window. Drag finger on it as if deciphering old script. Exclaim periodically “Aha!”.
  33. Locate nearer emergency exit. Time yourself how long it takes you to reach it.
  34. Sit at a check-in desk. When confronted, complain that the Internet kiosk “ate” your ten dollar bill. Demand full refund.

Creative Commons licence

Thanks to the tips, time passed swiftly and we find ourselves at Gate 7, ready to embark the plane. Alas, the security door gets stuck and cannot open. Picture here the attempt for 4 officers trying to break a rather high-security door. After 15 minutes and over 4 minutes of video footage :) , they managed to open it and we embarked the plane.

Upon touchdown at London, there is an announcement that Mr Ali and Mr Simos identify themselves to the crew. This obviously spooks the fellow passengers. After a few minutes, we find out that our checked-in luggage has not been sent with this airplane. Great, 10 hours waiting and the luggage are sent in wrong plane.

All in all, FOSSTJ was an excellent experience that I’ll never forget.

27Jul/050

Hey, what language is this page in?

This Website is predominantly in Greek. Have a look at the home page for some information in English, and also info on how to contact me.

This Website is a blog, or online diary, on issues relating to information security, open-source and free software, software internationalisation (making software support many spoken languages), software localisation (translation of software to other spoken languages), photography, traveling and more!

Switch to our mobile site