PCManFM Patch – Confirm Delete

• By Brad Conte, May 17, 2008
• Post Categories: My Projects
Update 6-30-08 (PCManFM v4.5):
As of v4.5, PCManFM started to add an integrated feature to disable delete confirmation, fullfilling the goal of this patch. (The upcoming official feature appears to disable confirmation when a trash can is used.) This new feature does not yet fully work but the code is similar to the patch. Since the author has not seen fit to activate the feature and is clearly working on it, I do no anticipate releasing patches to work with any version beyond v4.3.

About
The patched preferences menu This patch adds the option to enable/disable delete confirmation in PCManFM, a popular, light-weight, tabbed file browser. Default behavior in PCManFM is to always prompt the user for confirmation when deleting a file (the classic “Are you sure?” prompt), a feature some find inconvenient. This patch adds an option to the Preferences menu that allows the user to select whether or not they wish to be prompted on deletion.

To the right is what the Preferences menu looks like after the patch. (The dark colors are due to my GTK theme, they have nothing to do with the patch.)


Download
Patch version: v2 (June 26, 2008)
Last tested against: PCManFM v0.4.3
Download

Applying the Patch
Applying the patch is simple. First download and extract the PCManFM code. Then apply the patch to the source. Either:

…from the parent directory with:
$ ls pcman-0.4.1.1 confirm_delete.patch $ patch -p0 < confirm_delete.patch
…or from the actual source directory with
$ ls AUTHORS config.guess libtool COPYING config.h ltmain.sh ChangeLog config.h.in missing INSTALL config.log mkinstalldirs Makefile config.status pcmanfm.desktop Makefile.am config.sub pcmanfm.desktop.in Makefile.in configure pcmanfm.png NEWS configure.in please_read_README_carefully_before_packaging README confirm_delete.patch po TODO data src aclocal.m4 depcomp stamp-h1 autogen.sh install-sh $ patch -p1 < confirm_delete.patch
You can then compile PCManFM with the standard:
$ ./configure $ make $ make install

Technical Notes
Patching was pretty minimal, save for one file: pcmanfm-{$version}/data/ui/prefdlg.glade . In the original source, practically the entire XML UI design file is devoid of whitespace, including newlines (for optimization), which makes a nimble patch for it impossible, thus this entire file must be redistributed. This file holds the entire visual layout for the Preferences menu, thus the patched prefdlg.glade file will have to be updated whenever the official PCManFM package updates the Preferences menu layout (something unlikely to happen).

Aside from that issue, since the editing was very simple and inline with the basic structure of the program itself, I see no reason why it shouldn’t work for on many PCManFM releases to come. (If things change, I’ll update the patch, though.)

Automatic Installation
Some OSs lend themselves to compiling from source very easily. If you use such an OS (Arch Linux, Gentoo, FreeBSD, etc) you may wish to write a script to apply the patch and rebuild the package. For Arch Linux, move the patch to your /var/abs/local/pcmanfm directory and add the patch to the PKGBUILD via:
$ cd /var/abs/local/pcmanfm $ sed -i “s_cd\ \$startdir/src/pcmanfm-\$pkgver_cd\ \$startdir/src/pcmanfm\ -\$pkgver\npatch\ -p1<../../confirm\_delete.patch_g" PKGBUILD
I’m unfamiliar with Gentoo’s ebuild format, but I’m sure that modifying an ebuild would be similar.

My Sweatshirt

• By Brad Conte, February 26, 2008
• Post Categories: Miscellaneous
In just four days of wearing my new favorite sweatshirt on campus for the first time I got four separate complements on it. Three people asked me where they could buy it. Since then I’ve received dozens of compliments, mostly from strangers who, although they don’t know me, know an elegant math expression when they see it.

Unfortunately, this sweatshirt is not explicitly for sale anywhere. I had it custom made because I couldn’t find anything like it.

My Euler's Identity Sweatshirt


Summary, for those interested in getting a similar one
I love my sweatshirt, I’d sell it on a store like CafePress if I could find one that has black sweatshirts. Since I can’t, the next best thing is to provide the instructions to get one.

The image: You can get the image I used for the screen-printing here. However, the company I used for the screen-printing required you to upload an inverted version of the image (at least as of the last time I used their services), which you can download here. If one doesn’t work try the other.

The company: The company I used to screen-print the image is Blue Cotton. I chose the Hanes Pullover sweatshirt (Printing -> Sweats -> Hooded Sweatshirt -> F170 Hanes Pullover Hood), but they do offer other sweatshirts. The Hanes sweatshirt has the advantage of having the lowest polyester content (90% cotton) of any of their sweatshirts, which is a good thing for a screen print and has the side benefit of being very comfortable.

The image sizing: For my sweatshirt, an extra-large, I chose to make the image 9.5 inches wide (be sure you lock the width/height ratio when scaling the image on the sweatshirt) and centered it 2 inches below the collar (you’ll have to eyeball this measurement). It took a long time for me to decide on those dimensions, but I finally did and I think they’re perfect, which is saying something. You might want to scale the width for sweatshirts of different sizes, my rough guess would be to subtract/add .75 to 1 inches per size smaller/larger.

So all you have to do is go to the website, select your sweatshirt, upload the image, set the width/placement, and order it.

The background of the sweatshirt
I’m a math major, and I like elegance. Euler’s Identity is my favorite mathematical expression: it’s a simple expression of universal truth via constants. It’s fascinating how the five most fundamental constants of math are all uniteable in a single, simple expression.

In addition to math, I like t-shirts. I tend to treat t-shirts as billboards for things that I like — you won’t find a blank shirt in my drawer. As need had it, in winter of ’07/’08 I found myself in need of a new sweatshirt. Like the rest of my upper-body apparel, I wanted it to say something interesting. I wanted the sweatshirt to be “nice-ish” so that I could wear it to “nice-ish” events, so I didn’t want a busy/complicated design. it had to be simple, yet elegant. Settling on a simple expression of Euler’s Identity was easy. My second stipulation was that the sweatshirt had to be black.

I started my search at the obvious place for a weird request like that: CafePress. I found a couple of sweatshirts with Euler’s Identity, but a) They had obnoxious brand logos, and b) Cafepress doesn’t sell black sweatshirts. After an extensive search of the Internet, it became obvious that no one offered anything like what I was looking for (shocking, considering the obvious demand). So I decided to have the shirt custom screen-printed.

The design of the sweatshirt
Thus I was faced with two tasks. The first task was creating the image I wanted to be screened onto the sweatshirt. The second task was finding someone to screen-print the image. Neither task turned out to be as simple as it might seem.

Creating the image was difficult because the only decoration for the black sweatshirt was going to be the bold, white text of Euler’s Identity. Thus the styling of the text was very important. In order to truly do the equation justice, and make the sweatshirt look as simply elegant as possible, the font had to be perfect. Not fancy, but not boring. Just slightly elegant.

Getting the image screen-printed turned out to be difficult because there were two major conditions for the screen-printing: I had to be able to have a transparent background, and I was not going to order in bulk. Most custom screening companies violated the former of these two requirements, and the few that allowed background colors required bulk orders. In addition, some companies didn’t offer sweatshirts in black.

The final solution
Finally, however, a solution was reached. I designed the image using the “i” and “pi” symbols generated by a Linux-based LaTeX front-end called eqe. I generated the rest of the equation using characters from the Tahoma font in the Linux-based image editor KolourPaint. I needed a very large size image to achieve a sufficient DPI, which was recommended to be at least 90. Both programs allowed me to create the images at a large size with excellent quality, but not a size quite large enough. So I used Gimp to expand the size and I used its anti-aliasing feature to keep the font’s smooth despite being enlarged. The result is shown here. (This is a scaled-down version of the image, for bandwidth reasons. Click the image to download the full-size image, the one you would use for actual screen-printing.)

Euler's Identity
View the inverted version.


I also found a company, called Blue Cotton that allows one to screen-print an image, choose a color to make transparent, and doesn’t require a bulk order. (Choose Printing -> Sweats -> Hooded Sweatshirt -> F170 Hanes Pullover Hood.) Thrilled to have a working image and a working company, all I had to do was manually place the image on the sweatshirt. I spent (no joke) probably 3 hours total moving the image around on the shirt, higher, lower, bigger, smaller, trying to get it just the right size and at just the right height. Finally I decided on a 9.5 inch width at 2 inches below the collar, which I am pleased to say is the perfect size/placement (for an XL).

Close-up picture of the screen-printed text on the sweatshirt.


Also, kudos go out to my girlfriend for her extreme patience with me. The sweatshirt was a Christmas present from her to me. Being a nit-picky perfectionist, it was decided that I had actually best do the bulk of the designing. I didn’t even finish the design until the end of January. Giving it to me was an excellent idea, and it’s one of my all-time favorite articles of clothing.

GDM Login Theme: Blue Fractal

• By Brad Conte, December 14, 2007
• Post Categories: My Projects
Ever one to customize that which I use, I’ve take the time to design my own GDM Login Theme for the Gnome desktop manager for the X Window system.

My inspiration to create the theme actually started with the background image. I’m not graphics artist and I never create my own artwork beyond the simplest of images, but I know when I see an image I like. The background I used for this theme is a blue-colored fractal from Beautiful Fractals. The moment I saw the image, the center circle practically demanded that someone insert a user name prompt in it. So I did.

The theme only comes with a background resolution of 1280×1024. It scales nicely to fit other resolutions so I didn’t care to create separate themes for different resolutions. The original wallpaper, however, comes in many resolution sizes so it’s easy to modify it if you care to.

E-mail me with any bugs and/or problems. No graphics requests, please, I can’t fulfill them. (And yes, the wallpaper itself is asymmetrically shifted by a couple pixels to the left.)

This GDM theme is available Gnome Look

Cryptography Links

• By Brad Conte, October 27, 2007
• Post Categories: Security
This is a list of resources on cryptography knowledge that I’ve compiled. The goal of this list is to cover the fundamental spectrum of cryptography and to touch on the higher mathematical end.

Index of Links
















  • TrueCrypt — Symetric key, disk/virtual disk encryption.
  • GPG — Public key, multiple encryption options.
  • PGP — Public key, multiple encryption options.
  • AxCrypt — Symmetric key, individual file encryption.
  • DriveCrypt — Symmetric key, whole disk encryption.
  • dsCrypt — Symmetric key, individual file encryption (stand-alone EXE).
  • Snake Oil Encryption Software — This isn’t an encryption program, but it’s a good article on how to evaluate encryption software.


  • Crypto++ — A C++ library under a custom, permissive license.
  • PolarSSL — A C library under the GNU GPL license.
  • OpenSSL — A C++ library under an Apache-style license.
  • Brian Gladman — C source code for AES, SHA, and HMAC.







Update: November 15, 2009 – Removed stale links, added more links, reorganized some existing links.
Posted: October 27, 2007

My Notepad Info

• By Brad Conte, August 28, 2007
• Post Categories: My Projects
My project “My Notepad Info” is an online notepad service and has a dedicated website: MyNotepad.Info. (Also accessible via MyNotepad.org.)

My Notepad Info is a free, online application for storing and retrieving notes. The goal of My Notepad Info is to provide users with an web-based convenient, keyboard-oriented notepad that can be smoothly be entered and exited to store and retrieve notes. Instead of e-mailing oneself notes or URLs to bookmark or read later, you can just save them in your notepad and retrieve them from another computer.

I designed My Notepad Info because I was annoyed with having to e-mail myself links/notes and many other online notepads I found fell short of what I wanted. More information is on the project’s website.

Becoming a “Hacker”

• By Brad Conte, August 24, 2007
• Post Categories: Security
Introduction
That word “hacker” carries with it a lot of baggage. The word intrigues teenagers, scares politicians, and causes computer geeks endless debates as to its exact definition.

Computers have created an deep, complex, intertwined world that few people are truly familiar with. A world in which most of its users can’t even begin to comprehend the complexity or functionality of it. Even people who would be labeled as relatively computer literate, in all likelihood, don’t really know much about how their computer works. Average Joe hasn’t really a clue what his computer actually does or how it actually works beyond the point-and-click GUI he sees. And that’s fine, because thousands of man-hours have gone into the design of everything computers do and it’s unreasonable to expect Average Joe to understand a large portion of it.

But hackers make a point of knowing what happens inside a computer. What’s more, they try to manipulate what happens. The combination of their knowledge and skill sets scares a lot of people (and excites others). Hackers have a knowledge base that many others do not. And they have a skill set that many others do not.

Odds are you’re reading this because the concept of “hacking” interests you and you want to learn more about it. If you are an aspiring “hacker” (we’ll see if you truly are in a bit), this if for you. For others, this will give an introspective into the mind of the hacker. I assume that the “aspiring hacker” is somewhat familiar with computers but hasn’t really touched on hacking and computer security in any depth. My goal here is to provide a first introduction to what you’ll need to do to pursue “hacking”. The most daunting part of any task is usually just finding a place to start, and giving you that start is my goal.

However, my goal is not to teach you how to hack; it is just to tell you were to start. First I’m going to explain what the concept of hacking entails, so that you know what you’re getting into. Next I’m going to lay forth the learning mentality and efforts you’re going to need to expend, namely, what you’re going to need to do to become a hacker. Third, I’m going to show you what your goal should be, namely, what it is you should eventually arrive at. Last, I’m going to give you a starting point so that you can go off and actually begin your studies, because that’s what you probably want anyway.

I’m going to spend a lot more time elaborating on this topic than need be. A lot of good advice for the aspiring hacker could be condensed in just a couple sentences. But all of that has been said and done before, it’s my goal to give the exhaustive explanation that covers every relevant conceptual topic. And since every hacker, more or less, follows a similar path of development, this can also give the non-hacker an insight into the mind of a hacker.

Remember, this is only an article about where and how to start learning, it’s not my goal to actually give you your first Hacking 101 lesson.

What You’re Getting Into
Hacking requires a lot of knowledge and understanding. If you just want to find one computer program you can download so that you can click a couple buttons and impress your friends by breaking some stupid thing on their computer then you aren’t aspiring to be a hacker, you’re aspiring to be a script kiddie. And script kiddies are to hackers what construction workers are to structural engineers. Script kiddies are out to, usually, amuse themselves. They act without purpose and rarely have any ethic standards.

First you’ll need to understand what it is that hackers do. In the beginning, rules to govern the everyday aspects of computing were created. These rules are for networking, web design, programming, graphics design, etc. They govern everything that computers do and dictate how they do it. Most developers live by these rules.

Hackers, however, have what might be likened to a second layer of rules, a layer of rules built on the first layer. At the risk of using a cheesy analogy, the normal rules of computer are can be described by the line from The Matrix where Morphius tells Neo (in the sparring chamber): “Like any rules, they can be bent, others can be broken.” That’s fairly true of computing. The normal rules of computing can be manipulated, others can be completely bypassed. The realm of hacking lies on the second layer of rules, rules that are based on the first layer and can manipulate the functionality of the first layer.

Note the lack of the phrase “breaking into computers” in my definition of “hacking”. Hacking is about learning, changing, and manipulating. Whether you use those skills to break into someone else’s computer is a separate, unrelated issue. The mainstream media uses the buzzword “hacker” too narrowly, the roots of the term are far more broad than what modern mainstream usage implies.

For example, take the ARP networking protocol. It doesn’t matter if you know what ARP is or how it works, suffice it to say that it’s a networking protocol. ARP is a “first level” set of rules that govern how computers communicate on a network. Every network administrator must be familiar with how it works. However, a hacker knows how ARP works and knows how to use those rules to perform a different task than the goal of the original rules. Using the ARP protocol is standard computer networking. Manipulating ARP to do something you want it to is hacking. ARP is a normal rule, but it is a rule you can build from and it is a rule you can manipulate.

Thus in computer security/hacking it should be obvious that it pays to know the normal rules. Everything hackers do is based on the normal rules and unless you understand those normal rules you won’t be a decent hacker. You’re going to have to study how things work, why they work, learn how they work successfully under normal conditions, learn how they fail under abnormal conditions, and then figure out how to use them abnormally and make them achieve different goals.

So to begin your hacking career you’re going to have to do a lot of reading and a lot of question asking. If you already assumed this then you’re in the right frame of mind. If you thought you just needed to find those one or two magic programs that would let you crash Windows boxes by the second day, rethink your plans.

How to Learn
In brief, you’re going to need to read. A lot. Everyone’s learning style is different and there are a lot of perfectly valid learning methods, but all of them will include a lot of reading.

Let me offer this bit of advice: Do not start by reading RFCs or any other sort of extremely technical specification. (RFCs are technical papers describing many common computing standards.) Some people will give you that advice and, frankly, I don’t think it helps very much when you’re very new to hacking. Instead, start by reading articles/essays/tutorials that are more than a listing of facts and specifications. Read what one person has to say on a topic, then go read technical documentation if you want to know very specific details about it. RFC’s and other technical documentation can be complex, and sometimes downright unhelpful to a beginner.

To start your reading, get a browser that has tabs and makes both searching the Internet and searching a displayed web page easy (such as Firefox). Then find an online article about some security topic that interests you and seems roughly at your level of understanding.

There are two things I would like to emphasize from just that last sentence. First, I would like to stress that you find something roughly on your level. You will kill your ambition if you try to understand and dissect concepts too far over your head. Some stuff is very complicated, don’t discourage yourself by trying to take it on before you’re ready. You’ll get frustrated trying to bench press a 500lb weight on your third day at the gym, it may be out of your league at the moment and just isn’t worth your time trying to lift. This isn’t to say you should forget about any complex topic you come across, you should just make a note to come back to that topic later when you know more and can assimilate information on that complex topic better. Go spend some serious time researching and learning what you need to in order to understand that topic and come back to it when you’re ready. If it takes a day before you’re ready, great. If it takes a month, that’s fine too. The important thing is that you’re learning. You don’t get any sort of points for reading the articles you originally decided to, you get points for what you learn.

My second point may seem a bit obvious but I do encourage that you start your research online, as opposed to going out and buying a hacker book or magazine. The newer you are to hacking the less you’ll know, and the less you know the more likely you are to find heaps of material about what you’re looking for online for free anyway, so it may not be worth buying hard copy material. Plus the less you know the more you’ll need to look up as you read. It’s easier to look stuff up on the fly if you’re on the Internet. Every new golfer likes to go out and buy their first new set of clubs, but that mentality doesn’t work as well here. You will likely not need to spend a dime for anything (other than a computer and/or basic accessories) for a long time. Most stuff is available, in some form, for free.

Anyway, find an article on something that looks like material you want to learn. Read it and make note of all the words or terms you don’t recognize. As you find them, highlight them, right-click them with your mouse, and search Google for them (one of the nice features of Firefox). All of them. If you have to open 20 new tabs from one article then that’s fine, remember, you only get points for what you learn, not for whether you finish the initial article you started to read. Sometimes you’ll come across a tutorial, paper, or audio lecture that does nothing but provide you with a long list of topics to go research. You may not be able to make much sense of it for months, but that’s OK.

Read on all of those topics you just searched Google for. You don’t have to read just one article per topic, if the article you read seemed short and didn’t satisfy your curiosity then read another article to make sure you’re not missing anything important. If those articles themselves have terms you don’t know, look those up too. Make it a habit to instinctively always look up terms or concepts you don’t know. The number of open tabs you have can balloon quickly but that’s OK, you’re out to learn.

A word of sympathy to those who find themselves with dozens of open tabs and dozens of topics that need to be researched: It can get very big very fast and you will sometimes have to call it quits on a topic. Don’t be a wimp, though, call it quits only when you’ve truly hit a wall or are getting into a subject that truly bores you. Even if you don’t learn the details about a subject, just learn the vague idea behind it. For example, even if you don’t fully understand how ARP poisoning works and how to do it yourself, understand what it allows you to do that way you know what it means the next time you hear the term. You can learn how to perform an ARP poison attack some other time, and when you do learn it will be easier if you already understand what it is (ARP poisoning is actually very simple, I’m just using it as an example). Be flexible with what you learn in depth and what you just learn the concept behind. If something frustrates or bores you, move on to something else — there’s plenty of interesting topics to study. If everything bores you, you might not be cut out for it after all.

Which topics should you be pursuing more than others? This is up to you. There are dozens of topics you can research and you’ll have to determine for yourself which ones you spend the bulk of your time pursuing. Almost everyone will recommend that you have at least minimal well-rounded knowledge in most fields but that you find some topic that specifically interests you and you pursue it.

As you read more and more articles, you should come across fewer and fewer terms you don’t understand. You will always run across unfamiliar terms — no one knows everything — but the quantity of those terms should diminish with time. Even if you don’t necessarily remember every acronym you read (there are a lot of them) a quick Google search for one you’ve forgotten and a quick glance down the results page should spark the “Duh, now I remember that,” light bulb.

Remember, never hesitate to use Google (or your search engine of choice), no matter what your question is about. If you’re new to hacking and seriously trying to learn it would not be unreasonable for you to be executing 15 Google queries an hour during any given period of research. (This wouldn’t be unreasonable for a veteran to do either if they’re delving into new territory.) Google isn’t a sign of weakness. And it’s free. Use it. Often.

There will be some questions you have that Google doesn’t answer, or doesn’t answer to your satisfaction. When this happens, ask someone who might know. The best way to do that is to post your question to a hacker / computer security forum.

At some point you’re going to need to start doing some actual hands-on work. All knowledge and no experience makes Jack a condescending pseudo-guru. If you want to be a hacker you’re going to have to actually do something sooner or later. Feel free to experiment on your own computers on your own network. Port scan your desktop various ways from your laptop, try an ARP attack against your laptop from your desktop, etc.

And remember, for the sake of all that is good in this world, don’t attack computers you don’t own. It’s tempting, but don’t do anything against other computers, you’d be surprised how easily people can get upset. And I’ve seen enough hackers far more competent than you will ever be who got into legal trouble to last me a life time. It seems tempting to try, but it’s not worth it.

The obvious question is, “When do I actually start doing hands-on work?” This is up to you. Some people prefer to research to their heart’s content before touching any tools, some prefer to experiment with tools as they learn everything. Do whatever helps you learn the most, but always research a concept at least a little bit before you try it out — I’m not a big fan of “try it then learn it”. Otherwise you won’t know what you’re doing, you might get confused, and you’ll waste your time. And, most importantly, if you’re really unlucky you’ll break something by accident. If you don’t know what your tools are doing and how they work when you use them, you’re a script kiddie.

When you do start doing hands-on work is when you might want to start reading technical manuals. I assumed that you started very new to hacking, but by the time you’re attempting to try things you should be able to read and understand RFCs and similar documentation on the subjects that you’re experimenting with. Because by then you’re more concerned with the more nitty-gritty details of how stuff works, and then the mumbo jumbo in RFCs and other technical documentation should make sense.

I would also advise that you focus more on technical understanding than on technical memorization. Its important to know how you can use ARP for a man-in-the-middle attack. Its much less important to be able to construct an ARP header frame from memory. If you ever need to do that, you can look it up. If you understand how something works, you can get the precise details when you need them.

Where You’re Headed
In your endeavors to learn about hacking, eventually you should hit a point where your tools stop dictating what you do and you start dictating what your tools should do. You should be continuously learning and feeling more in control of what you do, and eventually you should hit a point where you know that “I need a program that explicitly allows me to perform this specific function,” and you go to Google and type in a precise seven word query looking for such a program. It may not exist so you have to make hack together something using other tools. Or, better yet, you may find yourself writing the tool yourself.

In other words, eventually the construction worker is going to have to start buying tools that will build what he wants and stop building what his tools will allow him to. He needs to design a building that he likes, then he needs to go find tools that will allow him to do that.

Some people don’t understand this concept and live in an infinite loop of never doing anything that their four favorite tools can’t do. Don’t let this be you. Govern what your tools do, don’t let your tools govern what you do. This isn’t to say you can’t find some nice, multi-functional tools out there, but don’t just download a couple programs with pretty interfaces and stick with just those, you’ll hold yourself back.

Usually hackers will eventually learn at least one or two programming languages, so that they can write at least small programs themselves. I would advise you to learn at least some programming. Even if you don’t do much with it, learn at least one or two languages semi-fluently.

A Starting Point
Enough advice. You need to start doing something. Cool, so now you know that you need to read a lot, but on what? Where do you start? My first bit of advice involved finding those first articles of interest to read and branch out from, but how do you find those articles?

Start with the following concepts and vocabulary words. What I provide is a list to get you started researching computer security/hacking. Remember, don’t just read one article on each of these topics and call it quits, use these topics to start your Google research from. Read on these topics and everything related to them, then everything related to those topics, and related to those topics, and so on. This list is just to help you figure out what your first Google queries should be. The items on this list were not chosen to give you a comprehensive grasp of hacking but to rather give you a starting point in the most important fields. If you want to hack, you’re going to need to branch out into all the different fields from these starting points.
  • Man in the middle
  • SQL injections
  • Packet sniffing
  • ARP poisoning
  • Buffer overflows
  • SSH
  • Public and private key cryptography (RSA, AES, DES, Blowfish)
  • Cryptographic Hashes (MD5, SHA1, SHA2)
  • Proxies
  • DOS attacks
  • Reverse engineering
  • Worm / virus / trojan
  • Router / hub / switch
  • Networking OSI (TCP, IP, UDP, ICMP, ARP protocols)
  • Port scanning (stateful filters, half-open scans, open/closed/filtered ports)
Hackerthreads.org has “start here” thread with a collection of links to actual articles on topics such as these for newbies. If you’re looking for material to read on a topic, or material to read in general, you can start there.

When you want to start actually doing stuff, you’re going to need tools. The following are interesting/handy tools of the trade. Remember, don’t think that you have to stop learning when you start using tools. You can learn a lot from the tools you use. Visit a tool’s homepage and read on what it does. More importantly, if the tool offers a complex function/feature, read articles on how it does what it does. Most tools come with their own tutorials/manual on how to use them that explain what the tool does and provides some descriptive information about why what it does works. Read it.

  • wireshark
  • nmap
  • nessus
  • ettercap
  • nemesis
  • hping
  • dsniff
  • Cain & Abel
For a larger list of useful tools, see the list of tools included in Backtrack 2.0 (a Linux-based security-auditing oriented OS) and the tools included in Arudius (the parent OS of Backtrack).

Unfortunately, once you start using tools reality will kick in and you may have to decide which operating system you’re going to use. Before now I’ve said nothing specific to any specific operating system or software, but unfortunately not all tools work for all operating systems. Most of them can be run on both Linux and Windows, and a lot of Linux programs can be run on Windows with Cygwin (which requires Linux knowledge to use effectively), but the deeper you get into actually doing stuff the more OS-specific some things are going to get. I’m not going to officially endorse one operating system over another because an operating system itself just another tool, but I encourage you to do hands-on research and to select your favorite.

A list of recommended operating systems to try would include one or two basic systems from each major family. Linux: Ubuntu/Debian, Fedora, OpenSuse, or even Arch. BSD: FreeBSD. Windows: 2000, XP. Many more Linux and BSD distros exist, but if you’re new to hacking then odds are that you’re not looking for the more complex/powerful ones, that was just a beginners list for those who don’t know what to try. (If you know which distro you want to use, you don’t need a recommended starting point. Use what you already like.) Feel free to hop around operating systems for a time. When you find one you like, and you know why you like it, stick with it. (Note that I do not include OSX. It is nothing against OSX but it contributes little originality to the list. If you want to try it, you can try FreeBSD, which is close enough to OSX for technical purposes, but it is free.) Practically, your operating system will limit what you can do, I advise that if you decide to stick with Windows, you at least give Linux a serious try. There’s a lot to be learned from it, and like all Unix-like systems it will inherently be more hacker-friendly. But the choice is yours. Use what works. Best yet, keep more than one OS around and use multiple OSs that work.

Good luck in your studies. Have fun with them. Be responsible with your knowledge. And when you can, contribute back to the global hacking community that’s provided you with all the information, articles, and tools you’ve been able to utilize.

2Wire’s Weakened WEP

• By Brad Conte, July 25, 2007
• Post Categories: Security
It’s a well established fact by now that the security a 64-bit WEP encryption offers a WiFi network is small, in the same sense that the Pacific Ocean is big. This is especially true as of late as recent months have unveiled multiple attacks against WEP that, figuratively, kicked it while it was down, making the popular personal network encryption scheme even more trivially broken by hackers. Various network configurations, network protocol flaws, and mathematical breakthroughs have chipped away at the effectiveness of WEP encryption to the point where it can reasonably be broken within 20 minutes by a skilled attacker.

However, while everyone is out looking for ways to use replay attacks and better mathematical algorithms to break WEP faster, I happened to note that router manufacturer 2WIRE is making on its own odd effort at rendering WEP less effective.

It’s becoming a more standard practice these days for ISPs to enable WEP by default when they install a wireless router for a new Internet customer. And what with the popularity of wardriving and P2P file-sharing lawsuits you can’t blame them. WEP isn’t the most secure wireless encryption solution but it’s the easiest one and it makes the ISPs look like they’re doing something. But for as insecure as WEP is by nature, 2WIRE does something that compromises the effectiveness of WEP on their wireless routers in a new way.

When the SBC Yahoo! ISP hooks up a customer’s Internet service the customer is provided with a 2WIRE wireless router with 64-bit WEP turned on by default and an SSID that starts with “2WIRE”. On the outside of the physical router there’s a white label with the router’s default WEP key printed on it for the convenience of the customer (and tech support). However, 2WIRE makes a crucial flaw with both the default WEP keys and all WEP keys generated by the router. If you’re used to dealing with WEP keys, one quick look at just a couple of default WEP keys for 2WIRE routers should tell you there’s something wrong.

The keys have no letters. Just numbers. All 2WIRE WEP keys are composed purely of numbers.

This means that every character in the WEP key uses just 10 of its potential 16 values. If you aren’t convinced of how significant that is, then let’s see how large the actual keyspace (namely, the effective strength) of a 64-bit WEP key is if you exclude the “letter range” from the hexadecimal key. We’re only going to examine the brute-force aspects of this.

(Note: The following will assume familiarity with binary and hexadecimal.)

Start with the full 64 bits of the WEP key (as 2WIRE uses 64-bit, rather than 128-bit, WEP by default). The first 24 bits of the key are merely the IV, which is not an effective part of the key. This was originally done in accordance with the US government’s cryptography export regulations which at the time prohibited the export of encryption technology stronger than 40 bits, so this isn’t 2WIRE’s fault. Thus, by definition, 64-bit WEP only has 40 bits of actual effective keyspace. (Hence the reason 64-bit WEP is often referred to as 40-bit WEP.)

If the entire 40 bit range of keyspace were used, the key would still be relatively small. 40 bits is nothing by todays standards — no one uses anything less than 128 bits if they’re serious about the security of their encrypted data. But 2Wire chips away at even those 40 bits.

The remaining 40 bits are the equivalent of 5 bytes. Each byte is represented by two hexadecimal characters (each hexadecimal character representing four bits of the byte). These 10 hexadecimal characters will compose the final human-readable WEP key. Each hexadecimal character has a range of 16 values (because it is 4 bits in length). However, by restricting a WEP key to be composed of only numbers, each character only has a range of 10 possible values. It only takes log_2 (10) = 3.322 bits to have 10 possible values in binary, thus we only have 3.322 effective bits of key.

Now instead of having 10 * 4 = 40 bits of keyspace, we are left with 10 * 3.322 = 33.22 bits of keyspace. This 17.5% reduction of effective keyspace may not seem that critical, but remember that each bit of keyspace doubles the strength of the key. This is because the strength of the key is expressed as the number of combinations that would be required to successfully guess the key based on its length and value restrictions.

With forty bits of keyspace, we have 2^40 = 1,099,511,627,776 possible combinations. This isn’t large in the world of cryptography, but it’s annoying enough that likely no one would want to spend a couple weeks breaking it on their computer — not if the payoff was simply access to a personal network. However, contrast that number of combination with the number of combinations we get from just 33.22 bits of keyspace, namely, 2^33.22 = 10,004,985,324 possible combinations.

Yes, those are both big numbers, but count the commas in them and note that the first is over 100 times larger than the second. Now, assume that a hypothetical attacker wants to launch a brute force attack against a key of 40 bits and a key of 33.22 bits. Further assume that his computer can make 500,000 attempts per second, which is not unreasonable for a home computer. (Remember, if if the attacker has a weak laptop on site he may still have a powerful desktop he can use remotely to do his hard work.) So the hypothetical attacker captures a few encrypted packets from your network then goes to work brute forcing them.

With his assumed computing speed, it would take 25.5 days to brute force the 40 bit key, but only 5.6 hours to brute force the 33.22 bit key. And those are the worst-case scenarios, note that we are assuming that the correct key is the very last one the attacker guesses. Statistically the attacker has a 50% chance of guessing correctly half way through.

Now is that 40 – 33.22 = 6.78 bits of difference in keyspace looking more important? An attacker started needing to devote nearly a full uninterrupted month of computer processing time to the attack and has downgraded to just needing to leave his computer working while he goes out to a movie.

In summary:
  • 2WIRE made a decision to only use numerals in their customers’ default 64-bit WEP network setup.
  • In doing so, the necessary time for launching a brute force attack against such a network is decreased from about 3.6 weeks to about 5.5 hours.
  • These networks are easily identifiable via a default SSID that starts with “2WIRE”.
  • Despite the advantages this compromise of keyspace gives the attacker, there are still many faster (but more complicated) ways to break a WEP network.
In conclusion, allow me to compare this new ways we now have of attacking a 2WIRE WEP network with the traditional way that works against all WEP networks.

The traditional way:
  • is faster (20 minutes possible break times)
  • requires active attack (attacker must collect packets for a long time)
  • requires more specific hardware/firmware (requires injection mode)
  • is more complicated / less reliable
The 2WIRE-specific brute force way:
  • is longer
  • does not require active attacks, a few packets can be saved and attacked later
  • requires less specific hardware/firmware (only monitor mode required, this is very standard)
There’s no question about it, 2WIRE WEP is significantly worse than standard WEP.

However, I would speculate that it’s unlikely that this weakness will turn out to be of much, if any, consequence. The thing is, for as bad as 2WIRE WEP is, WEP’s inherent weaknesses are worse. Serious attackers will have better ways to get into encrypted networks, so they’re unlikely to care about this. The people that would be best off using this tool would be the less-serious attackers, but there exist no automated tools (yet) for launching this specific attack — and odds are probably decent that there never will exist them. This flaw is too specific and overshadowed by too many greater flaws to receive much attention. Writing the tool, though, would be trivial — the aircrack-ng suite already contains all the necessary functionality.

This kind of security bungle would make any security engineer cringe. Such a poor configuration would never fly (I hope) at the U.S. DoD or the NSA, but I don’t think it impacts Joe Schmoe that much.

SBC Yahoo!/2WIRE got off easy with this poor decision because the serious weakness they introduced was none weaker than weaknesses that already existed. They definitely dodged the bullet on this one. However, had WEP not been so critically broken before 2WIRE’s mistake came on the scene, I guarantee that much more attention would’ve been focused on their flaw.

Finally, 2WIRE’s decision to only use numbers in WEP keys itself is somewhat puzzling. I don’t know if all 2WIRE routers are this way or if SBC Yahoo! made a deal with 2WIRE for this functionality in order to ease up on tech support calls. Regardless, my guess is that it was a tech support problem having to do with letters being in the keys. Average consumers probably naturally associated security codes with numbers and were getting confused to find letters amist their WEP keys.

And in the end, that’s the heart of security, tradeoffs. Some are good, some are bad. Depending on the resources SBC Yahoo!/2WIRE saves because of the decision, it may even be worth it. I just know they got lucky.

Another interesting factoid for the archives of 802.11 wireless security.

A Simple Partitioning Tip

• By Brad Conte, June 26, 2007
• Post Categories: Computers & Tech
Deciding how to partition a hard drive is not necessarily a simple task. Depending on what you want to do with it, your partitioning scheme may vary greatly. For those with specific needs I put forward a practical tip: Make all your operating system partitions the exact same size. I’ve learned the value of this several times over in situations that called for experimentation/backup with/for an operating system.

I will use the *nix tools fdisk (the Windows version of fdisk will not suffice) and dd, and consequentially assume that the reader has minimal *nix experience and access to some form of a *nix like system. Linux live CDs are adequate, as will (I believe) OSX. The *nix system will be used to perform the delicate initial partitioning and the partition clones thereafter.

I always dual-boot Windows and Linux, keep a third partition around for experimenting with other operating systems, and have a fourth partition blank. All four of these partitions are the exact same size, which offers me flexibility in moving them around. The biggest advantage is that it allows me to perform a byte-for-byte clone any one partition onto a second partition, perform whatever perverse thing I’m experimenting with on the first partition, and then restore it if something goes wrong. Or I can just boot straight to the new copy of the partition I cloned. Somewhat time consuming, but simple and error-proof.

I know this concept may strike some as a waste of time and space, but it’s not inefficient as it may sound. Cloning a 20GB partition can be done over lunch and, like many others, I have a hard disk exclusively devoted to operating systems, no one of which needs more than 25GB.

There are several reasons why you might want to backup an entire partition. The need to do so for a *nix system is less pronounced, because the flexibility of *nix systems lets you do a file-level copy between partitions without adverse effects. But doing a byte-for-byte direct copy isn’t much longer than a file-based copy, and removes any of the file-based copy complications. As well, Windows systems are attached to their partitions and if they are copied on the file level to a new file system they will not work, so doing a byte-by-byte image of a Windows system is almost a must for backup purposes.

The problem, though, is that if you rely on a partition manager like the default Windows manager or GParted (which is the default partition manager in the Ubuntu installation process) to create your partitions for you, as odd as it may seem, you aren’t guaranteed to get partitions the exact size you specified. I don’t know the details, but creating two 20GB partitions does not guarantee you of getting two partitions of the same size. Thus when you go back to try and clone one partition to another you may discover that the destination partition is, say, 8MB smaller than the source partition, and there will be hell to pay.

Creating Precisely-Sized Partitions
  • Open the disk to partition with fisk:
    # fdisk /dev/sda
    Use the “p” command to get a printout of my current table. If the disk is new, the printout should be empty.
  • Determine how large you wish the partitions to be. Create a new partition and choose the starting first sector (use the default if you are creating them sequentially). Then select the last sector by using the +XG to indicate that the last sector should be X gigabytes worth of sectors after the first. This should work with both primary and extended partitions, with one exception noted below.
  • Exception: There is a special partition that requires a non-default starting sector. The first partition within an extended partition will start in the same cylinder as the extended partition marker, and thus share some space with said marker and not be the exact size specified. To correct this, create the first “inner” extended partition one sector after the beginning of the “outer” extended partition. This will result in a few bytes of wasted space, but if both partitions start on the same sector then size of the final partition will be slightly too small.

  • Copying Partitions
    • Decide which partition will be the source and which will be the destination. Use dd to copy from the source to the destination:
      # dd if=/dev/sda2 of=/dev/sda4 bs=8M
      A key parameter here is the “bs” option, which tells dd how many bytes to read and write each time. Read/write operations to disks are relatively slow and have significant overhead so you want to make each read/write operation worth your computer’s time. I’ve found 8MB to be about the most efficient block size to use for each read and write. If you fail to specify a value then the default of 512 bytes will be used, this can make the process take on the order of 100 times longer to finish.
    Obviously, copying partitions also applies to copying entire disks if the disks are the exact same size. This can be used make manual backups of entire drives.

    Credit Card Number Generator

    • By Brad Conte, March 3, 2007
    • Post Categories: My Projects
    Generate Credit Card Numbers

    Visa   (Length: 13:  16:)
    Mastercard
    American Express
    Discover

    Download: JavaScript source code.

    About This Generator
    First of all, let me make it clear what this generator is not. It is not a legitimate credit card number generator. It just produces numbers that will pass the initial credit card numerical testing. Numbers generated by this script could be valid, since they conform to the general necessary numerical requirements, but statistically it’s near impossible to generate a valid card number by chance — the odds are literally trillions to one (against) of doing so. If you try to use one of the numbers generated here as an actual credit card number, it’ll get bounced the moment the card gets validated by the bank that supposedly backs it.

    Now, about what this generator is. Despite what it might look like, Credit Card numbers aren’t totally random strings of numbers. Ever wondered how online stores like Amazon.com can helpfully inform you if your credit card number is invalid when you make a typo? This is possible because all credit card numbers all conform to the Luhn algorithm. The Luhn algorithm acts as a convenient way to catch almost all credit card number typos by subjecting numbers to a numerical test that a valid credit card number definitely will pass, but is unlikely a mistyped number will pass.

    All things considered, the Luhn algorithm is very simple, and it’s algorithmically trivial to generate a random number and tweak it so as to force it to pass the Luhn test and appear, at a glance, as a valid credit card number.

    To use the Luhn algorithm, start at the right side of the credit card number. Moving left, add the first digit to your running sum (which starts at zero), then double the second number and add that to your running sum. However, if the double of the second number yields a double digit number, separate the digits and add them separately, (ie, 16 becomes 1 and 6 and adds to 7). Continue this pattern of adding each number and doubling every other number for all digits in the card. Take the final sum and divide it by 10. In order to pass the Luhn test, the remainder must be zero (ie, the total sum must be a multiple of 10).

    Using this process, anyone who wants to validate that your credit card number is plausible, before they waste a day or two of both your time trying to process it, can easily do so. Statistically if you make a mistake typing your credit card number you will not enter a number that passes the test. If you make a mistake on just one of the numbers you cannot have a valid credit card number because the total must be a multiple of 10, and no one digit can be 10 off from itself without being equivalent to itself modulo 10, thus your mistake must include at least two numbers. But although you likely will not accidentially generate a valid incorrect credit card number, it’s not hard to custom tailor a number to pass the Luhn test.

    Two facts make it easy to generate a number that passes the Luhn test: The final sum of the number string must be a multiple of 10, and the last digit of the number is never doubled. Thus the final number can be custom tailored to the rest of the number to force the sum to be a multiple of 10. My script (above) does just this, it generates random numbers right up to the last digit, calculates the sum using the existing digits, then tacks onto the end whatever number is necessary to force the sum to a multiple of 10. (Actually, the first couple numbers are dictated by the specific credit card vendor you want to use, since they all have their own blocks of numbers they’re allowed to use.) This process isn’t far from how banks generate the credit card numbers themselves, they start the card with their allocated first number(s), then pad the number to a certain length with random digits, then create and append the card’s account number, which fills up the card to the very last digit, which is then chosen specifically to make the card pass the Luhn test.

    At the top of this page is my credit card number generator, written in JavaScript. It will generate card numbers that pass the Luhn test and fall into the numerical category of the vendor you choose, with the appropriate card number length. But, again, these are not valid credit card numbers, they simply pass typo testing. You can validate that these cards pass the Luhn test by putting them through the test form here. You can read more about credit card numbers here.

    My Review of ABeka Acadamy

    • By Brad Conte, February 17, 2007
    • Post Categories: Miscellaneous
    ABeka Academy is the child of the larger Pensacola Christian College that handles grade school and high school. The two academic institutions have the same philosophies, same teachings, same standards, and are, ultimately, run by the same people. ABeka is based out of Pensacola, Florida, and they offer a nation-wide home school charter program for home school families who want to give their kids an at home, Christian education. They offer their program for the entire K-12 grade spectrum.

    At a glance ABeka may seem like the perfect answer to a lot of home schoolers’ needs. They provide the books, materials, instruction, grades, and a diploma. All you have to do is send them a few thousand dollars per year and grade the student’s quizzes with an answer key ABeka provides.

    But for all ABeka does, there’s a lot they don’t do. I’m an ABeka high school student, and everything I say comes from three years of experience in ABeka’s high school program, and I say that ABeka is not all they’re made out to be. (Note that I only spent three years in ABeka — I’ll explain later.)

    Like a lot of students, I joined the ABeka high school program my freshman year because I needed the instruction their DVD courses offer. My mom’s teaching was adequate until then, but she had three younger kids to take care of and home school as well and the material I was covering in school was getting harder for her to explain. So when I started high school, we decided it would be easier for both of us if I did all my schooling via ABeka. We did the same research that basically all other prospective ABeka students have done, and they appeared to be a solution for our needs. As it turned out, we didn’t know as much about them as perhaps we should have.

    I took classes at a community college during high school. Not being the type of person who wanted to take two classes when one would suffice, I asked ABeka if they would give me credit for my college classes and count them towards my high school record. This seemed like a reasonable request, since every public and private school I know of does so, on the grounds that a college class should meet the standards for a high school class.

    But no. My college classes may have been good enough for UC Davis and UC Berkeley (the two schools that accepted me when I transfered out of community college years later), but they were not good enough for ABeka. ABeka said that they would not give me credit for college classes, and, when pressed for the reason why, said that it was because they could not validate that the classes I took would satisfy their standards. That is, seriously, what we were told. My college classes weren’t veritably good enough for their high school requirements.

    Now, I could understand why ABeka might frown on an anthropology class, biology class, or any class in that general area because of the philosophical and (potentially) anti-Christian teachings commonly associated with such classes (ABeka is, after all, a Christian school) but I was asking ABeka to accept computer and math classes — classes that carry no such philosophical baggage. In fact, they were classes that ABeka didn’t even offer but that I would need for my college major later in life. (Ironically, ABeka is big on “preparing you for college”, by the way.) It is standard procedure for kids in high school to take a community college class when their high school doesn’t offer an equivalent class –- I’ve shared classes with a couple of them myself – but ABeka apparently doesn’t see fit to accommodate anyone in this area, and their refusal to credit students for college classes boxes some students into a very tight corner, as I’ll explain later.

    Along the lines of ABeka’s high standards, they’re very anal about problem solving methods. I happen to be gifted in mathematics. Since an early age I’ve always excelled in math; I was actually factoring and solving elementary Algebra problems by age 8 when most kids are doing arithmetic. Math and logic come naturally to me and I usually solve problems quickly and with minimal work.

    As it turns out, doing so is not a practice ABeka encourages. They wanted to see every little step and sub-step of my math work. I would sit down and breeze through a test with 98% accuracy, and lose 10% because I “didn’t show enough work”. I can understand that, as the graders, they need to see some work between my beginning and ending steps, so I would always show my work at important intervals. But I didn’t show enough, even though anyone looking at what I did could tell what I was doing. I could combine three steps in my head and turn what they deemed an eight-step problem into a four or three step problem just by my normal way of solving problems. I wouldn’t condense the steps too much, though, and would usually include a step or two more than I personally needed to just for good measure. But I would, consistently, get scrawled red-ink notes on my tests informing me that I wasn’t showing enough work because doing work, showing the important steps of the solution, and getting the correct answer wasn’t good enough. If I were shortening 10 step problems to four step problems I might see their point, but, like I said, I wasn’t doing that. I can recall multiple instances where I actually lost points for shortening a four-step problem down to a two or three step problem.

    Wanting to see the steps a student uses to solve a math problem is reasonable, but ABeka wasn’t insisting I be reasonable. They were insisting I memorize and regurgitate their step-by-step solutions.

    Throughout ABeka’s math courses, I found myself painfully trying to find extra sub-steps to write down, so that I would actually get full credit for my work. There were many tests where I actually lost more points to not showing enough work than to making mathematical errors.

    Unfortunately, this is very typical of ABeka. They don’t encourage creativity and ingenuity; they encourage memorization and regurgitation. Understanding math isn’t important, following steps 1, 2, and 3 is. That’s a horrible way to teach math. At the end of such a class, a student will not have learned anything life-applicable, they will have learned how to memorize math steps. And, as a math major, I’m here to tell you that that flat out doesn’t work. Ask any math student or math professor at any university and they’ll tell you that that learning method isn’t worth beans to students.

    Another issue I have with their math department is that they only offer three real years of traditional, consecutive math study, their fourth year is devoted exclusively to consumer math –- if you opt to take math at all. That’s fine, I have nothing against people taking consumer math, but not everyone benefits from it. No disrespect to anyone who has taken consumer math, but anyone who plans on majoring in something science, engineering, or math related does not want to waste an entire year on consumer math. It isn’t going to help them in anything. If they’re going to be an engineer, they obviously have the math skills necessary to understand consumer math as it comes in life. What they need for their careers is a strong understanding of trigonometry and calculus. They have so much math they’ll need to study they can’t afford to spend a year not progressing towards higher math.

    But ABeka doesn’t offer calculus. The highest level of math they offer is a hybrid trigonometry/advanced geometry/pre-calculus class. If you could just go down to the local community college and get your calculus class that way it wouldn’t be so bad, but, as I discussed earlier, that isn’t exactly an option. ABeka won’t accept college classes, so you’re stuck with what they offer unless you double up and do ABeka’s full school load in addition to calculus at college. Possible, yes. Reasonable? Not really.

    If you’d hoped, in lieu of getting any calculus, to get a good, solid trigonometry foundation (which, believe me, you future engineers and mathematicians will need), you’re in for a disappointment. Their hybrid trigonometry/advanced geometry/pre-calculus class is, in my opinion, the worst math class they offer. They try to cram too much into one class, and the class as a whole is devoid of direction. You have a semester of trigonometry, then you have a semester of geometry, and at the end they announce that you’re ready for calculus. I’ve taken college pre-calculus, and it’s nothing like what their pre-calculus is. So for the record, you’re not usually ready for calculus by the time you’re done with that class. If you have the option of doing so without hurting your planning, take a real pre-calculus class at your community college your senior year of high school. It’ll get you better prepared for actual calculus and it’ll help keep your mind in shape during your year of vacation from math at ABeka.

    Also, I’d go so far as to say that their hybrid trigonometry/advanced geometry/pre-calculus textbook(s) are the worst textbooks I have ever used. The books are confusing, very poorly organized, vaguely worded, and sometimes just ramble about nothing that make sense. A good math textbook will be something (if you go on in a field related to math) that you reference in later years when you have a question on that topic. I myself have referenced every math textbook I’ve used since Algebra II — except their trigonometry/geometry one.

    Along the lines of bad math classes, trigonometry/advanced geometry/pre-calculus isn’t the only bad one, so are Algebra I and II. The Algebra series is almost the same subject both years, as best I could tell. Half of Algebra II is contained in Algebra I, just a little differently, which logically means that either their Algebra II moves back to overlap traditional Algebra I or their Algebra I moves ahead to overlap traditional Algebra II. Anyone familiar with ABeka definitely knows the answer to that. (For non-Abeka’ers, Algebra I moves ahead. ABeka never reaches backward for anything. When in doubt push too fast and slow down later. That is their motto.) Students don’t get the opportunity to take math gradually and let it grow on them; they get it shoved into their face. There’s a difference between memorizing math and understanding math. Students can memorize math in the same way they memorize poems, and then forget it a couple years (or weeks) later. Math, taught properly, shouldn’t be like that. What good is it that way?

    The algebra textbooks are nothing to brag about either. They’re poorly organized and confusing. Woe to the student, or mother, who doesn’t have the DVDs and opts to learn the material straight from the book. I taught myself exclusively almost all of the math I learned in school through their 8th grade math level, but, once I hit their Algebra I textbook, it all came to a shuttering halt. I couldn’t teach myself the material any more, and that prompted us to to sign up for their video program. Their math textbooks are good and I would recommend them up to 8th grade. After that they’re horrible and I would recommend you look elsewhere.

    (I’ve heard many other people voice the exact same thing about ABeka’s textbooks. In the beginning I wondered if it was just my mom and I who didn’t like the difference between ABeka’s lower grade math books and their high school text books, but I’ve met a lot of people who agree. I’ve even had people e-mail me, after reading what I say, who say the exact same thing, “ABeka was great, right up until high school.”)

    For those who don’t know me, and for those who do know me, let me remind you, I’m a math major. Math is what I do, math is what I understand, and math is what I’ve studied. I would confidently say that I’m more than qualified to speak on their math program. And doing so, I grade it a C. Sure it could be worse, but that’s almost a failing grade. (I guess it’s better than it sounds. A C is, after all, by ABeka’s standards, about, what, an 85%?*)

    * This is meant to be funny. ABeka students won’t find this funny, though, because this is too close to reality to be funny.

    Now, leaving the realm of math and going to the complete opposite side of the spectrum…

    Their English program is somewhat insane. Each year’s English class is basically two classes rolled into one. It was like they couldn’t decide whether to focus on grammar or literature, so they just decided to get the best of both worlds and decided to do both. Looking back, I think that English was by far their most intense subject. There was always grammar homework to do, literature to read and comprehend, and poems to memorize. Constantly, constantly, constantly. Write this, memorize that, etc. Due to the amount of material covered, English had about twice the number of quizzes of any other subject. There were actually quite a few classes composed of nothing but a pile of 15-minute quizzes.

    I’m all for students having good grammar and being able to write well because it’s a necessary life skill. I think less highly of literature, but it has its merits. But ABeka needs to decide what they want to do with their English program. Forcing students to concurrently deal with two nearly full time subjects is just stupid. I can’t help but notice, at my college, that the English Writing and English Literature classes are in completely separate categories, and I don’t think that’s by chance. One class. One subject. It works best that way. Someone should point that out to ABeka.

    I don’t know why the four years of high school English aren’t split into two years of each subject. The fact that they try to teach grammar in English for all four years of high school is just weird. I mean, you don’t need four years of English grammar. Eventually you need to concentrate on just writing (enough with the sentence diagrams already). But no. They try to fit the exact same material into each English class for four years. I think they should just split their classes up into two years of writing and two years of literature (or some other ratio). The writing classes would consist of learning to write, and the literature classes would consist of learning to comprehend literature and poem memorization. Each class would be object-oriented, and just maybe you wouldn’t find yourself diagramming sentences going into your senior year. I have never heard of anyone else having to do that.

    Overall, their English program seems to be aimless. You do four years of it, and at the end you’ve spent countless hours writing the same essays multiple times, diagramming the same sentences over and over, and memorizing of poems that, honestly, you don’t remember a tenth of by the end. For a private school with their reputation, it sure is easy to go through their program and not improve your writing abilities. It could be argued I’m proof of that.

    This brings up yet another subject I want to point out. ABeka is known for being tough, which isn’t bad. Tough isn’t a bad thing, in and of itself, and I personally like tough. My problem with ABeka is how tough they are in combination with how inflexible their schedules are. They don’t give students homework to complete by the end of the chapter, or by the end of the week, rather, by every class the last assignments are due and new assignments are issued. There’s no buffer period for students to manage. If you do all the homework and assignments for each class, every day is an exact repetition of the last.

    In college, and I have report that this is similar in public schools, my workloads rise and fall in each subject over each week. Each day has different priorities and different subjects that need to be studied. In ABeka, it’s the same thing every day. Every day you have to do x, y, and z, and it has to be done today so that tomorrow you can do the new and improved X, Y, and Z. Not only does it not allow for personal interruptions in life it gets very old very fast. If you’re not a good “just grinding away at it” person, you’ll get bored of ABeka in about a month. It’ll become a seemingly endless, boring chore.

    Like I said at the beginning, I only did three years of ABeka’s high school program. I left at the start of my senior year. But hopefully, by now, you understand why I left. I didn’t leave because I was a failing, lazy student. I left because they couldn’t meet my needs. I needed math and computer classes; they didn’t provide them and wouldn’t accept college alternatives. Their grading was obnoxious and discouraged creativity and originality. Their English workloads were irritatingly heavy with no sense of direction or real accomplishment and distracted me from beneficial activities. And in general, I grew to simply loathe their classes.

    I left Abeka a straight A student after three fairly miserable years and joined the ACAEA in my senior year, graduated half way through the year, and promptly started college.

    On that note, going from ABeka’s high school program to college was a huge change. And I have to say, in all honesty, ABeka’s scholastic training didn’t help a bit. Their environment was completely different from college. Nothing ABeka teaches or encourages by way of study habits and scholastic conditioning will be useful in any normal college. And nothing they say you’ll need in college you actually will need in college. The teachers in ABeka’s video lectures make the occasional remark about how you’re going to need skill X or knowledge Y to survive in college and/or the rest of life, and nine times out of ten it’s completely bogus. The exception is their Bible classes. Those are by far the most practical and best classes they offer.

    In college, they’re interested in creativity and ingenuity. They’re concerned that you get the right answer, rarely how you got there. Your homework, if you even have any that is obligatory to turn in, is collected sporadically in chunks, allowing you to pick it up and do it at your own pace whenever you need to. The focus is to gain understanding and brainpower, and they’re usually pretty relaxed about it.

    In summary, here are my complaints about ABeka Academy. I’ve talked a lot, but this list summarizes the main points that I’ve talked about:
    1. ABeka will not accept college classes.
      • They don’t offer calculus.
      • Their trigonometry/advanced geometry/pre-calculus math class is bad, and doesn’t prepare you for when you eventually do take calculus.
      • Their algebra series is too aggressive.
    2. Their English program is heavy, time consuming, and redundant.
    3. Their overall teaching style is too anal and procedure oriented.
    4. They don’t prepare you for real life, despite the fact they incessantly insist that they do.
    So… These are just my own thoughts about ABeka, and I know that there are those who would disagree with my opinions. Some people aren’t like myself. Some people like the hard workloads and “just do it” mentality of ABeka. That’s fine, but those people are the minority, most other people don’t fit well with ABeka, and I’d like for those people to know what they’re getting into before they find it out the hard way.

    How do you know if you’re right for ABeka? If you’re a casual, independent, questioning person, ABeka probably won’t be a good fit. Conversely, if you like memorizing 15 20-line poems a year, having your homework dictated to you day by day, and taking only three real years of math, you probably will fit with ABeka. And that’s fine. I’m not saying ABeka is morally evil, I’m just saying that I personally don’t like them. And I think that a lot of other people, judging from ABeka’s turnover rate, don’t like them either, but don’t know enough when they begin to know that.

    But, ultimately, it’s all about education. Never forget the primary function of school. School is to teach you knowledge and, most importantly, expand your understanding. Pick what works with your personality and educational mindset the best.

    « Older PostsNewer Posts »