Maximilian Irro

ERMMA-Studie 2018 – Deutschland: Messung und Analyse der ERM-Reifegrade von deutschen Unternehmen

Sat, 15 Dec 2018 00:00:00 +0000

Walter S.A. Schwaiger, Michael Brandsträtter, Theresa Fröschl, Maximilian Irro : “ERMMA-Studie 2018 – Deutschland: Messung und Analyse der ERM-Reifegrade von deutschen Unternehmen”; Bericht für Funk Stiftung Hamburg; 2018

Paper: [pdf]
BibTeX: [bib]

Abstract

Unternehmensweites Risikomanagement (Enterprise Risk Management: ERM) ist ein komplexes und schwierig messbares Konstrukt. Die vorliegende Studie wurde von der Funk Stiftung gefördert und in Kooperation mit der Risk Management Association (RMA e.V.) konzipiert. Zur Messung (Assessment) des ERM-Reifegrads (ERM-Maturity level Assessment: ERMMA) wurde das ERMMA-Reifegradmodell nach facheinschlägigen ERM-Standards und ERM-Frameworks erstellt und mit Hilfe eines intelligenten Online-Fragebogens softwaremäßig implementiert. Mit dem ERMMA-Online-Tool werden die Reifegrade von deutschen Unternehmen gemessen und sodann statistisch ausgewertet. Das ERMMA-Tool ist so gestaltet, dass damit nicht nur die aktuellen Reifegrade, sondern auch deren zeitlichen Entwicklungen messbar sind.

Keywords: Enterprise Risk Management (ERM), Maturity Assessment (MA), ERMMA-Reifegradmodell, -Klassifikationsschema und -Scoring, 3-Lines Of De-fense-Modell (3LoD-Modell), COSO ERM-Framework, ISO-RM-Standard

@techreport{ErmmaStudie2018,
  author  = {Walter S.A. Schwaiger and 
             Michael Brandst{\"a}tter and 
             Theresa Fr{\"o}schl and 
             Maximilian Irro},
  title   = {{ERMMA-Studie 2018 - Deutschland: Messung und Analyse der ERM-Reifegrade von österreichischen Unternehmen}},
  institution = {E330 - Institut f{\"u}r Managementwissenschaften; Technische Universit{\"a}t Wien},
  year    = {2018},
  url     = {http://publik.tuwien.ac.at/files/publik_262862.pdf}
}

Hemin

Fri, 30 Nov 2018 00:00:00 +0000

WebApp: hemin.io
Source: github

Hemin is a podcast catalog & search engine infrastructure. It’s engine is written in Scala, uses MongoDB to store the podcast/episode/feed catalog, and indexes the data with Solr. The REST API relies on the Play framework for routing and JSON. The server is fully asynchronous, and makes heavy use of Akka actors and Scala Futures. The current web client is written in ~~Typescript and builds on the Angular framework~~ Elm.

⚠️ Early development status warning

The Hemin infrastructure is still in the early development phase and not yet ready for full productive use.

The system currently supports the following standards:

Syndication feeds in RSS 2.0 or Atom (RFC 4287) format
Metadata from Apple’s Podcasts Connect XML namespace (“iTunes tags”)
Chapter marks in Podlove Simple Chapter format

Support for the following standards is planned:

Paged Feeds (RFC 5005)
Adhere to JSON:API standards
Add feeds by importing OPML files

ERMMA-Studie 2017 - Österreich: Messung und Analyse der ERM-Reifegrade von österreichischen Unternehmen

Wed, 15 Nov 2017 00:00:00 +0000

W.S.A. Schwaiger, M. Irro, T. Fröschl, M. Brandstätter, D. Raffaele: “ERMMA-Studie 2017 - Österreich: Messung und Analyse der ERM-Reifegrade von österreichischen Unternehmen”; Bericht für Governance, Risk & Compliance ERFA; 2017

Paper: [pdf]
BibTeX: [bib]

Abstract

Unternehmensweites Risikomanagement (Enterprise Risk Management: ERM) ist ein komplexes und schwierig messbares Konstrukt. In der vorliegenden Studie, welche von der Funk Stiftung gefördert wurde, wird zur Messung (Assessment) des ERM-Reifegrads (ERM-Maturity level Assessment: ERMMA) das ERMMA-Reifegradmodell nach facheinschlägigen ERM-Standards und ERM-Frameworks konzipiert und mit Hilfe eines intelligenten Online-Fragebogens softwaremäßig implementiert. Mit dem ERMMA-Online-Fragebogen werden die Reifegrade von österreichischen Unternehmen gemessen und sodann statistisch ausgewertet. Der ERMMA-Fragebogen ist so konzipiert, dass damit nicht nur die aktuellen Reifegrade, sondern auch deren zeitlichen Entwicklungen messbar sind.

Keywords: Enterprise Risk Management (ERM), Maturity Assessment (MA), ERMMA-Reifegradmodell, -Klassifikationsschema und -Scoring, 3-Lines Of Defense-Modell (3LoD-Modell), COSO ERM-Framework, ISO-RM-Standard

@techreport{ErmmaStudie2017,
  author  = {Walter S.A. Schwaiger and 
             Maximilian Irro and 
             Theresa Fr{\"o}schl and 
             Michael Brandst{\"a}tter and 
             Davide Raffaele},
  title   = {ERMMA-Studie 2017 - {\"O}sterreich: Messung und Analyse der ERM-Reifegrade von {\"o}sterreichischen Unternehmen},
  institution = {E330 - Institut f{\"u}r Managementwissenschaften; Technische Universit{\"a}t Wien},
  year    = {2017},
  url     = {http://publik.tuwien.ac.at/files/publik_262862.pdf}
}

Flatten directory structure on *nix

Tue, 16 Feb 2016 00:00:00 +0000

Given this example directory structure:

rootDir/
├── dir1
│   ├── file1.markdown
│   └── file2.txt
├── dir2
│   └── file3.html
└── dir3
    ├── file4.mp3
    └── file5.c

it is quite easy to flatten rootDir, so that it contains all the files from the child directories dir1, dir2 and dir3 by moving them via a single command liner using find:

find rootDir/ -mindepth 2 -type f -exec mv -i '{}' rootDir/ ';'

The -i option for mv will prompt before overwriting a file when a file name collision occurs. There is an additional tweak for this, e.g. if every subdirectory contains a README.md file which should be ignored. The -type option of find can be:

-type f \( ! -iname "README.md" \)

So to flatten the directory structure, but leaving the *.txt files untouched is accomplished with:

find rootDir/ -mindepth 2 -type f \( ! -iname "*.txt" \) -exec mv -i '{}' rootDir/ ';'

To match all .txt files, but not README.txt:

-type f \( -iname "*.txt" ! -iname "README.txt" \)

The find command line program should be available on most unix-like operating systems, but they do not all support all options and can handle regex matching differently (so I read at least).

LNCS-markdown

Sun, 24 May 2015 00:00:00 +0000

[github]

This are TeX and HTML templates as well as a CSS to render LNCS styled papers to PDF and HTML written in Markdown.

Currently only one author is supported.

Format

The papers source markdown file has to have a front-matter with this layout:

---
title: "My Title"
subtitle: "My Subtitle"
author: Maximilian Irro
email: optional@email.com
institute: My optional Institute
university: My optional University
keywords: "Lorem, ipsum"
abstract: "Lorem ipsum"
bibliography: references.bib
csl: lncs.csl
output:
  html_document:
#    toc: true
#    toc_depth: 2
    number_sections: true
    template: lncs-template.html
    theme: null
    highlight: kate
    css: lncs.css
    self_contained: false
    md_extensions: +footnotes
  pdf_document:
    fig_caption: yes
    keep_tex: true
    template: lncs-template.tex
    md_extensions: +footnotes
---

For a full list of output options, see R Markdowns HTML document format and PDF document format.

I added toc, toc_depth and number_sections to the html_document options out of personal favour though this is not conform with the LNCS style. Feel free to remove these.

Usage

To generate the PDF:

R -q -e "rmarkdown::render('paper.markdown', 'pdf_document')"

To generate the HTML:

R -q -e "rmarkdown::render('paper.markdown', 'html_document')"

The Makefile provides the basic targets make pdf and make html.

Dependencies

Note: this are the installation instructions for OSX. For other platforms, use their package managers. The package names might differe there.

Fonts:

The fonts in fonts/ must be installed on your system.

Pandoc:

brew install pandoc

pandoc-citeproc:

brew install pandoc-citeproc

R Markdown:

$ brew install R
$ R
> install.packages('rmarkdown', dependencies = TRUE)

Citation

In the Markdown files front matter there has to be the attribute bibliography: references.bib set, where the specified .bib file contains the references of course.

Citing a reference from the .bib file in the markdown text is simply done via R markdowns citation syntax:

bla bla bla [@xiang2007robust; @wu2005efficiently].

Basically, citations go inside square brackets and are separated by semicolons. Each citation must have a key, composed of @ + the citation identifier from the database.

Paper name

The default paper name used is paper.markdown, which will produce paper.pdf and paper.html. If you want to use a different name, feel free to change the .markdown files name, but keep in mind to alter the PAPER variable in the Makefile if you are using the make build approach.

Note that there is a variable for the markdown file extension MDEXT as well, if you would rather use .md or one of the other 10 or so that are out there.

Web scraping problem with PHP

Mon, 20 Apr 2015 00:00:00 +0000

I am scraping a website in PHP via a cronjob quite frequently for about 2 years now and did not have a problem so far. Yesterday however, the mechanism broke, because the HTML code I scrapped with file_get_contents was now empty. The basic code is this:

<?php
$url = "http://..."; // some url

$context = stream_context_create(array('http'=>
    array(
        'timeout' => 10 // for reasons this shall be short
    )
));

$html = file_get_contents($url,false,$context);

if( $html == false ){
    // some error handling
}

if( empty($html) ){
    // some error handling
}

First the empty($html) did not match because the $html == false error handling went of. Looking into the documentation I noticed “This function may return Boolean FALSE, but may also return a non-Boolean value which evaluates to FALSE”. Classic mistake by me, for I used == and therefore the return value (which was empty) evaluated to FALSE. After changing to === the second error handling confirmed that HTML read really was an empty string. This is in fact quite odd, for opening the URL in a browser I did see the website.

Checking the site via an HTML validator I realized that the site suddenly lacked the <!DOCTYPE HTML SYSTEM> header. I honestly do not know why, but this was a problem for file_get_contents seems to refuse reading the HTML code if this fails to exist.

I did not find any useful workaround (or simply a related problem in fact) on Google, but in the end I did come up with one myself. Out of sheer desperation I tried to provide a User agent with my request:

<?php
$context = stream_context_create(array('http'=>
    array(
        'timeout' => 10,
        'header' => "User-Agent: Mozilla/5.0 (iPad; U;"
            . " CPU OS 3_2 like Mac OS X; en-us)"
            . " AppleWebKit/531.21.10 (KHTML, like Gecko)"
            . " Version/4.0.4 Mobile/7B334b"
            . " Safari/531.21.102011-10-16 20:23:10\r\n"
    )
));

$html = file_get_contents($url,false,$context);

and tada! I worked. Not immediately though, for most user agents still do not suffice. I had to fake being an iPad before the web server in question agreed to serve me something more than just emptiness. Why I do not know though…

Creating slides with LaTeX's Beamer package

Tue, 31 Mar 2015 00:00:00 +0000

I am quite fond of a special kind of lecture slides formats I see regularly at University. I always had the feeling that those were made using LaTeX and now that I have to do a presentation I though this might be a good chance to look into it.

I found out that this is the Beamer package with its default layout (easily spotted in the Beamer Theme Matrix)

The usage is quite simple:

\documentclass{beamer}
%\usetheme{umbc4}
\begin{document}

% ==========================
% Title page and information
% ==========================
\title[fancy topic] % (optional, only for long titles)
{my very fancy topic}
\subtitle{even more fancy than you think!}
\author[Irro] % (optional, for multiple authors)
{Maximilian Irro}
\institute[Some Institute] % (optional)

\date[\today] % (optional)
{Seminar aus Programmiersprachen, 2015S}
\subject{Computer Science}

\frame{\titlepage}

% =================
% Table of Contents
% =================
\begin{frame}
\frametitle{Table of Contents}
\tableofcontents[currentsection]
\end{frame}

% ======
% Slides
% ======

\begin{frame}
\frametitle{Overlaying declarations and graphics}

\begin{theorem}<1->
Every finite distributive lattice can be 
embedded in a boolean lattice.
\end{theorem}

\begin{proof}<3->
Use join-irreducible elements.
\end{proof}

% ===
% End
% ===

\end{frame}
\end{document}

Basically every slide is encapsulated in pair of \begin{frame} and \end{frame}. I use the default theme, colortheme and fonttheme. Those I like best. The rest is what you call visual noice to me.

Universal Turing Machine in Forth

Fri, 16 Jan 2015 00:00:00 +0000

I (co-)wrote a universal turing machine in Forth this semester for a course about stack-based languages. It is named Universal Forth Machine. The major feature is the compilation of the transition word at runtime based on a provided turing machine specification. This word performs the machines state transition in a loop. We developed our program for the Gforth interpreter. If used with other Forth interpreters there might be issues (we never tested).

The project is available on GitHub.

Name explanation

We call our program Universal Forth Machine (UFM), a wordplay between “Universal Turing Machine”, being written in Forth, and Forth being a stack machine.

Usage

ufm.forth /path/to/machine /path/to/tape

Machine specification format

We provide some example machines in machines/ and tapes to test them in tapes/. The basic file format looks like this:

start-state
state-term1 label
state1
sym-read sym-write next-state tape-ptr-move
sym-read sym-write next-state tape ptr-move
state-term2 otherlabel
state-term3 yetanotherlabel
state2
sym-read sym-write next-state tape-ptr-move
sym-read sym-write next-state tape ptr-move

The first line has to be the start-state. All following lines are state descriptions. A term-state (terminal state) is followbed by a label which is a string that will be the output of UFM if the machine terminates in this state. A line containing just a state token starts the definition of a regular state. All following lines until a new state or state-term line are the edge dedinitions for this state. An edge line has to consist of:

sym-read: the symbol read on the tape. If the machine is in the currently defined state, and this symbol is read, the machine will execute the following actions of this line. Think of it as the edge label when picturing the turing machine as a graph.
sym-write: the symbol to write onto the current tape position.
next-state: the next state the turing (state-)machine goes to.
tape-ptr-move: the direction the tape pointer (tape-ptr) moves. It can go one step to the left (-1) or right (1), or just stay (0) at its current position.

Note that all tokens except the label for terminal states support literals only! They will all be converted into numbers. So no strings allowed here.

Special stack feature

The state transition of the machine is done in a loop calling the transition word. This is a word that will be dynamically compiled at runtime just before it’s first execution. Therefore the code of transition is not hardcoded in the program file, but will be generated by a special compilation word [compile-transition] which is compile-only and immediate. It will compile Forth code into transition based on the input machine specification file. Have a look at the colon definition of transition in the source code, and at runtime using see transition

Structure of transition word

The code structure of transition (which will be compiled depending on the machine-file) looks like this for the machines/increment.machine:

: transition ( cur-state sym-read -- next-state flag )
  over 1 =
  IF     cr 4546001056 16 type 4545995737 9 type cr 2drop 0 EXIT
  THEN
  over 0 =
  IF     dup 1 =
    IF     2drop 1 tape-write 0 tape-ptr-move-right -1 EXIT
    THEN
    dup 0 =
    IF     2drop 1 tape-write 1 tape-ptr-move-stay -1 EXIT
    THEN
  THEN ; ok

The over <some-literal> = if sequences will check for the state the machine is currently occupying. The dup <some-literal> = if parts then check the current symbol on the tape. With this mechanism it is decided which action the machine will perform next.

Dynamic compilation of Forth words at runtime

Tue, 13 Jan 2015 00:00:00 +0000

One very powerful feature of stack-based programming is the compilation of words at runtime. This allows you to define the compiled state of a word dynamically.

To compile a word foo (the Forth community seems to have a fabel for foo and bar in examples) that will contain the even literals from 10 to 2 descending:

10 Value token

\ decrement the token value
: decr-token ( -- )
  token 1- to token
  ;

: compile-foo
  10 0 u+do
    token 2 mod 0= if \ if token is even
      \ compile token literal value into foo
      token postpone literal
    endif
    decr-token \ decrement token value
  loop
  ; compile-only immediate

Now, compile-foo is an ìmmediate word, meaning it will be executed when it is used in compile state, that is the colon definition (= what comes between : and ;) of a word. So when doing

: foo ( C: -- ; I: -- n1 n2 n3 n4 n5 )
  [ compile-foo ] ;

every word within compile-foo that is not preceded by postpone will be executed immediately. Checking correctness with see foo yields:

see foo
: foo  
  10 8 6 4 2 ; ok

Note that [ and ] will switch between compile state and interpret state. But this is in fact not even necessary:

: foo
  compile-foo ;

generated the same compiled content of foo which is easily checked with see foo.

For only the compile time behaviour of compile-foo is defined it is tagged compile-only. This will prevent any call of compile-foo in interprete state. It is not necessary to do this, yet useful, for the error message will clearly state that the call of compile-only is an error. Otherwise there would be whatever error which would be hard to find and debug in a larger program.

Executing more complicated control structures are possible as well as calling custom defined words. Every word preceded by postpone will be compiled into the word, everything else immediately executed. Note that in order to compile literals into a word it has to be followed by postpone literal as shown in compile-foo, even when it is the result of a word, a Constant or a Value.

Using the data stack in compile state

When compiling a word like this, all data is put onto the data stack while the Forth interpreter is in compile state. Therefore, all postponed words will leave a stack effect behind (compilation tokens and such - this basically is what postpone does: keep the following word from executing, but putting its compilation tokens on the data stack) which must not be tampered with. This is especially tricky when postponeing control structures like if (and therefore also endif) inside a loop. To ensure a consistent stack effect of loop control data throughout each loop iteration, the stack effect I produce manually has to be passed by each postponed word without modifying the stack-effect produced by postpone. Elsewise the endif will not match its if and a compile error will be the effect.

Problem is in general it is not clear what postpone will leave behind. Fortunately there is the return-stack which can be used in compile state (in fact it can only be used in compile state). It must only be guaranteed that the return-stack is empty when leaving compile state.

Additionally, there is this nice effect of a stack that it is a LIFO (last in first out) data structure. So when pushing (using >r) 5 values to the return-stack they will be on it in reversed order compared to when they were on the data stack. But when poping (using r>) them back onto the data stack, there will be the same stack effect as before the push operations.

Example:

: foo
  1 2 3 5 6
  >r >r >r >r >r
  ( )
  r> r> r> r> r>
  ( 1 2 3 4 5 )
  ;

Sweet.

Minecraft Overviewer on FreeBSD 10.1

Tue, 30 Dec 2014 00:00:00 +0000

The Minecraft Overviewer is a nice python tool that enables you to render google maps like maps for your minecraft server.

minecraft.disposia.org overviewer map

This is an example showing the map of my server minecraft.disposia.org.

Installation

You need a minecraft world that will be displayed, of course. A world is generated by your minecraft server (port games/minecraft-server) upon first start.

For image rendering it is easier if you have the minecraft client installed too:

# portmaster games/minecraft-client

Clone the Minecraft Overviewer repository:

# git clone git://github.com/overviewer/Minecraft-Overviewer.git

(Note: you need git for this. Install port devel/git if need be)

Make sure you have python2.7 installed (port lang/python27). Ensure that you are using it by adding:

PYTHON_VERSION=2.7

to the file /etc/make.conf.

The Minecraft Overviewer has some python dependencies:

# portmaster math/py-numpy
# portmaster graphics/py-imaging

Build the Overviewer:

# python2.7 setup.py build

You now have an overviewer.py script in you Minecraft-Overviewer directory.

Configuration

The basic usage is now:

python2.7 overviewer.py /path/to/world /path/to/output-dir

Additionally, the overviewer may also require a path to the texture files if it can not find them itself. This is why I recommended installing the minecraft-client as well. Providing the path is done via the config.py script. You can provide the path to the world data and the output directory in this config file as well, or dynamically load it from you OS environment (which will be shown further down).

Here is the config file I use to generate the maps: gist.github.com/mpgirro/abe487fbed85c8157c49

This config file uses some OS environment variables. Those are exported by a bash script automating the steps for the whole generation of the map.

Running and operations

#!/usr/bin/env bash

MINECRAFT_SERVER_WORLD=/usr/home/max/minecraft/world
MINECRAFT_OVERVIEWER_DIR=/usr/home/max/Minecraft-Overviewer
MINECRAFT_OVERVIEWER_OUTPUT_DIR=/websites/minecraft.disposia.org/http
MINECRAFT_OVERVIEWER_CONFIG_LOCAL=/usr/home/max/minecraft-overviewer-config.py
# view the config file at: https://gist.github.com/mpgirro/abe487fbed85c8157c49#file-minecraft-overviewer-config-py
MINECRAFT_OVERVIEWER_CONFIG_GIST=https://gist.githubusercontent.com/mpgirro/abe487fbed85c8157c49/raw/minecraft-overviewer-config.py
MINECRAFT_OVERVIEWER_TEXTURES=/usr/home/max/.minecraft/versions/1.8/1.8.jar

# Export the variables config.py needs
export MINECRAFT_SERVER_WORLD
export MINECRAFT_OVERVIEWER_DIR
export MINECRAFT_OVERVIEWER_OUTPUT_DIR
export MINECRAFT_OVERVIEWER_TEXTURES

# Download current version of the config file.
rm $MINECRAFT_OVERVIEWER_CONFIG_LOCAL
curl -fsSL $MINECRAFT_OVERVIEWER_CONFIG_GIST > $MINECRAFT_OVERVIEWER_CONFIG_LOCAL

# Render the World
cd $MINECRAFT_OVERVIEWER_DIR
python2.7 overviewer.py --config=$MINECRAFT_OVERVIEWER_CONFIG_LOCAL

# Generate the markers - looks similar to the rendering run, but --genpoi will only generate some JS
python2.7 overviewer.py --genpoi --config=$MINECRAFT_OVERVIEWER_CONFIG_LOCAL
cp $MINECRAFT_OVERVIEWER_DIR/overviewer_core/data/web_assets/icons/*
$MINECRAFT_OVERVIEWER_OUTPUT_DIR/icons/

Note that the points of interest (POI) are generated in a second step, looking very similar to the rendering. Yet the --genpoi option does not execute a rendering step, it only creates the JavaScript files for the POI options in the map.

Abstract of Bachelor Thesis

Thu, 26 Jun 2014 00:00:00 +0000

Maximilian Irro. Digital Audio-Watermarking für analoge Übertragungsstrecken. Bachelor Thesis. 2014

Paper: [pdf] [html] [ps]
Code: [github]
BibTeX: [bib]

Abstract

While digital audio watermarking is already a widespread practice, most research only concern copyright protection mechanisms. An aim on open information integration is hardly ever a focus of development goals. Yet there are use cases were additional information in audio signals would be of most value. Especially digital/analog (DA) conversion processes tend to lose all sorts of metadata, for them not being translated into acoustic signals. This is where watermarks may come to aid. Also they could be utilized to add additional information to radio and TV broadcast which would make them accessible not only to the receiving device.

This paper describes the implementations of an existing watermarking algorithm claiming to be capable of enduring DA conversions. Additionally a framework is proposed to utilize the algorithm in a developed communication protocol with synchronization-codes and error-correction mechanisms to provide a well defined, stable communication channel.

Zusammenfassung

Während digitales Audio-Watermarking einen an sich viel beachteten Bereich darstellt, beschränkt sich die Forschung dennoch hauptsächlich auf Anwendungsgebiete rund um Urheberrechtsschutz. Eine Ausrichtung auf offen eingebrachte Information ist kaum im Fokus der Entwicklung. Doch gibt es durchaus Anwendungsfälle in denen Zusatzinformationen in Audiosignalen einen erheblichen Mehrwert bedeuten können. Vor allem bei der Digital/Analog Wandlung gehen in der Regel sämtliche Metadaten eines Audiosignals verloren, da diese nicht in akustische Signale mit überführt werden. Hier können Watermarks Abhilfe schaffen. Auch könnten sie genutzt werden um in Radio- oder Fernsehübertragungen gezielt zusätzliche Informationen einzubauen, welche auch von anderen Geräten als dem ursprünglichen Empfangsgerät verarbeitet werden könnten.

Diese Arbeit beschäftigt sich mit der Implementierung einer vorhandenen Audio- Watermarking Methode welche für die DA- und AD-Wandlung geeignet sein soll. Weiters wurde für deren Verwendung ein Framework entwickelt, welches mittels eines eigens entwickelten Übertragungsprotokolls unter Verwendung von Synchronisations-Codes und Fehlerkorrekturverfahren einen definierten Übertragungskanal bereitstellt.

Keywords: audio, watermarking

@mastersthesis{Irro2014,
  document_type = {Bachelor Thesis},
  author        = {Maximilian Irro},
  title         = {Digital Audio-Watermarking für analoge Übertragungsstrecken},
  school        = {Interactive Media Systems Group, TU Wien},
  type          = {Bachelor Thesis},
  year          = {2014},
  month         = {June},
  keywords      = {audio, watermarking},
  timestamp     = {20140624},
  url           = {https://max.irro.at/pub/bakk/thesis.pdf}
}

Häkelschwein in the Wikipedia

Mon, 09 Jun 2014 00:00:00 +0000

For a university course I had to write a (prefereably german) new Wikipedia article that should not become a victim to the “unimportantness discussion” (the german Wikipedia is very prone to them) and be deleted in the aftermath. So I decided to wrote an article about the Häkelschwein which had none yet. It’s basically an internet phenomenon about a little pink crocheted pig.

Ode to Disposia

Sun, 28 Jul 2013 00:00:00 +0000

I found myself on a 4 hours train ride with a very sunny seat and no air conditioning today. Whilest I “enjoyed” the illusions comming with dehydration a poem came to mind, which - as far as I can remember - never happened before. At home I did some final adjustments and so here it is, my very first and quite likely only ever poem, explaining the term “Disposia”.

an island far, on ocean blue

lies far from me, and not to see

a land of old, still new although

left there to reign, left to obtain

a wondrous place, all to embrace

made out of waste, for your distaste

but not for mine, it is divine

though we apart, you're in my heart

and so it's lore, you are my more

conceived so lite, one faithful night

on one symposia, my own utopia

disposia

I’ve also made a nice looking stand-alone page.

Full disk encrypted ZFS with geli on FreeBSD

Sat, 23 Feb 2013 00:00:00 +0000

I built myself a NAS of my own design lately for my old one did not perform to the tasks I have in mind for those sorts of dedicated machines. Two of the many desires I wanted to tackle were the utilisation of a modern file system and properly encrypted disks. I had my eyes on FreeBSD and ZFS for quite a while and so I decided the time was right.

The problem was on how to achive the full disk encryption. ZFS does have this feature, but only as of Zpool version 30. FreeBSD 9.1 on the other hand only supports version 28 at this point. On my old maschine I used the Linux dm-crypt tool for encryption. Though I was now very happy with it, it did perform the task, so I looked into similar methods available on FreeBSD.

The FreeBSD Handbook (great resource as it always is) has a section on Encrypting Disk Partitions and points out a solution using geli. This does work nicely, but the example uses keyfiles - something I did not want. Also, one has to know the device name (or number, like da2) of each disk.

Every disk of mine has a name trivial name. I tend to mount them into a folder with this name, and I would like it if I could reference the device with this name too, so there will not be some name mixup in case the device number changes due to a changing disk setup. There is a tool called glabel that does exactly perform to the task. It assigns a labelname to a device, making it available under /dev/label/$labelname.

Disk setup

Well now, lets go through the steps needed to get an encrypted ZFS disk:

First of all, we destroy any previous partitioning on the disk. This will wipe the device clean, therefore only proceed when you are absolutely certain!

dd if=/dev/zero of=/dev/$device bs=512 count=1

Now we create a new partitioning layout using the GPT (GUID Partition Table).

gpart create -s GPT $device

Next, we assign the label to the device.

glabel label -v $labelname /dev/$device

Until now you had to know the $device of the disk. From now on, we will only reference it via the $labelname we just assigned.

geli init -s 4096 -e AES-XTS -J - /dev/label/$labelname

And this is where it gets interesting. We just used geli to initialise a password protected GEOM container on the device. The -j option will make geli prompt the password from the command line.

From now on, the device /dev/label/$labelname holds encrypted data. In order to get a decrypted device we need to attach it.

geli attach -d -j - /dev/label/$labelname

As in the previous step -j will make geli prompt the password from the command line. The result of this step is a new device called /dev/label/$labelname.eli. This one is decrypted and we can use it as any ordinary device. At this point it is still empty though, lacking even a file system. So lets give it one.

zpool create -m /$mountpoint/$labelname $labelname \
    /dev/label/$labelname.eli

This will create a Zpool on the disk with the poolname equal to the $labelname we gave the disk. Additionally, it will set the mountpoint. This can be anywhere within your file system. I have it in a special folder within the file system root called /frachtraum (German for cargo bay), but you may choose any name and place.

And finally we do some tweaks.

zfs set compression=lz4 $labelname

UPDATE: As of FreeBSD 10 the lz4 compression algorithm is supported, and it is quite a good choice. Previously I used lzjb which was fine too.

And of course, we do need permissions.

chmod -R 775 /$mountpoint/$labelname

And that’s it! There is our new full disk encrypted ZFS drive. The reason why I use bash variables like $device, $labelname and $mountpoint in all the steps is because I do not tend to do this by hand, but within a script of course. One does not want to make a tiny error and screw up the setup, you know. All the variables are therefore provided as command line arguments.

Mounting procedure

Most likely one has more than one disk these days and running a decryption and mounting procedure by hand after every restart (a home NAS does not run 24/7 in general) tends to be quite dull, so some automation is in order. Basically, the only thing you need is a list of you labelnames stored somewhere in you file system. This - in opposition to an encryption keyfile - does not pose as a security risk.

echo -n "enter password: ";
stty -echo
read password
stty echo

LABELLIST=( $( < labellist.txt ) )
for labelname in "${LABELLIST[@]}" ; do
    echo $password | geli attach -d -j - /dev/label/$labelname
    if [ $? -eq 0 ]
    then
        zfs mount $labelname
    fi
done

This is the very short version of my mounting script. I do have much more error handling and output eye candy involved, but this makes it a bit confusing to read. Basically it prompts for the password and attaches the crypted device the same way used in the setup procedure. On success, it only performes a zfs mount. We told ZFS where the Zpool should be mounted during setup, so no need to do it again.

Some final notes

As you will have already noticed at this point, every disk gets its own Zpool, every Zpool containing exactly one ZFS. A lot of the great features of ZFS like mirroring or RaidZ are not used, therefore there is no redundancy involved in this setup. Many of you may not want this (and I myself am not entirely happy with it either)
Also, you will find that there are two ways for glabel to write the label: automatic and manual. On the first glance automatic seems like a good idea. But if you read the man page carefully, you will find that this method stores the label name in the last sector of the GEOM provider (that is the disk). This sector is later overwritten by the geli encryption process - and therefore the label destroyed!
If you do use a disk as an automatic backup target (lets say for OSXs time machine), I found it effective to use a stronger compression algorithm. ZFS also supports the gzip algorithm family from compression level 1 to 9, the later being the maximum. The results are quite effektive, though initial backups may take a little while longer. Yet it is not a good idea on disks storing a lot of already compressed data (like multimedia files). gzip tries to compress it nevertheless, but fails of course, not without having spent a lot of time in the process, making write performance quite bad. lz4 on the other hand is quite quick in realising a lost cause and will not effekt performance noticeably.
The encryption key used for disk encryption is 4096 bits. At the time I wrote this script it was a good practice and there was no indication to worry. Yet this was before the Snowden leaks in Mid 2013 of course. And it seems that to Mid 2014 this still is a save keylength to stick to.

Follow Zero - xkcd inspired art

Sat, 11 Feb 2012 00:00:00 +0000

Recently while watching Code Geass R2 I got an idea for what would make a funny xkcd comic. So I tried myself in drawing the “complex” character design thats makes one of the secrets to the unique charm of xkcd. And I think I might made it.

Follow Zero

The picture is under a Creative Commons Attribution-NonCommercial 3.0 License.

If you are not familiar with Code Geass, I recommend you to watch the series. It may be the best Anime I have ever seen (and I have seen a lot), and it contains something for everybody. Promised.