ABCDE - Alvin's Blog ...

Thursday, July 2, 2020

Using VLC to randomly play media files in some selected folders

Have you ever want to randomly play songs or MTV in some selected folders in Win7 ? For example, all the the mp3 or mp4 files are organized this way:

C:\MyAlbum\Artist1
C:\MyAlbum\Artist2
C:\MyAlbum\Artist3
C:\MyAlbum\Artist4
C:\MyAlbum\Artist5
C:\MyAlbum\Artist6
C:\MyAlbum\Artist7

I just want to play the media files for Artist1, Artist3 and Artist7 only. What can I do?

Here is the method.

First of all, using notepad or else to create a file named play_randomly_with_VLC.cmd with the following 2 lines:

@echo off

start "" "C:\Program Files\VideoLAN\VLC\vlc.exe" --random --zoom=1 --volume=256 %1 %2 %3 %4 %5 %6 %7 %8 %9

Put this file in any folder (e.g. C:\Bat)
Then go to the send-to folder using this method:

press Win+E to open an explorer window
press Alt+D to go to address bar
input shell:sendto
press ENTER

In the send-to folder, using drag-and-drop to create a shortcut to point to the play_randomly_with_VLC.cmd file in C:\Bat.
Now, everything is done!
Here is how to call VLC to play the media files for Artist1, 3 and 7:

Go to the folder C:\MyAlbum
Select the folders Artist1, Artist3 and Artist7 using the Ctrl key and the mouse left-button
Release the Ctrl key and Right-click the mouse button
In the pop-up menu, select Send to
Wait for another pop-up menu and select the shortcut for play_randomly_with_VLC.cmd

Then, VLC will be called to randomly play all mp3 or mp4 files inside the folders Artist1, Artist3 and Artist7.

This method can at most select 9 folders
Alvin SIU
2020-07-02

Copyright/Licence Information:
All information and coding in this article is offered at no charge for NON-COMMERCIAL PERSONAL USE only.
This blog and the coding is copyright.
Reproduction of this blog and its coding in whole or in part in paper or digitally or in any other forms without the explicit written permission of the author is strictly prohibited.

Disclaimer:
All information in this article is distributed "as is" and is UNSUPPORTED.
NO WARRANTY of any kind is expressed or implied.
You use AT YOUR OWN RISK.
The author will not be liable for any data loss, damages, and loss of profits or any other kind of tangible or intangible loss while using or misusing wholly or partly of the information.

Use VLC to randomly play ALL media files inside a folder

Have you ever wonder to put all the media files (e.g. mp3 songs or MTV in mp4 format) in a folder as an album and then let VLC to play them one by one randomly?

Under Win7, here is the simple way.

Assuming that VLC is installed in the folder "C:\Program Files\VideoLAN\VLC", then:

Put all your favourite mp3 or mp4 files inside a folder named, for example, C:\MySongs
In your Win7 desktop, create a short cut ...
In the location:

"C:\Program Files\VideoLAN\VLC\vlc.exe" --random --zoom=1 --volume=256 "C:\MySongs"
Click the Next button
Then, input the following as the name of the shortcut:

VLC Play Randomly
Click the Finish button

It is all done!

Now, just double-click this shortcut will call-up VLC to randomly play all files inside this folder. You can even create sub-folders to organize your songs.

Alvin SIU
2020-07-02

Wednesday, June 17, 2020

The Hydra of Information Security

In previous blogs "The CIA of Information Security", "The CDE of Information Security" & "Information Security Enforcement and Criminalization", 10 pillars are introduced in information security. Here is a summary of all the pillars:

Area		Abbr.	Pillar	#
Information		C	Confidentiality	1
		I	data Integrity	2
		A	Availability	3
Client-Information Interaction (Data Access)	Definition	A	Authorization	4
		CID	information Classification / Identification / Dictionary	5
		A	Authentication	6
		RASTS	security Risk Assessment for the Services, Tools & Systems	7
	Enforcement	A	Auditability	8
	Criminalization	A	Accountability	9
	Criminalization	NR	Non-repudiation	10

Here is a brief description of the pillars:

#	Pillar	Brief Description
1.	Confidentiality	Only authorized client is allowed to access the information. Prevent un-authorized access.
2.	Data Integrity	Ensure the accuracy and completeness of the data.
3.	Availability	Guarantee that the information is accessible at any time to the authorized client.
4.	Authorization	Define a set of data access rules with 5W1H details: Who is the client/person? Whose device/host/system? What action to do? (e.g. read, update, print, sign, confirm, etc) Which category of data? Which piece of data (with a ID) in a predefined format or layout specified in the data dictionary? Where to do the data access? When to do so? How to do so? (e.g. in person or remotely, use which tool or service provider)
5.	CID	Classify the information into categories. Identify each piece of data with pre-defined formatting and layout specified in the data dictionary.
6.	Authentication	Prove the true identity (not a fake) of the person, device, host, system and location. Prove the real/true time of data access activity.
7.	RASTS	Perform security risk assessment for the services, hardware/software tools and systems which are used during the data access activities.
8.	Auditability	Able to let an auditor to examine all the data access activities to check for authorized/illegal activities.
9.	Accountability	Ensure that a person is accountable or responsible for the data access activities.
10.	Non-repudiation	Ensure that the accountable person cannot deny for his/her activities.

For easy to remember, I would like to call these 10 pillars as the Hydra of information security. Hydra is a multi-head (usually 9-head) serpentine water monster in Greek and Roman mythology. Although presently there are 10 pillars, maybe later additional pillar is needed in information security, just like the heads of Hydra.

Alvin SIU
2020-06-17

Information Security Enforcement and Criminalization

In the previous blog The CDE of Information Security, the pillars about the definition of the information access rules are introduced. In this blog, I will talk about illegal access, i.e. how to tackle the situation when some client breaks the rule.

First of all, how to do with the information security enforcement? We have to find out which client observes the authorization rules and which breaks the rules. This introduce another information security pillar: auditability. Auditability refers to the ability for an auditor to examine all the information access activity.

For auditability, audit log is one of the many important tools. Will the system log all the information access activities? Will it record the activities in a timely base? Does the logging complete? Will it record the time and location of access? Does the audit log itself secured? How to ensure the confidentiality and integrity of the audit log? Will the audit log be altered deliberately?

When we find out some seem-to-be illegal access in the audit log, who is the suspect? This introduce another information security pillar: accountability. Accountability ensure that there should be a person accountable or responsible for those activities. For example, when the audit log discloses some unauthorized access done by an account, who is the person accounted for this activities? When all the colleagues of a department share one account, we cannot identify who is/are the real suspect(s) for that illegal access activity. In countries/regions using common law, the suspect can enjoy benefit of doubt in this scenario. Therefore, the suspect is likely not to be sentenced.

Moreover, when the illegal access is performed by a device, host or a system, who should be accountable?

When CCTV records serve the auditability issue, can we identify the person in the CCTV video without doubt? If not, no one is accountable even though there is a video recording some illegal activity.

Auditability provides evidences of illegal access. Accountability provides a suspect. Everything seems to be ready for the criminalization of the suspect. In many countries/regions using common law, besides evidence, a witness is also required. However, in the cyber world, such a witness may NEVER exist. The suspect can afterward deny everything he/she did. In this case, we introduce another pillar of information security: non-repudiation. Non-repudiation is the assurance that someone cannot deny something.

Non-repudiation has a very close relationship with other pillars. For example, when the suspect denies doing an illegal access activity, the audit log can show that it is done by which account and the accountability can relate the account to the suspect. When the suspect claims that the information received is empty, the integrity measures can guarantee that information is not. When the suspect claim that the illegal activity is done by someone else, using 2-factor authentication, digital certificate with trusted third party (e.g. certificate authority) can address this authentication issue. In short, all these techniques can help in this non-repudiation area.

In short, we use the pillars Auditability, Accountability and Non-repudiation to provide enforcement and criminalization of data access.

So far, 10 pillars are introduced. A summary will be given in the next blog The Hydra of Information Security.

Alvin SIU
2020-06-17

Copyright/Licence Information:
All information and coding in this article is offered at no charge for NON-COMMERCIAL PERSONAL USE only.
This blog and the coding is copyright.
Reproduction of this blog and its coding in whole or in part in paper or digitally or in any other forms without the explicit written permission of the author is strictly prohibited.

Disclaimer:
All information in this article is distributed "as is" and is UNSUPPORTED.
NO WARRANTY of any kind is expressed or implied.
You use AT YOUR OWN RISK.
The author will not be liable for any data loss, damages, and loss of profits or any other kind of tangible or intangible loss while using or misusing wholly or partly of the information.

The CDE of Information Security

In the previous blog The CIA of Information Security, I have mentioned that the CIA triad is based heavily on the information point of view. When the information user, i.e. the client, is introduced into the world of information security, there should be some additional pillars.

Traditionally, the client-information interaction is known as 'data access control' or simply 'data access'. We will consider the data access Definition, Enforcement and Criminalization one by one. (The first letter of these 3 areas are C.D.E.)

First of all, we have to DEFINE the data access. We use the term Authorization to dictate this pillar of information security. Authorization is to specify a set of data access rules in very detail so as to allow/disallow a client to access to the information. How to specify the authority rules ? We use the traditional 5W1H method.

5W1H	Example
Who is the client ?	Who is he/she ? Whose device ? Whose host / system ?
What to do ?	grant / deny select / insert / update / delete / permanently delete read-only / write / alter / comment-only search / re-index upload / download / print / store / destroy sign / confirm
Which information ?	Which category of information : sensitive / critical / confidential / internal / public Which piece of information Which kind of formatting and layout is required for that information
Where to do so ?	in the office in the data centre at home in the entrance in a particular location with CCTV
When to do so ?	during office hour only 24 hour around the clock only in coming 24 hours only in next 8 hours only during a specific period of time
How to do so ?	in person alone in person together with his/her supervisor remotely using VPN or internet remotely using a private network through a mobile or particular device through a mobile app through a thick client application through a thin client browser through a pre-defined protocol through a third party service provider

As seen in the above table, such an authorization rule matrix nearly cover every aspect for a client to access the information.

Also seen in the above table, we need to do some more tasks on the information in order to setup the authorization rule matrix. First of all, we need to classify the information into categories. For many company, the classification is: Sensitive, Critical, Confidential, Internal and Public. Each company has to setup the classification according to the need and compliance to the local legal requirement. This is the traditional way to authorize access to various category of information.

However, with the introduction of IOT (Internet Of Thing), the information will be largely accessed by a system or device, instead of human being. In this case, simple information classification may not be enough. A more refined requirement may be needed. For example, it will be more easy to give each piece of information an unique identity. Then, the client system can clearly define to access which piece of information with the information identity. For another example, the barcode (identification) of a box of milk and the chocolate bar should not be the same, the intelligent refrigerator can then take the stock correctly. Furthermore, the information may need to be accessed with some pre-defined layout and formatting, e.g. how many digits and whether having leading zero. Therefore, there should be an document named information dictionary to denote all these concerns. So, these information Classification, information Identification and information Dictionary forms another pillar, the C.I.D.

Looking at the authorization rules, there is a very important pillar throughout the rules: authentication. Authentication is to prove that someone/something is true, not a fake.

For example, how to verify the login user is really that client specified in the authorization rule. Nowadays, we use 2-factor authentication or multi-factor authentication to do so. When the client is a host or a system, how to ensure the client system is not a fake? Today, maybe a digital certificate can do. However, could we trust the certificate? In 2017, Google announced to distrust Symantec CA Brand SSL certificates issued before 2016Jun01. In the near future, it is foreseeable that blockchain technology will help a lot in this topic.

In some circumstances the information itself may need to be authenticated. How to prevent getting a fake document? Accessing/getting a fake information or document is meaningless in the authorization. There are numerous criminal cases related to fake/fraudulent will documents already. The will documents related to Nina Wang is a well known story in Hong Kong. How to verify the document, file or software update are the official true copy issued by a company or authority? In this case, digital certificate or public/private key can help. Again, blockchain should be the next tool.

How to authenticate the location? Can we trust the GPS reported by our mobile application ? There are numerous fake-GPS applications in the mobile store. Also, many GPS application cannot determine the current height above the sea level. So, it is difficult to identify you are working in the 3rd floor or the 40th floor of that building by simply using GPS.

Could we authenticate the actual time of access? It is easy to modify the system clock in mobile and PC. Network time protocol and blockchain may help in this area, I think.

Also, we have to use many hardware/software tools to perform the data access. Will these tools introduce security risk? Sometimes we have to rely on third party service provider such as VPN or video conferencing. Sometimes we outsource our operation to third party service provider. Will these third party service provider introduce security risk? Recently the USA government has officially banned the use of the US-based Zoom app. To address this issue, there comes another pillar: the security Risk Assessment for the Services, Tools and Systems, abbreviated R.A.S.T.S.

So far, 4 pillars: Authorization, CID, Authentication and RASTS are introduced. They all related to the DEFINITION of data access. If everyone access the information according to the authorization rule, everything work fine. However, rules are made to be broken. What should be done for those illegal access? Please refer to the blog Information Security Enforcement and Criminalization.

Alvin SIU
2020-06-17

The CIA of Information Security

What is information security? When I took the CISSP examination in 2002, the definition is confidentiality, integrity and availability, which is also known as the CIA triad. When I took my master course later, there is another definition with 4 pillar stones (one of them is authentication). When I did internet search later, someone suggested an 8-pillar definition. Anyway, the information security triad is the most acceptable definition so far.

The first consideration of the triad is confidentiality. Confidentiality means only authorized person/party/process is allowed to access the information (no matter whether the information is 'confidential' or not). This is to prevent 'unauthorized access' to information. Put it simple, if you are allowed to access the data, you can access. If you are not allowed to do so, you are unable to access. If this scenario is observed, the confidentiality is said to be done.

The second pillar of the triad is data integrity. Data integrity ensure the accuracy and completeness of the data. To be precise, for example, when a person/party/process is authorized to access the data, the data must be presented in an intact state with nothing added, nothing loss and in the correct order. This is to prevent the data being modified or stolen in an unauthorized or undetected manner.

The final pillar of the triad is availability. Take for an example, if some authorized person is unable to access the information due to whatever reason, his/her authority is actually meaningless. He is effectively the same as an un-authorized person. So, this pillar is to guarantee that authorized person must be able to access the information at any time on his will.

Noted that this definitions just denote the concept, it does not specify how to do so. It does not specify what hardware, devices, software, tools, processes nor procedures to be applied to achieve the security requirements. For example, to achieve confidentiality, the information can be encrypted and only authorized person has the decryption key. Or, it can be locked inside a safe with the physical key held by authorized person. Both methods can guarantee confidentiality. In shorts, whatever methods/tools can be used to achieve the security requirements.

The first letters of Confidentiality, Integrity and Availability thus form the 'CIA' of information security. For years, many thinks that just 3 pillars, C.I.A., seems not enough. There should be some areas need to be addressed and taken into consideration.

As you can see, this CIA pillars are mainly from the INFORMATION point of views. These 3 pillars seems related to the 'state' of the information. The information should be kept in a 'confidential' state for presenting to authorized/unauthorized client. When given to that authorized client, the information should be in an 'integrity' state. At last, the information should always be in the 'available' state for the authorized client. In other words, these 3 pillars relate closely to the 'information', NOT so directly related to the CLIENT, the ultimate user of information security. The CIA pillars can only see the shadows of the clients in the definition. In the next blog The CDE of Information Security, I will introduce the consideration related to the client in the world of information security.

Alvin SIU
2020-06-17

Tuesday, April 23, 2013

Alvin's HISTFILE workaround

Here is the background of my story. In my site, there are 3 hosts (named host-A, host-B & host-C) running AIX 6.1. Each host allows a maximum of 2 telnet login sessions. So, I can at most login 6 telnet sessions. My $HOME directory is mounted in host-B. Using NFS, all the 3 hosts will share the same $HOME directory. Ideally I would expect each telnet session have its own command history, but this does not happen.

Once login, the korn shell will create a command history file .sh_history in the $HOME. Then the 6 telnet sessions will share the SAME command history file $HOME/.sh_history. This is really a nightmare.

To solve this problem, I tried to define the HISTFILE variable in the first line of my $HOME/.profile. This HISTFILE will define an unique filename for each of the 6 telnet sessions. So, each session will have different command history filenames. However, such a HISTFILE setup does not work.

Why the HISTFILE is not functioning? Sometimes even the HISTFILE is defined in the first line of the $HOME/.profile file, it is not functioning at all. Why? It is because of the /etc/profile file. When korn shell is your login shell, once login, the korn shell will firstly execute the system file /etc/profile before executing the $HOME/.profile file. Usually, some third party software (such as file transfer or database software) will modify this /etc/profile to instruct it to run some setup scripts of the software. Commonly those setup script will use some functions. Once there is function declaration in the script, the korn shell will record the function in the command history. Thus, the default command history file $HOME/.sh_history is used. Once the default $HOME/.sh_history file is used, the name of the command history file will not be changed by the HISTFILE variable.

Actually, the command [[ set -o nolog ]] can prevent the korn shell to record the function the command history file. Usually, the nolog option will not be set in the /etc/profile. You can modify the /etc/profile to add this nolog option. However, once the host is already in production, changing the system file /etc/profile requires numerous procedures and approvals. No one will take the risk to approve this kind of system file modifications. In other words, it is very difficult to make this change in a production host. As a result, those third party software setup script and its function in the /etc/profile will force the korn shell to use the command history file $HOME/.sh_history once you login.

To be more complicate, the AIX 6.1 seems cache the command history in the memory. Therefore, when issuing the command [[ fc -l ]], sometimes the result is the command history in the cache memory but sometimes it is a mix of commands from the 6 telnet sessions due to sharing same $HOME/.sh_history file.

The korn shell in AIX 6.1 has a built-in fc command. When issuing the command [[ fc -l ]] in an interactive korn shell, this built-in fc command seems rely on the cached command history.

However, when using [[ fc -l ]] inside a script (which is run under another process), the external /usr/bin/fc or /bin/fc commands may be used (because a process should not use the korn shell process built-in commands). For the external command /usr/bin/fc, it seems that it cannot access the cached command history of the login korn shell. So, it will reply on the default command history file $HOME/.sh_history or the HISTFILE environment variable. When the HISTFILE is defined and exported to the script, it will use it, even though this HISTFILE is not functioning in the login korn shell. This further complicates the situation.

Also, when issuing [[ fc -l & ]] or [[ nohup fc -l & ]] in an interactive korn shell, a separate process is run for the command. This separate process seems behave quite similar to the situation above.

In order to solve the above problems, what we need is an unique command history file for each of the 6 telnet session. But, how to do so ? Here is my solution. I named it as Alvin's HISTFILE workaround.

This workaround is to add the following line at the beginning of the $HOME/.profile file.

if tty -s
then
     export HISTFILE=~/.sh_history.e`/bin/date +"%s"`.`/bin/hostname`.pts`/bin/tty | /bin/awk -F'/' '{print $NF}'`.r$RANDOM

     if [ -e ~/.sh_history ]
     then
          /bin/ln ~/.sh_history $HISTFILE

          /bin/rm -f ~/.sh_history

          /bin/find ~ -type f -name '.sh_history.e*r*' -mtime +15 -exec /bin/rm {} \; &

     fi
fi

Here is a detail description of how this workaround achieve my purpose.

When I telnet login the first session, this workaround is executed

The first line [[ if tty -s ]] is to ensure that this is an interactive shell. In my site, there are scheduled jobs running using root-id to [[ su - ]] to my user-id to execute some programs on behave of me. This action will call my $HOME/.profile and then run some programs in "no terminal" mode. In AIX 6.1, such a "no terminal" situation will make the [[ pts ]] command to give error messages which will spoil the scheduled jobs and also the HISTFILE variable. Anyway, the primary purpose of the workaround is for interactive korn shell, so it is better to have such a [[ if tty -s ]] checking.

The next line is to define the HISTFILE variable. The variable will use the epoch time, the hostname, the pts number and a random number. So, for the 6 telnet login sessions, the HISTFILE will be unique.

Then, the [[ if ]] statement is to double confirm the $HOME/.sh_history is already exist. Such file should be created by the /etc/profile once login.

Then, we use hard-link to make the two files $HOME/.sh_history and the $HISTFILE sharing the same i-node. Now, the content of this i-node file is the command history of this interactive korn shell. This i-node has 2 links : the $HOME/.sh_history and the $HISTFILE files. Now, no matter whether the built-in fc command or the external /usr/bin/fc command is used, each command will refer to the same command history content in that i-node.

The next line is to remove the filename .sh_history in the $HOME directory. Such a file removal will not affect the interactive korn shell. The shell should already get the i-node number for command history processing throughout its life. The i-node will not physically clean-up because there is still a link (the $HISTFILE file) pointing to it. As a result, both the interactive korn shell and the external /usr/bin/fc commands will function as usual.

Now, I login the second telnet session. Since the file .sh_history is already removed from the $HOME directory, the /etc/profile will create a new .sh_history file (with a new i-node number, of course). Then, this second interactive korn shell will work on this new i-node number for command history. Also, a new HISTFILE is defined for this shell. The $HISTFILE filename is different from the first telnet session. So, this new i-node and new $HISTFILE is only for this second telnet shell. Therefore, I have a completely independent command history file in the second login shell.

This process is repeated for the third, fourth, fifth and sixth interactive login korn shell. There will be six $HISTFILE in the $HOME directory, each using a different i-node.

The final [[ find ]] command is to clean-up those $HISTFILE files older than 15 days. It is assumed that you exit the login korn shell at least 15 days after login. If you do not exit the shell after 15 days, a new login process will kill your $HISTFILE and your i-node will be clean-up. Then, un-expected behavior will be resulted. Normally, you should exit the shell as soon as you no longer need it.

Alvin SIU
2013-04-23