KGSR Online: Required Listening for Austin Refugees

Of course there is nothing like KGSR in Chicagoland. Hell, there is probably nothing that plays the eclectic mix of Texas and Foreign music anywhere else. One more reason to work from home more often.

Sunbrid Recant (or searching for a browser-based iCal Replacement)

So once again I'll recant on on a previous blog.

Sunbird is crap. Events mysteriously get created and can't be deleted. Or get deleted, period. Or something weird happens with the interface. It never crashed, though. But it was annoying enough to stick with iCal.

So what I really want is a entirely browser-based iCal/Google Calendar-like tool (that means Javascript, and I'm not a Javascript programmer) tool that allows me to:

Drag (and eventually drop) activity across a daily schedule for stuff I work on.

Remember/autosuggest project names

Export events to some standard format, iCal or XML, YAML, or whatever

Summarize project activity by week/month/totoal

Yeah this probably could be done in Rails/Django but I don't want that. No databases. No webservers, but still browser based. Am I crazy? Creating a Dojo Calendar has promise, but it requires server side code. What I want is something self contained like TiddlyWiki. Where the data is all stored in the .js and can be moved around and modified.

Since I'm obviously in over my head (what else is new) this is obviously something I wouldn't want to start from scratch, but what next? Should I look at GWT or better yet pyjamas to avoid Java development? Obviously this would be (relatively) trivial to do as a traditional desktop GUI app but that is no fun.
The key is needs to be portable, lightweight, usable off line. Somebody else had to have run across this sort of problem (and solved it) before. We'll see what happens.

Sunbird as an iCal Replacement

Although orage is more useful than it appears at first, I discovered Mozilla Sunbird today when looking for a decent standalone calendaring program for Linux.

Now my primary use for calendaring is tracking my hours on projects, and iCal ended up to be the easiest way to do this on the Mac although I did try out some time tracking software. Now folks can pry my 12" Powerbook out of my cold dead hands, but I'm trying to ensure I'm using cross platform tools in case my Powerbook dies, I have to send it in for service, etc.

BTW, Sunbird easily handled 18 months of timesheets I exported from iCal so it looks like a keeper.

Using i4965AGN (iwlwifi + not ndiswrapper) and wpa_supplicant

For some reason I've always had a mental block about wpa_supplicant. I thought it was hard to setup.Well for WPA Personal it is not.

So after getting discouraged about not seeing anyone getting wpa_supplicant working with the iwlifi/mac80211 drivers, I was suprised to actually get WPA working with my Linksys AP (one of the crappy new VXWorks based ones I think). See my previous blog for the list of components necessary.

Using a simple config file (/etc/wpasupplicant.conf)

network={
ssid="kartoffel"
psk="m00nfac3"
}

The stock Debian 4.0 network-manager packages and wpasupplicant 5.5 ( which is a dependency of network-manager) were required. So starting from scratch:

franz-t61:~/iwlwifi# ./unload
Unloaded: iwl4965 iwl3945 mac80211 cfg80211
franz-t61:~/iwlwifi# ./load
No modules unloaded.
Loaded: iwl3945 iwl4965
franz-t61:~/iwlwifi# startwpa
ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 4 value 0x0 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 5 value 0x1 - franz-t61:~/iwlwifi# cat /usr/local/bin/startwpa
wpa_supplicant -B -c /etc/wpasupplicant.conf -i wlan0 -D wext
franz-t61:~/iwlwifi# iwconfig wlan0
wlan0     IEEE 802.11g  ESSID:"kartoffel"  Nickname:""
         Mode:Managed  Frequency:2.457 GHz  Access Point: 00:18:F8:52:B5:E1
         Bit Rate=54 Mb/s   Tx-Power=27 dBm
         Retry min limit:7   RTS thr:off   Fragment thr=2346 B
         Encryption key: wo-ul-dn-ty-li-ke-to-kn-ow
         Power Management:off
         Link Quality=65/100  Signal level=-68 dBm  Noise level=-127 dBm
         Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
         Tx excessive retries:0  Invalid misc:0   Missed beacon:0

franz-t61:~/iwlwifi# dhclient wlan0
There is already a pid file /var/run/dhclient.pid with pid 5114
killed old client process, removed PID file
Internet Systems Consortium DHCP Client V3.0.4
Copyright 2004-2006 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/

wmaster0: unknown hardware address type 801
wmaster0: unknown hardware address type 801
Listening on LPF/wlan0/00:13:e8:08:8d:f5
Sending on   LPF/wlan0/00:13:e8:08:8d:f5
Sending on   Socket/fallback
DHCPREQUEST on wlan0 to 255.255.255.255 port 67
DHCPREQUEST on wlan0 to 255.255.255.255 port 67
DHCPACK from 192.168.170.1
bound to 192.168.170.100 -- renewal in 35748 seconds.

And of course there are NetworkManager and wpa_supplicant daemons. I think I've actually got 5-6 wpa_supplicants running, hehe.

i4965 Finally Working (Albeit Insecurely)

Well I can finally toss my PCMCIA Aironet 352, and a good thing since the button was starting to stick. Even the thick single button design on the T-61 seems a bit flawed.

Components that worked for me

• Linux 2.6.21.5
  
• Linux wireless tools v 29 (compiled from source, obviously you need to wipe the one in your distro)
• iwlwifi-4965-ucode-4.44.15.tgz
• iwlwifi-0.0.38.tgz
• mac80211-9.0.2.tgz

Here is an excerpt of my kernel config. The key breakthrough (I think) was that I read somewhere (probably on ThinkWiki) not to enable the wireless netlinks (CONFIG_NL80211 below) Otherwise the README's are pretty much on target. You do have to up the wlan0 interface before trying to assign the essid.

CONFIG_CFG80211=m
# CONFIG_NL80211 is not set
CONFIG_WIRELESS_EXT=y
CONFIG_MAC80211=m
# CONFIG_MAC80211_DEBUGFS is not set
CONFIG_MAC80211_DEBUG=y
CONFIG_MAC80211_VERBOSE_DEBUG=y
CONFIG_MAC80211_LOWTX_FRAME_DUMP=y
CONFIG_TKIP_DEBUG=y
CONFIG_MAC80211_DEBUG_COUNTERS=y
CONFIG_HOSTAPD_WPA_TESTING=y
CONFIG_MAC80211_IBSS_DEBUG=y
CONFIG_MAC80211_VERBOSE_PS_DEBUG=y
CONFIG_IEEE80211=m
# CONFIG_IEEE80211_DEBUG is not set
CONFIG_IEEE80211_CRYPT_WEP=m
CONFIG_IEEE80211_CRYPT_CCMP=m
CONFIG_IEEE80211_CRYPT_TKIP=m
CONFIG_IEEE80211_SOFTMAC=m
# CONFIG_IEEE80211_SOFTMAC_DEBUG is not set

Kernel modules and stuff

franz-t61:/var/log# lsmod
Module                  Size  Used by
iwl4965               181796  0
iwl3945               159460  0
mac80211              161548  2 iwl4965,iwl3945
cfg80211                8264  1 mac80211
ecb                     3840  2
arc4                    2432  2
ipv6                  236640  22
button                  8400  0
dm_snapshot            16868  0
dm_mirror              20756  0
sbp2                   21700  0
eth1394                18884  0
tsdev                   8000  0
pcmcia                 35220  0
firmware_class          9920  3 iwl4965,iwl3945,pcmcia
i2c_i801                8912  0
ohci1394               32944  0
i2c_core               21056  1 i2c_i801
ieee1394               90040  3 sbp2,eth1394,ohci1394
yenta_socket           25292  1
rsrc_nonstatic         11008  1 yenta_socket
pcmcia_core            37524  3 pcmcia,yenta_socket,rsrc_nonstatic
psmouse                35528  0
serio_raw               7044  0
pcspkr                  3584  0
intel_agp              23452  1
agpgart                32712  1 intel_agp
evdev                   9664  3


franz-t61:~# iwconfig -v
iwconfig  Wireless-Tools version 29
      Compatible with Wireless Extension v11 to v22.

Kernel    Currently compiled with Wireless Extension v22.

wlan0     Recommend Wireless Extension v21 or later,
      Currently compiled with Wireless Extension v22.


# ifconfig wlan0
wlan0     Link encap:Ethernet  HWaddr 00:13:E8:08:8D:F5
      inet addr:192.168.2.137  Bcast:192.168.2.255  Mask:255.255.255.0
      inet6 addr: fe80::213:e8ff:fe08:8df5/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:1635 errors:0 dropped:0 overruns:0 frame:0
      TX packets:1269 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000
      RX bytes:1234676 (1.1 MiB)  TX bytes:300070 (293.0 KiB)

franz-t61:~# iwconfig
eth1      no wireless extensions.

lo        no wireless extensions.

eth0      no wireless extensions.

wmaster0  no wireless extensions.

wlan0     IEEE 802.11g  ESSID:"tsunami"  Nickname:""
      Mode:Managed  Frequency:2.437 GHz  Access Point: 00:90:4B:38:E6:5C
      Bit Rate=54 Mb/s   Tx-Power=27 dBm
      Retry min limit:7   RTS thr:off   Fragment thr=2346 B
      Encryption key:off
      Power Management:off
      Link Quality=81/100  Signal level=-53 dBm  Noise level=-127 dBm
      Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
      Tx excessive retries:0  Invalid misc:0   Missed beacon:0

And dmesg from ./loading and ./uloading the interface.

[ 1296.724000] iwl4965: ipw going down
[ 1298.780000] wmaster0: Removed STA 00:90:4b:38:e6:5c
[ 1298.848000] ACPI: PCI interrupt for device 0000:03:00.0 disabled
[ 1326.836000] iwl3945: Intel(R) PRO/Wireless 3945ABG/BG Network Connection driver for Linux, 0.0.38d
[ 1326.836000] iwl3945: Copyright(c) 2003-2007 Intel Corporation
[ 1326.836000] iwl4965: Intel(R) Wireless WiFi Link 4965AGN driver for Linux, 0.0.38d
[ 1326.836000] iwl4965: Copyright(c) 2003-2007 Intel Corporation
[ 1326.840000] ACPI: PCI Interrupt 0000:03:00.0[A] -> GSI 17 (level, low) -> IRQ 22
[ 1326.840000] PCI: Setting latency timer of device 0000:03:00.0 to 64
[ 1326.840000] iwl4965: Detected Intel Wireless WiFi Link 4965AGN
[ 1327.076000] iwl4965: Channel 12 [2.4GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 13 [2.4GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 14 [2.4GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 183 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 184 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 185 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 187 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 188 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 189 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 192 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 196 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 7 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 8 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 11 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 12 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 16 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 34 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 38 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 42 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 46 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 100 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 104 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 108 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 112 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 116 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 120 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 124 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 128 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 132 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 136 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 140 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Channel 145 [5.2GHz] is Tx only -- skipping.
[ 1327.076000] iwl4965: Tunable channels: 11 802.11bg, 13 802.11a channels
[ 1327.076000] wmaster0: Selected rate control algorithm 'iwl-4965-rs'
[ 1327.076000] iwl4965: Unhandled INTA bits 0x04000000
[ 1327.076000] iwl4965: Disabled INTA bits 0x04000000 were pending
[ 1327.076000] iwl4965:    with FH_INT = 0x00010000
[ 1327.080000] iwl4965: REPLY_CT_KILL_CONFIG_CMD succeeded
[ 1348.472000] HW CONFIG: channel=1 freq=2412 phymode=3
[ 1348.480000] ADDRCONF(NETDEV_UP): wlan0: link is not ready
[ 1365.048000] HW CONFIG: channel=1 freq=2412 phymode=3
[ 1365.052000] HW CONFIG: channel=6 freq=2437 phymode=3
[ 1365.060000] iwl4965: REPLY_ADD_STA failed
[ 1365.060000] wlan0: Initial auth_alg=0
[ 1365.060000] wlan0: authenticate with AP 00:90:4b:38:e6:5c
[ 1365.060000] wmaster0: TX to low-level driver (len=30) FC=0x00b0 DUR=0x013a A1=00:90:4b:38:e6:5c A2=00:13:e8:08:8d:f5 A3=00:90:4b:38:e6:5c
[ 1365.060000] wlan0: RX authentication from 00:90:4b:38:e6:5c (alg=0 transaction=2 status=0)
[ 1365.060000] wlan0: authenticated
[ 1365.060000] wlan0: associate with AP 00:90:4b:38:e6:5c
[ 1365.060000] wmaster0: TX to low-level driver (len=53) FC=0x0000 DUR=0x013a A1=00:90:4b:38:e6:5c A2=00:13:e8:08:8d:f5 A3=00:90:4b:38:e6:5c
[ 1365.064000] wlan0: RX AssocResp from 00:90:4b:38:e6:5c (capab=0x401 status=0 aid=1)[ 1365.064000] wlan0: associated
[ 1365.064000] wmaster0: Added STA 00:90:4b:38:e6:5c
[ 1365.064000] wmaster0: TX to low-level driver (len=42) FC=0x0040 DUR=0x013a A1=00:90:4b:38:e6:5c A2=00:13:e8:08:8d:f5 A3=00:90:4b:38:e6:5c
[ 1365.064000] ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 1365.072000] wmaster0: TX to low-level driver (len=108) FC=0x0108 DUR=0x002c A1=00:90:4b:38:e6:5c A2=00:13:e8:08:8d:f5 A3=33:33:00:00:00:16
[ 1365.600000] wmaster0: TX to low-level driver (len=96) FC=0x0108 DUR=0x002c A1=00:90:4b:38:e6:5c A2=00:13:e8:08:8d:f5 A3=33:33:ff:08:8d:f5
[ 1366.600000] wmaster0: TX to low-level driver (len=88) FC=0x0108 DUR=0x002c A1=00:90:4b:38:e6:5c A2=00:13:e8:08:8d:f5 A3=33:33:00:00:00:02
[ 1370.600000] wmaster0: TX to low-level driver (len=88) FC=0x0108 DUR=0x002c A1=00:90:4b:38:e6:5c A2=00:13:e8:08:8d:f5 A3=33:33:00:00:00:02

FastCompany: Bosses and Real Bosses

Leadership: The Boss and the Real Boss got me thinking about some of the more (or less ) dysfunctional teams I have have been part of in the past and the formal or informal leadership roles that are often at play and impact team effectiveness.

What is interesting about my family is that we have all been given the same "bossy" gene. It skipped no one and each one of us is just as confident about his or her "rightness" as the next one. This year, nine of us traveled, and as usual, we stopped in Niagara on the Lake for the first night. My 10-year old son and his 17 and 14-year-old cousins, already fed up with the grown-up's bickering over the best route to the cottage, went into town, "to walk down the street of the last civilization they will see for a week." They are very dramatic! When they returned, they brought us a gift. It was two hats - one said THE BOSS and the other said THE REAL BOSS. They explained that every night at dinner we would designate a Boss and a Real Boss for the next day. The Boss would make the plan and if any disagreement or dissent erupted, then the Real Boss would step in to have the final word. Interesting.

Fortunately, I've forgotten most of painful details of bad experiences to blog about them, except to say that overhead groups that have no revenue requirements or operational responsibilities can be really fun (for a while) -- but can implode quickly and become sheer hell to work work in when these leadership get out of whack.

Early Returns: Franz: 1 VMWare+CARP+FreeBSD: 0

So running FreeBSD 6.2 CARP on VMWare Server is the subject of some confusion and struggling for me today. This closed CARP bug turned out to be a red herring and this VMTN thread made it seem that it was only possible to use CARP on ESX (if you enable promiscous mode on the virtual switch) and/or possibly with VMWare workstation with teaming. But I don't have admin privs on the ESX cluster. And I want to be able to do development and testing on my laptop and our VMWware Server.

On the drive home I remembered similar battle battle I faced a year ago working with the SCADA Honeynet where broadcast traffic (ARP Requests) were being forwarded to a virtual interface but the unicast was failing. Today pings to the CARP interface were failing even though I had an ARP entry on the host I was pinging from and of course the ICMP Echos were going out--but not making it to the virtual interface.

So it looks like once again loosening permissions on /dev/vmnet[0-9] is the solution to the problem.

i4965: Two Steps Forward, One Step Back

iwl4965:    with FH_INT = 0x00010000
iwl4965: REPLY_CT_KILL_CONFIG_CMD succeeded
iwl4965: REPLY_ADD_STA failed
iwl4965: no version for "release_firmware" found:  kernel tainted.
iwl4965: Intel(R) Wireless WiFi Link 4965AGN driv er for Linux, 0.0.35d
iwl4965: Copyright(c) 2003-2007 Intel Corporation
iwl4965: Detected Intel Wireless WiFi Link 4965AG N
iwl4965: Radio disabled by HW RF Kill switch

So with 2.6.21.5 + iwlwifi-0.0.35 and mac80211-9.0.0 and Linux Wireless Tools v 29 (you'll need the firmware from the Intel site as well) I was able to get to able to get the hardware detected, see a few access points, associate a couple of times, and oh yeah get kernel stack traces every time I tried to get a lease. I was surprised to see the kernel honored the "kill switch" on the front of the laptop.

Oh well, I'll try again next weekend. It's back to a wide open Aironet card when running Linux (God knows why WEP isn't working with the Aironet 352 and the Truemobile running OpenWRT). If you are in the neighborhood, you can have free wifi if you spoof the 3 MACs I have in the filter list (until I get WPA working I'll adopt the bonehead OpenBSD view (I need to find a better link, but that will do) that Wireless security protocols encourage a false sense of security) but I'm sure its much easier to hop on my neighbor's Linksys. Assuming they didn't close it down. But I've got fprobe running the OpenWRT box (as simple as ipkg install fprobe, very cool!) so I'm watching you :)

#  --- ---- ---- Report Information --- --- ---
#
# Fields:    Total
# Symbols:   Disabled
# Sorting:   Descending Field 1
# Name:      UDP/TCP destination port
#
# Args:      flow-stat -f 5 -S1
#
#
# port      flows                 octets                packets
#
80          223                   1012583               4549            
123         182                   21280                 280             
3000        132                   56380                 271             
443         20                    77666                 331             
2050        16                    42523                 239             
53          16                    15287                 239             
60321       7                     20647                 69              
22          7                     24766                 307             

Minor Rant on Fuzzing

Bejtlich's Pre Review triggered some painful memories. Back when I was a teacher, I ran across two types of really bad papers: those that were so bad they were funny and those are those that are so bad they made you angry, really angry -- because they were wasting your time.

Last year, I had the misfortune of serving as a technical reviewer for the new Addison Wesley Fuzzing book. The manuscripts I read clearly fell into the into the second category. It just wasn't worth the $750 (or whatever it was they were going to pay me) to provide feedback and fill out the little forms, so I eventually quit responding to emails from the editors and a deleted all the copies of manuscripts I had in my possession. Now, to be honest, it wasn't just that the manuscripts were a lost cause that I gave up the endeavor. I did have a lot on my plate: trying to get my house on the market in Austin, finish up some projects for my last job, and figure out where the hell I was going to live in Chicago--and move two kids and two dogs cross country, without losing any of them in Oklahoma. Which almost happened.

But if I thought the book had any hope of being useful I probably would have found the time. Unfortunately, from the table of contents, it doesn't look like they fixed the book's structural flaws. Not only the did conceptual sequence not make much sense to me, the audience and purpose were always a mystery. But maye that was maybe because I didn't ever see the first section. I was never sure if it existed? Was it be written last? There was no clear driving purpose linking the content. Was the book targetting professional application security teams (Software Security is an example of one of these, a very useful book) or just a quick way for 3rd rate independent researchers to find a bug or two. It appeared to be the latter, which to me was a pointless exercise. Why invest time in writing (let along reading) a book on the topic of vulnerability testing that does not go beyond what you could find by downloading tools from Packet Storm.

Lastly, I wonder if they cleaned up annoying colloquial writing style that sounded like a transcript of a bad Black Hat talk (except what I assume were Pedram's Amini's chapters, the were fairly well written and had some original content as well) but I guess I'll never know. I'd love to hear these problems were fixed, but I'm certainly not going to spend good money on finding out myself.

rtnetlink kernel link errors with Intel 4965 Drivers

In my last blog I mentioned some instructions I'd run across for building the Open Source Intel drivers for the i4965 that ships with Lenovo T-61s. I more or less followed the instructions but am still getting the follwing error:

net/wireless/wext.c: In function ‘rtnetlink_fill_iwinfo’:
net/wireless/wext.c:1136: warning: initialization discards qualifiers from pointer target type
  CC      net/wireless/core.o
  CC      net/wireless/sysfs.o
  LD      net/wireless/cfg80211.o
  LD      net/wireless/built-in.o
  LD      net/built-in.o
  GEN     .version
  CHK     include/linux/compile.h
  UPD     include/linux/compile.h
  CC      init/version.o
  LD      init/built-in.o
  LD      .tmp_vmlinux1
net/built-in.o: In function `rtnl_getlink':
rtnetlink.c:(.text+0x10c69): undefined reference to `wireless_rtnetlink_get'
net/built-in.o: In function `rtnl_setlink':
rtnetlink.c:(.text+0x11372): undefined reference to `wireless_rtnetlink_set'
make: *** [.tmp_vmlinux1] Error 1

Linux i4965 Wireless Preview on T-61

Last few days I confess I've mostly been using XP on my T-61 (hell I've mostly been working on a blasted Compaq DL-145 and FreeBSD through the lights out management software, which oddly enough Opera seems to work best with since it uses Java Applet for some VNC-ish looking thing for the remote KVM) but I ran across a Fedoraforum thread on getting the 4965 drivers working. It appears you will need iwlwifi and mac80211 and some microcode but it looks like it is now possible. Maybe I'll give it a shot.

SCADA, SIGINT, IW, and the PRC

It might be vain, but I look at my webserver logs occasionally. You never know who stumbles across your site with an interesting set of google search words. Like when 58.31.65.233 searches for pages with SCADA and SIGINT in them. Which reminds me of the amusing dailydave thread on IW (the one on responsibility and power). Of course any conversation that starts with the question about who has the best hackers is bound to go nowhere, fast. It doesn't matter whether the context is the information warfare capabilities of nation states, the real or perceived regional concentration of security expertise within a large networking, security consulting companies trying to win assessments, or DoE (or Batelle, it is a business, despite the national security angle) labs hyping their "cyber" credentials to secure mo money, mo money, and get those earmarks while they still can. It's all the same. It all ends badly with someone talking out of their ass.