RIP, Skype for Asterisk

Digium announced today the official end of Skype for Asterisk– ending anyone’s dream of a more friendly, open, Skype under Microsoft.

Their email, stated:

We expect that users of Skype for Asterisk will be able to continue using their Asterisk systems on the Skype network until at least July 26, 2013. Skype may extend this at their discretion.

The announcement of Skype and Asterisk came during Astricon 2008, a little less than 3 years ago. After almost a year, a beta program was announced with a pay per use licensing announced shortly thereafter.

The full announcement:

Product notification:

Skype for Asterisk will not be available for sale or activation after July 26, 2011.

Skype for Asterisk was developed by Digium in cooperation with Skype. It includes proprietary software from Skype that allows Asterisk to join the Skype network as a native client. Skype has decided not to renew the agreement that permits us to package this proprietary software. Therefore Skype for Asterisk sales and activations will cease on July 26, 2011.

This change should not affect any existing users of Skype for Asterisk. Representatives of Skype have assured us that they will continue to support and maintain the Skype for Asterisk software for a period of two years thereafter, as specified in the agreement with Digium. We expect that users of Skype for Asterisk will be able to continue using their Asterisk systems on the Skype network until at least July 26, 2013. Skype may extend this at their discretion.

Skype for Asterisk remains for sale and activation until July 26, 2011. Please complete any purchases and activations before that date.

Thank you for your business.

Digium Product Management

The Asterisk Development Team has announced security releases for the following
versions of Asterisk:

* 1.2.40
* 1.4.29.1
* 1.6.0.24
* 1.6.1.16
* 1.6.2.4

These releases are available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk/

The releases of Asterisk 1.2.40, 1.4.29.1, 1.6.0.24, 1.6.1.16, and 1.6.2.4
include documention describing a possible dialplan string injection with common
usage of the ${EXTEN} (and other expansion variables). The issue and resolution
are described in the AST-2010-002 security advisory.

If you have a channel technology which can accept characters other than numbers
and letters (such as SIP) it may be possible to craft an INVITE which sends data
such as 300&Zap/g1/4165551212 which would create an additional outgoing channel
leg that was not originally intended by the dialplan programmer.

Please note that this is not limited to an specific protocol or the Dial()
application.

The expansion of variables into programmatically-interpreted strings is a common
behavior in many script or script-like languages, Asterisk included. The ability
for a variable to directly replace components of a command is a feature, not a
bug – that is the entire point of string expansion.

However, it is often the case due to expediency or design misunderstanding that
a developer will not examine and filter string data from external sources before
passing it into potentially harmful areas of their dialplan.

With the flexibility of the design of Asterisk come these risks if the dialplan
designer is not suitably cautious as to how foreign data is allowed to enter the
system unchecked.

This security release is intended to raise awareness of how it is possible to
insert malicious strings into dialplans, and to advise developers to read the
best practices documents so that they may easily avoid these dangers.

For more information about the details of this vulnerability, please read the
security advisory AST-2010-002, which was released at the same time as this
announcement.

Asterisk 1.2.40 also contains a backported dialplan function called FILTER() in
order to allow the filtering of strings as described in the best practices
document.

It should also be noted that the 1.6.x series of Asterisk had release candidates
available as versions 1.6.0.23-rc2, 1.6.1.15-rc2, and 1.6.2.3-rc2. These will
either be released as 1.6.0.25, 1.6.1.17, and 1.6.2.5, or if another round of
RC changes is necessary, those versions numbers will be used with -rc1 appended.

For a full list of changes in the current releases, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.2.40
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.4.29.1
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.0.24
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.1.16
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.2.4

Security advisory AST-2010-002 is available at:

http://downloads.asterisk.org/pub/security/AST-2010-002.pdf

The README-SERIOUSLY.bestpractices.txt document is available in the top-level
directory of your Asterisk sources, or available in all Asterisk branches from
1.2 and up.

http://svn.asterisk.org/svn/asterisk/trunk/README-SERIOUSLY.bestpractices.txt

Thank you for your continued support of Asterisk!

Ty would be proud...

Are you ready? Tomorrow, Asterisk fans, fanatics, developers, users, and more will gather in Glendale, Arizona for AstriCon 2009. AstriCon, the official conference for Asterisk, runs from October 13 – 15.

This year, yours truly will speak (and very honored to do so) in a talk titled “Asterisk Applications – Unexpected Hurdles.”  (summary below)

But wait, there’s more…

Just in time for AstriCon, Digium pulled a Ty Pennington on the ol’ Asterisk website. It looks amazing. Just a great way to start the conference!

I’m extremely excited to be heading West and cannot wait to share the information learned. Get ready for a great show!

About Asterisk

Asterisk is free, open source software provided under the GNU General Public License (GPL). Asterisk is the most popular open source software available, with the Asterisk Community being the top influencer in VoIP.

Why free? It’s just how Digium rolls. They really take that GPL open source to heart.

For more information, please check out:

• Asterisk.org
• Digium, Inc.
• AstriCon.net

Summary of Fred’s talk:

With Asterisk AGI programming, almost anything is possible. From phone based payment systems to providing real-time information, Asterisk makes it possible to bring information to anyone with a phone. Sometimes, even the simplest applications can have unexpected consequences. Building a real-time Parking Garage availability application in Ann Arbor, Michigan was met with great appreciation by residents but blocked by government who didn’t understand how Asterisk gathered data — interpreting it instead as a Security risk. The talk would explain that when building even the simplest public application, the designers should be familiar with public access laws and be able to articulate how their application gathers data. Freedom of Information will also be discussed.

Skype for Asterisk Beta is a download that lets you integrate your Asterisk system with the Skype network.

With Skype for Asterisk, you can:

• Make Skype to Skype calls
• Call landlines, cellphones, even grandma!
• Receive SkypeIn calls
• Make multiple Skype calls simultaneously using the same Skype account
• Read Skype profile fields
• Support DTMF
• Set and retrieve online status
• Handle incoming Skype calls using your dialplan
• Use the Asterisk PBX for voice and the Desktop for IM
• And much more!

And you can do this all from your Asterisk PBX!

Ordinary Skype is a mess. You need your desktop and some sort of sound equipment just to make a call. Crazy. Skype for Asterisk Beta has the muscle to use your phone system directly with the Skype network. Use Skype for Asterisk Beta to provide an IVR or Sales portal for your company. You can use Skype for Asterisk Beta at home while watching TV. You can even use Skype for Asterisk Beta to send your Skype calls to one central voicemail.

Whether your Skype needs are large or small, Skype for Asterisk Beta can handle it all. Skype for Asterisk Beta is free, so it pays for itself.

Through Digium’s exclusive Beta offer you can download Skype for Asterisk Beta at the very low price of Free.

But wait, there’s more!

Skype for Asterisk Beta is a limited time offer. You have to act now to download and register the software. Skype for Asterisk Beta can only be downloaded until August 7th and used until August 31st. And of course, being beta, there’s some betaness to contend with.

So act now and download the Skype for Asterisk Beta software today directly from Digium.

(In case you hadn’t guessed, this is also our homage to Billy Mays.)

Here’s what Digium’s John Todd posted:

I know many of you have been waiting for this for a while, so I’ll  keep this short:  The Skype for Asterisk Public Beta is now available on the Digium store.

We are pleased to announce the open beta of Skype For Asterisk is ready to begin and we look forward to you participation. To obtain your copy of the software, please visit Digium’s web store and purchase (for zero dollars) the Skype For Asterisk product. The web store does require a Digium.com account, which can be set up during the purchase process if you don’t already have one. Once the web store process is complete, you will be e-mailed your license key and directions on where to download Skype For Asterisk beta software.

This is a “time-expiring” beta – the software will stop working on August 31.  The download is also currently time-limited – it will be available until August 7 on our website.  After the 31st, you would need to have purchased a license for the SfA software (sorry, no pricing that I can give you right now – that will be a separate announcement.  I’m just the community guy – I have no idea about pricing or commercial contracts or the like, so please wait until that’s been announced as I will find out about the same time as you do.

Trial “purchase” page:
http://store.digium.com/productview.php?product_code=804-00019

JT

While you’re downloading Skype for Asterisk, read Michael Grave’s post over at Graves On SOHO VoIP.

When I first started working with VoIP, I began to hate telephony, and any and all things telephone related. This bothered me on many levels. You see, as a kid, I loved telephones. Growing up in the “big city,” pay phones seemed to be on every corner. Family stories talk about walking several blocks extra, just to avoid me seeing and wanting to play with a phone. But, as usual, I digress…

When I worked with an unnamed switch (let’s just say it rhymed with Broadmoft), I hated working with VoIP. I knew there had to be a better way and started playing with Asterisk. Soon, my memories of playing with phones started coming back and my love rekindled. Now, I look forward to working with phone systems, only because I truly feel that the use of a phone can only be limited by your imagination. And with companies like Twilio, Adhearsion, and Digium, the community of telephone developers seems only to grow.

With that long winded introduction, let’s discuss today’s topic — telemarketer torture. I, like every other person I know, receives the random yet continual undesired telemarketer call (yes, I’m on the DND databases and let’s not get into that). Thanks to Asterisk, I can send my telemarketers to a little place I call the Annoyatron.

Now, many developers and users implement their own version of Telemarketer Torture. Some like using IVR’s. Some like endless ringing. Personally, I like to keep them on the line for a long time. You see, since I add numbers to the Annoyatron after they call me, by the time they reach the Annoyatron they have already called and wasted my time at least once before. So, instead of just having them hang up and move on to the next home, I like to see if I can keep them talking for a while. My Goal? At least 2 minutes.

I use Asterisk’s “WaitForSilence” command to keep my torture conversational. When there’s a pause, the Annoyatron will play a file. While the telemarketer speaks, the Annoyatron will patiently wait. You put it all together, and wala — the Annoyatron Telemarketer Torture.

Today, I received unwanted calls regarding long distance to India. I added the number to the Annoyatron and well, the results of their continued calls no longer annoy me. Here are two examples:

Listen to Call 1:
Download audio file (annoyatron.mp3)
(or you can download the MP3)

Listen to Call 2:
Download audio file (annoyatron2.mp3)
(or you can download this MP3, too)

Ok, so here’s an example of how you would write the dialplan in Asterisk:

[annoyatron]
exten => s,1,Answer()
exten => s,n,Wait(2)
exten => s,n,Playback(annoy/annoy-hello)
exten => s,n,WaitForSilence(2200)
;...
; record a file for "your side" of the conversation
; wait for silence, and then play it
; lather rinse repeat
;...
exten => s,n,Hangup()

Simple, no? Just one of the reasons Asterisk allowed me to enjoy working with telephones. Awwww.

We’d love to hear about your fun examples with Asterisk. And you know, Leif Madsen is requesting some ideas for Asterisk Recipes himself.

Asterisk is free, open source software provided under the GNU General Public License (GPL). Asterisk is the most popular open source software available, with the Asterisk Community being the top influencer in VoIP.

Why free? It’s just how Digium rolls. They really take that GPL open source to heart.

In case any of you were wondering why there has been a fairly notable upswing in the attacks happening on SIP endpoints, the answer is “script kiddies.”  In the last few months, a number of new tools have made it easy for knuckle-draggers to attack and defraud SIP endpoints, Asterisk-based systems included.  There are easily-available tools that scan networks looking for SIP hosts, and then scan hosts looking for valid extensions, and then scan valid extensions looking for passwords.  You can take steps, NOW, to eliminate many of these problems.  I think the community is interested in coming up with an integrated Asterisk-based solution that is much wider in scope for dynamic protection (community-shared blacklists is the current thinking) but that doesn’t mean you should wait for some new tool to defend your systems.  You can IMMEDIATELY take fairly common-sense measures to protect your Asterisk server from the bulk of the scans and attacks that are on the increase. The methods and tools for protection already exists – just apply them, and you’ll be able to sleep more soundly at night.

Seven Easy Steps to Better SIP Security on Asterisk:

1) Don’t accept SIP authentication requests from all IP addresses. Use the “permit=” and “deny=” lines in sip.conf to only allow a reasonable subset of IP addresess to reach each listed extension/user in your sip.conf file.  Even if you accept inbound calls from “anywhere” (via [default]) don’t let those users reach authenticated elements!

2) Set “alwaysauthreject=yes” in your sip.conf file.  This option has been around for a while (since 1.2?) but the default is “no”, which allows extension information leakage.  Setting this to “yes” will reject bad authentication requests on valid usernames with the same rejection information as with invalid usernames, denying remote attackers the ability to detect existing extensions with brute-force guessing attacks.

3) Use STRONG passwords for SIP entities.  This is probably the most important step you can take.  Don’t just concatenate two words together and suffix it with “1″ – if you’ve seen how sophisticated the tools are that guess passwords, you’d understand that trivial obfuscation like that is a minor hinderance to a modern CPU.  Use symbols, numbers, and a mix of upper and lowercase letters at least 12 digits long.

4) Block your AMI manager ports.  Use “permit=” and “deny=” lines in manager.conf to reduce inbound connections to known hosts only.  Use strong passwords here, again at least 12 characters with a complex mix of symbols, numbers, and letters.

5) Allow only one or two calls at a time per SIP entity, where possible.  At the worst, limiting your exposure to toll fraud is a wise thing to do.  This also limits your exposure when legitimate password holders on your system lose control of their passphrase – writing it on the bottom of the SIP phone, for instance, which I’ve seen.

6) Make your SIP usernames different than your extensions.  While it is convenient to have extension “1234″ map to SIP entry “1234″ which is also SIP user “1234″, this is an easy target for attackers to guess SIP authentication names.  Use the MAC address of the device, or some sort of combination of a common phrase + extension MD5 hash (example: from a shell prompt, try “md5 -s ThePassword5000″)

7) Ensure your [default] context is secure.  Don’t allow unauthenticated callers to reach any contexts that allow toll calls. Permit only a limited number of active calls through your default context (use the “GROUP” function as a counter.)  Prohibit unauthenticated calls entirely (if you don’t want them) by setting “allowguest=no” in the [general] part of sip.conf.

These 7 basics will protect most people, but there are certainly other steps you can take that are more complex and reactive.  Here is a fail2ban recipe ( http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk ) which might allow you to ban endpoints based on volume of requests.

If you’d like to see an example of the tools that you’re up against, see this demo video (http://enablesecurity.com/products/enablesecurity-voippack-sipautohack-demo/) of an automated attack tool that does scan, guess, and crack methods via a click-and-drool interface.

In summary: basic security measures will protect you against the vast majority of SIP-based brute-force attacks.  Most of the SIP attackers are fools with tools – they are opportunists who see an easy way to defraud people who have not considered the costs of insecure methods. Asterisk has some methods to prevent the most obvious attacks from succeeding at the network level, but the most effective method of protection are the administrative issues of password robustness and username obscurity.

JT

Check out John Todd’s blog post at Digium.

About Digium

Digium, Inc., the Asterisk Company, created, owns and is the innovative force behind Asterisk, the most widely used open source telephony software. Since its founding in 1999, Digium has become the open source alternative to proprietary communication providers, with offerings that cost as much as 80 percent less. Digium offers Asterisk software free to the open source community and offers Asterisk Business Edition and Switchvox IP PBX Software to power a broad family of products for small, medium and large businesses. The company’s product line includes a wide range of hardware to enable resellers and customers to implement turnkey solutions or to design their own voice over IP (VoIP) systems. More information is available at www.digium.com.

A few months back, we posted a nice little article on using Asterisk to get Parking Space Availability from Ann Arbor garages. The response from the VoIP community was fantastic! We received great comments and feedback from people like Jason Goecke, Dug Song, Dave Michels, Evan Cooke, and more! People not only responded, they even showed different ways of providing access to this information. And everyone shared their work in an open forum — truly a great example of open source coding inspiring innovation (albeit with Parking Spaces).

Even better was the local response in Ann Arbor. Edward Vielmetti and Fred Posner were interviewed in the local papers, appeared on a radio show, and even rode the teeter totter. Everyone loved the idea of being able to check on parking space availability… everyone except for the DDA (insert scary music).

The DDA (Ann Arbor Downtown Development Authority), funded by tax dollars,  “provides a diversity of transportation and parking options to meet downtown’s [Ann Arbor’s] ever-changing needs.” The DDA does not like us making information of parking spaces available to the public via phone. Instead, the DDA wants to control this information. Seriously, they want to control parking space availability information.

Tyler Erickson helped Edward Vielmetti and Fred make this project even more fascinating by tracking parking space availability over time. The plan was to provide predictability of availability. For example, “We’re sorry, the lot at 4th and Washington is currently filled, we predict the parking lot will be available in 7 minutes. Press 1 to be notified…”

Wouldn’t that be neat? We thought so… The DDA’s response was to block Tyler’s access. Of course, since it was using Google Apps, it blocked Google, but that’s another story. We inquired as to why this blockage occurred and… well enter Susan Pollay. Susan Pollay is Executive Director of the DDA. She told us (and remember, this is a tax funded organization):

“Hi all.   Over the last day or so I have talked about your project with a few DDA members and what arose from these conversations was a shared concern that because the project was not an initiative created by/run by the DDA there are no controls in place for this at present.  For instance, there is no DDA policy about how to allow /or even if it should allow an outside group to use the DDA’s parking data for a private enterprise.  There is a concern about how unsecure/secure the DDA website is made when sharing this data.   And finally, a concern that if the project had value to parking patrons, that the DDA itself should consider providing this service as an extension of what it is already doing on-line.”

Interesting… but the story doesn’t stop there. Due to real-life concerns of all of us, we kind of let this project move to the back burner. But then, two days ago Edward Vielmetti noticed the DDA website was no longer publishing real-time parking information. The response from Susan Polly follows:

From: Susan Pollay
Subject: RE: DDA real time parking data via web is not working // was Fwd: parking app busted again
Date: March 12, 2009 11:36:56 AM GMT-04:00
To: Sabra Briere, Edward Vielmetti
Cc: Margie Teall, Christopher TaylorC, Carsten Hohnke, Fred Posner, Tyler Erickson

Many thanks for this and other emails.  The DDA became aware of Mr. Vielmetti’s project after reading about it in the press.   Immediately a number of concerns were expressed including 1) no permission from the DDA was granted before this project got underway, 2) this project hopes to sell this software to other communities and thereby make a profit and is using DDA-generated information to accomplish this, 3) the DDA has no control over what is done with this information yet this information is attributed to the DDA, 4) persons interested in finding out about parking structure vacancies must make a toll-call out of state.

The DDA Operations Committee met and discussed these concerns.  Their resolve was to provide information by phone to interested members of the public using real human beings answering phones at the Republic Parking office.

There are several benefits to the public with this arrangement.  1) Republic Parking staff members can provide the follow up information that an automated system can’t.  e.g. You call to find out if there are vacancies at 4th & Washington – and if there are no vacancies or very few, Republic Parking staff can suggest a nearby convenient alternative parking location.  They can give directions to the parking structure.  They can provide information like yes, they do take credit cards.    The automated system only tells you there are 0 spaces available.      2) Republic Parking staff members can keep track of how many people are calling, what structures they call about most often, the follow up questions, etc.   This way if we ever decide to acquire an automated phone system we know how to prioritize and provide the information most sought after by patrons.  The DDA would have retrieved none of this information from Mr. Vielmetti.       And finally 3) a call to Republic Parking is not a toll call.  It is a local office, staffed 24 hours a day, 6 days a week (Sundays all facilities are open and unlikely there are vacancy concerns).

Thanks again for contacting me.  I hope to be helpful, so please let me know if I can answer any additional questions about this…..

Best wishes.

Susan

WOW!

Fred’s response follows:

From: Fred Posner
Subject: Re: DDA real time parking data via web is not working // was Fwd: parking app busted again
Date: March 12, 2009 4:13:08 PM GMT-04:00
To: Susan Pollay

Good afternoon,

First, my apologies to Tyler and Carsten. They both wrote exceptional, professionally toned replies. I, however, am so appalled at this email, that I must speak directly to the points mentioned.

Susan, the DDA is funded by tax dollars and parking fees. Perhaps you have forgotten that public money is used to fund the DDA’s mission to serve the public?  Allow me to introduce you to the concepts of open government and “public domain.” I don’t want to waste everyone’s time here, but please read up on these concepts so we can be on the same page.

Lets take your first point:

“No permission from the DDA was granted before this project got underway”

What permission should we have gotten? The DDA publishes parking space availability on the internet and on big, bright signs attached on garages. Do you believe that this is classified information that should be controlled by the government? If I asked someone if they knew how many spaces were available, should they say to me “I’m sorry Fred, I don’t have specific permission from the DDA to release that information.” Should people who release this information be considered enemies of the state and locked in Guantanamo Bay?

The bottom line here is that to horde this information is ridiculous. Let’s forget the tax/government/information aspect for a second. Even if this were private parking, I could never imagine an organization that would say… “Hey, I don’t want people to know that I have spaces available. They might come give money to park here.” An example of this is movie theaters. Movie theaters regularly welcome people announcing availability of shows and times. Why? Because they want to fill the seats. And if the seats are full, they want to let people know so they will plan to come back at a time when there is availability. With this in mind, there are many, many private companies that assist movie theaters with publishing this information on websites and phones.

This translates well to Ann Arbor Parking. I’m sure the citizens that you serve would like access to information. I’m also certain that the businesses would like people to know that parking is available. And, I’m certain they want a lot of access to that information. After all, no one suffers from having too much access to the same information. But the DDA response was completely the opposite. You actively stopped us from getting this information by blocking IP’s (such as google application server) and changing the format of the information.

In regards to needing your permission, I say simply, “You’re wrong. Either the information is public information on the public internet and public signs, or it’s private information that should be properly secured. Your idea that this public information must be secured is wrong. The idea is wrong, the approach is wrong, and the underlying ideology is wrong.”

Let’s look at point number 2:

“this project hopes to sell this software to other communities and thereby make a profit and is using DDA-generated information to accomplish this”

Wrong. Simply wrong. And your saying this is borderline libelous. Ed, Tyler, and I did this project to provide information. No money was thought of, and as a matter of fact, it cost me money to provide phone service for the beta project. Not only did we do this work for FREE, we also published the work, the source, and the methods online. We published the code we wrote and entered it into the public domain.

You know what happened when we did this? Others wrote similar code and also published it online. A discussion of open sharing of information took place with some very big names in the VoIP (voice over Internet) industry. We all shared code and provided public information to our work. Sadly, private companies and individuals are willing to share information, but the public DDA is not… that seems backwards, no?

Take a look at the post written on VoIP Tech Chat and the discussion that followed:

http://www.voiptechchat.com/voip/218/use-asterisk-cepstral-and-perl-to-get-parking-and-weather-updates/

Point number 3:

“the DDA has no control over what is done with this information yet this information is attributed to the DDA”

Ok. When I was in third grade I had to write a report where I researched information and cited my sources. I attributed the information I learned and gave credit to the source so that others could also get that same information. This “marvel” concept of citing sources is still used today.

I must ask, what control of this information is needed? “My goodness, it’s crazy. I can’t believe it… with this parking space availability information… I can unlock the secret to who killed Kennedy!!!! Eureka!”

Sarcasm aside, the thought of government controlling information means the end of freedom. Information is for people and there’s a reason why people need access to information. If you have thoughts of controlling information, please leave government. Also, citing the source of information is not a problem, it’s actually proper, responsible, and good practice.

Point number 4:

“persons interested in finding out about parking structure vacancies must make a toll-call out of state.”

Wrong. At one point, I had this project linked to a 212 number. Why? Because I could support unlimited callers at that number. I did this at a cost of 1.5 cents per minute from my pocket. It took me two weeks, but we received a local Ann Arbor number capable of having more than 2 simultaneous calls. So for a brief 10 day period, you needed to dial 212. Then you could dial 734. We released this information online, over the radio, and to newspapers… So basically, since January 20th, you’re wrong (and we really didn’t make this live until January 10th).

But let’s take this a step further… and say “So what?” Right now the DDA releases this information only online at at the garage. If people want to make this available via SMS, Phone, Twitter, Facebook, Smoke Signal, Tea Leaves, or whatever communicative method one can imagine, it’s simply another way to access the same information. After all, no one suffers from having too much access to the same information.

So, not only is there a local number, it shouldn’t matter if there wasn’t. I truly see implementing a Detroit number, maybe Toledo, Grand Rapids… and more. Could you imagine the possibility of people from another area calling a local number (for them) to visit Ann Arbor? I can… and wow, that would be great.

Benefit number 1:

“Republic Parking staff members can provide the follow up information that an automated system cant.  e.g. You call to find out if there are vacancies at 4th & Washington  and if there are no vacancies or very few, Republic Parking staff can suggest a nearby convenient alternative parking location.  They can give directions to the parking structure.  They can provide information like yes, they do take credit cards.    The automated system only tells you there are 0 spaces available”

Our system not only can do all this, it can do more. Our system can speak many languages. Our system won’t call in sick. Our system doesn’t have attitude, ever. And here’s the best part… Our system doesn’t only say there are “0″ spaces available. Our system actually calls you back when spots are available. Our system will also call you back when there are no more spots available. Are you going to have Republic Parking do that? Our system can give instructions, make recommendations, provide hours, and do much more than a staffed person and it costs you… nothing. No benefits, no salary, no cost, and yet more service.

Benefit number 2:

“Republic Parking staff members can keep track of how many people are calling, what structures they call about most often, the follow up questions, etc.   This way if we ever decide to acquire an automated phone system we know how to prioritize and provide the information most sought after by patrons.  The DDA would have retrieved none of this information from Mr. Vielmetti.”

We keep track of this information. Any time you want it, all you have to do is ask. Unlike the DDA, Mr. Vielmetti, Mr. Posner, and Mr. Erickson have demonstrated an ability and willingness to share information.

Final Benefit number 3:

“a call to Republic Parking is not a toll call.  It is a local office, staffed 24 hours a day, 6 days a week (Sundays all facilities are open and unlikely there are vacancy concerns).”

A call to Republic Parking can be a toll call for many of the users who travel from out of town or are students here in Ann Arbor  but I already addressed that above. Our system is a local call to Ann Arbor right now which you imply otherwise. Also, our system is open 24/7 and yes, you do have some availability problems on Sunday… well at least we could see that when you weren’t blocking access to the information.

Sometimes it helps to have other people look at information, this way we can assist you when you make incorrect statements. Your statement is a PERFECT illustration of why open access to information is needed. Open access to information corrects statements that interpret information incorrectly.

In closing…

Right now I wear two hats. I’m both a Florida Resident and am renting in Pittsfield Township. I also own a small business. After watching these Jeff Daniels’ commercials promoting the benefits of doing business in Michigan, I was very seriously considering moving my business from Florida to Michigan. However, dealing with the DDA has really opened my eyes.

You see, I’ve worked for the government. And say what you want about Florida, we take public access to government very seriously in the Sunshine state. We have what is called the Sunshine Law that provides both criminal and civil penalties when public access is restricted. It’s a great law, and perhaps needed here as well. You see, I believe, as many others do, that in a government of the people and by the people, that information belongs to the people. Government agencies, such as the DDA, should help get information to the public, not wish to control it.

The thought of the DDA requiring permission to access public information and / or control information is not only a scary thought; it’s absolutely anti-American. After all, no one suffers from having too much access to the same information.

A personal hero of mine has always been Benjamin Franklin, and I leave you with this:

“Never trust a government that doesn’t trust its own citizens…”

Fred Posner

PS…

Wonder why the phone number can’t tell you the available spaces? We are specifically blocked and forbidden to access their website. Here’s the page we get:

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access /parking__transportation/available_parking_spots/
on this server.</p>
<hr>
<address>Apache/2.2.4 (Unix) mod_ssl/2.2.4 OpenSSL/0.9.7a DAV/2 mod_jk/1.2.20 PHP/5.2.1 Server at a2dda.org Port 80</address>
</body></html>

Welcome to the new world order.

Here’s the information, directly from the source:

Asterisk is becoming more and more a choice for larger installations, both in Enterprise as well as Carrier environments.  While SMB (small/medium business) continues to be the heart of the user base, it seems that many of the questions on the minds of the user and developer community have to do with scale, redundancy, and configuration issues which are relevant to larger installations.

To encourage the improvement and testing of larger-scale Asterisk systems, I’d like to repeat here what I mentioned today on the asterisk-dev mailing list:  I’m putting out a semi-official challenge in place.  The first person to get an Asterisk system moving 10,000 G.711 call legs through a single instance on a single machine will get a first-class steak dinner at Astricon.  And a great bottle of wine, if that is your preference.

This isn’t an X-prize, but the concept is the same – think of it as an S-prize.  ”S” means “Steak”.  Or maybe “Salad” if you’re a vegetarian. 

There are some serious hurdles here, for both software and hardware.  Ten thousand channels sounds like a lot, and it is.  But it can be done, and is already done with custom hardware from closed-source vendors.  Open Source Asterisk has not been (to my knowledge) tested at anywhere near that capacity, though attempts have been made in the thousands of channel level ranges with good successes.  However, there are significant “walls” to climb between ~2500 channels and 10000 channels, and this is not merely a linear application of processing power.  Just the throughput for this 10k challenge is pretty impressive: 500k packets per second per direction at 20ms, and 820mbps per direction.  Ethernet trunking/bonding may be required to overcome IRQ issues, or certainly very close administration of a gigabit interface.  Operating system tuning will be required in conjunction with Asterisk tuning (and probably patching.)  Documentation on how you achieve this will help everyone, and this is an “open” challenge.

I know that the Asterisk community is already headed in the direction of making these kinds of advances.  This is merely an incentive to speed up the process, and hopefully get some discussion going as to how people might solve the problems both in the Asterisk implementation as well as on the systems which are required to handle that kind of throughput.  Everyone benefits from the effort, and I think it can be done with some concentration and clever design.

Will there be some other platform that makes it there first, or has someone already reached that number?  Maybe!  I think any work done towards improving VoIP RTP throughput on Linux systems at these high packet-per-second rates will benefit everyone, especially if it’s an Open-Source solution that reaches the goal first.

Small print: one winner, even if a group effort – choose amongst yourselves. Group members may get secondary prizes.  Prize dinner will be at the following Astricon, in whatever city that is holds Astricon that year. Equipment must be “off-the-shelf” gear.  Software must be Asterisk from SVN, or patched with code that has been submitted to the bugtracker with a valid submission agreement for inclusion into Asterisk.  MOS of audio channels must be at least 3.2 or better (subjective.)  Calls must be standard G.711 with 20ms or 10ms sample intervals.  All RTP (RX,TX) for all channels must be routed through a single instance of Asterisk.  Methods must be documented and reproducible by other community members or Digium with the same equipment.  Winner will be publicly cheered.  Dinner to be at Mortons, Ruth’s Chris, or comparable venue.  10,000 call legs is equivalent to 5,000 “hairpin” calls, though 10,000 calls to “Echo()” would be acceptable.  Substitutions are possible.  SIP, IAX2, or H.323 are acceptable protocols.

And there you have it. Are you game? A steak dinner at Astricon will certainly not compare to a million dollars, but it does deliver some pretty amazing bragging rights.

What you VoIPing 'bout Willis?

Yes, you guessed it correctly. In today’s article, Diff’rent Strokes will be used as a metaphor for VoIP. Why? The correct question is “Why Not?” And the answer… well that’s simple — Diff’rent Strokes is the perfect metaphor. Take for example these classic lines from the show’s theme song:

Now, the world don’t move to the beat of just one drum,
What might be right for you, may not be right for some.

Classic. Pausing for Trivia… do you know which 80’s sitcom star wrote these lyrics? If you said Growing Pains actor and Canadian sensation Alan Thicke, you’d be right… but, as usual, we digress.

Those working within VoIP, and contrary to many medical reports there are people still working in the industry, have many flavors and styles of VoIP products to choose from. Although opinions vary, there really is no “right” or “wrong” product line. Selecting your VoIP implementation is an individual choice that is determined simply by what works best for you.

Asterisk versus FreeSWITCH versus Closed Source

Asterisk, by Digium, provides full PBX (private branch exchange) functionality in a (reasonably) small footprint, software package. Created by Mark Spencer in 1999, Asterisk provides itself to the VoIP community free of charge through the GNU General Public License. Asterisk does not require “per seat” licensing fees, maintains a very active community of developers, and requires no additional hardware for a strict VoIP deployment (although grabbing a Digium hardware card to connect to the PSTN makes this software very versatile).

FreeSWITCH, also an open source telephony software program, was developed after Asterisk, by people actively engaged in the Asterisk community. Much like the Facts of Life spun off from Diff’rent Strokes, FreeSWITCH developers thought that new software would be better for telephony; based on their experiences working with Asterisk. They worked hard and created a system that more suited their needs — and like Digium, they have shared this software with the world. The FreeSWITCH site posts a well-written, detailed explanation of “How does FreeSWITCH compare to Asterisk?” on their website (and keeping with the Facts of Life theme… FreeSWITCH approached the software with a “you take the good, you take the bad” approach).

Closed source systems, such as Broadworks, Cisco Call Manager, and Nortel IP Telephony solutions also provide VoIP software and hardware. Closed source systems pride themselves on providing “carrier” class solutions with dedicated support personnel. They also offer licensing fees, fancy logos, and lots of printed documentation.

So which is the best choice? 

Remember: “The world don’t move to the beat of just one drum.”

Choosing a VoIP solution demands thought. Yes, Virginia, you truly have to warm up the water and boil the brain noodle for a while. Is Asterisk best suited for this deployment? Brian West would say that FreeSWITCH would be better in all situations. Others would say, “Hey, use Cisco in large deployments” (although Sam Houston State University might say otherwise).

There simply is no right or wrong answer. As long as you keep well informed of the products out there, the different tools available, and can approach your needs by selecting from your set of tools, you’ll be making the right choice. Fred uses Asterisk. Why? It works for him, and he’s comfortable with it, and he can deploy solutions quickly. Others use FreeSWITCH for the same reason. And who’s right? Simply put, everyone is.

This same discussion can be applied to coding within the VoIP platform of your choice. Recently, when we discussed using Asterisk, Cepstral, and Perl to Get Parking and Weather Updates, we received many, many comments from people with different approaches.

Dug Song commented how Twilio could be used in this situation while Jason Goeke demonstrated how Adhersion could also be used. Within the comments we can see that some coders like jumping into the programming interface (and staying there) whereas Fred likes the “get in, get out” approach and stay in the Asterisk dial plan as much as possible.

So, again, who is right?

We turn once more, to the wise Alan Thicke and Diff’rent Strokes:

Everybody’s got a special kind of story
Everybody finds a way to shine,
It don’t matter that you got not a lot 
So what,
They’ll have theirs, and you’ll have yours, and I’ll have mine.
And together we’ll be fine…
Because it takes, Diff’rent Strokes to move the world.
Yes it does.
It takes, Diff’rent Strokes to move the world.

roll credits

VoIP is Fun

Patrick and Fred eat, breathe, and live telecommunication. So, when the chance to make fun little phone applications come around, we like to jump on it. Recently, while discussing parking issues with Ann Arbor’s Edward Vielmetti, and idea came to mind. Mr. Vielmetti is active within the Ann Arbor community and among the many hats he wears, one seeks to provide access to accurate information concerning downtown transportation and parking (wow that was a mouthful). While discussing the lack of accurate bus information in Ann Arbor, the conversation took a tangent (yes, how odd that conversations with Fred or Patrick take tangents) on the area of parking.

The parking garages in Ann Arbor provide nice signs in front displaying in brightly lit numbers, the amount of available spaces remaining. Ann Arbor also posts this information on the web at the A2DDA website. An idea came to mind that basically, you can tell the available spots either from the website or right when you reach the garage — but what if you wanted to know while driving to the garage?

So, with that long introduction, we present “using asterisk, cepstral, and perl to get parking and weather updates.” Ok, for the non-techs, don’t panic! We’ll talk about the techie stuff in a little bit. The bottom line is using Asterisk, Cepstral, and Perl, you can check the internet for the spaces available and let the caller know — all in real time. For a working example, call +1 (212) 937-7844 and press 6 +1 (734) 272-0909 (this is not a toll-free number).

First, let’s talk about the three major components here: Asterisk, Cepstral, and Perl.

Asterisk

Asterisk (by Digium) is the world’s leading open source telephony engine and tool kit. Asterisk empowers communication with it’s flexibility. Whether working as a simple office telephone system, a robust Call Center platform, or anything in-between, Asterisk provides advanced features at a very low deployment cost.

Asterisk is free, open source software provided under the GNU General Public License (GPL). Asterisk is the most popular open source software available, with the Asterisk Community being the top influencer in VoIP.

Why free? “It’s just how Digium rolls.” They really take that GPL open source to heart.

Cepstral

Cepstral provides speech technologies and services for the spoken delivery of information. They build high quality, natural sounding voices for hand-held, desktop, and server applications. Their technology is easy to incorporate and operates in a small memory footprint with low computing resources. Cepstral is not free, however a full user’s license can cost under $30.00 (as of January 2009 at least).

If you are looking for a free alternative to Cepstral, try Festival. Festival is free, but sounds very “machine” like. Cepstral is a little more human.

Perl

Perl is a stable, cross platform programming language. Perl is open-source and is sometimes called the “duct tape of the internet.” If MacGyver programmed, he would have used Perl.

Ok, with our introductions in hand, let’s get on with the show. First step was to get the information from the A2DDA website using a perl script. the perl code for that was:

my $ua = LWP::UserAgent->new( timeout => 45);
my $URL = 'http://www.a2dda.org/parking.php';
$ua->agent('AsteriskAGIQuery/1');
my $req = new HTTP::Request GET => $URL;
my $res = $ua->request($req);
if ($res->is_success()) {
 if ($res->content =~ /4th and Washington</td><td>(.*)</td></tr>/) {
  my $spaces = $1;
  if($spaces =~ m/(d+)/) {
			$spaces = $1;
			return $spaces;
		}
 }
}

Sure, it could be nicer, but it works.

Ok, next was to resign the script so that it would work with the Asterisk AGI (the gateway interface of Asterisk). We modified the script slightly to read the amount of parking spaces at 4th and Washington and if we’re unable to get a number, report an ERROR.

#!/usr/bin/perl -w
use strict;
use LWP::UserAgent;
$|=1;
sub trim($);

my %AGI;

while(<STDIN>) {
	chomp;
	last unless length($_);
	if (/^agi_(w+):s+(.*)$/) {
		$AGI{$1} = $2;
	}
}

print qq(VERBOSE "STATUS: checking a2dda.org for spaces available" 2n);

my $spacesavail = "";

if ($spacesavail = &parking_lookup) {
	print qq(VERBOSE "There are $spacesavail spaces at 4th and Washington" 2n);
	print qq(SET VARIABLE SPACESAVAIL "$spacesavail"n);
	exit(0);
	}
else {
	print qq(VERBOSE "STATUS: unable to determine spaces" 2n);
}

print qq(SET VARIABLE SPACESAVAIL "ERROR"n);
exit(0); 

sub parking_lookup {
  my $ua = LWP::UserAgent->new( timeout => 45);
  my $URL = 'http://www.a2dda.org/parking.php';
  $ua->agent('AsteriskAGIQuery/1');
  my $req = new HTTP::Request GET => $URL;
  my $res = $ua->request($req);
  if ($res->is_success()) {
  		if ($res->content =~ /4th and Washington</td><td>(.*)</td></tr>/) {
      my $spaces = $1;
      if($spaces =~ m/(d+)/) {
							$spaces = $1;
							return $spaces;
						}
     }
  }
  return "";
}

Now, we have a number of available spaces, and integrating it was as easy as:

exten => s,1,NoOp(checking parking)
exten => s,n,playback(/tmp/spaces-greet)
exten => s,n,AGI(getspaces.pl)
exten => s,n,GotoIf($["${SPACESAVAIL}" = "ERROR" ]?error)
exten => s,n,SayNumber(${SPACESAVAIL})
exten => s,n,playback(/tmp/spaces-avail)

So why do we need Cepstral?

Good question! During testing of the script, we noticed that the number of spaces was always 130. No matter what we did, we kept getting back 130. Fred was pulling out what little hair he has… checking the asterisk… checking the code… couldn’t figure it out. Then, after checking the website, realized that Ann Arbor’s garages weren’t updating the spaces available. Perhaps a glitch, perhaps they don’t care, perhaps the information is being held hostage. No one knows for sure, but as of this moment, it’s pinned at 130.

Anyway, so enter Cepstral. Since the parking spots wouldn’t change, maybe the weather would. So, using another script to check the weather, you can modify the results and create a sound file using Cepstral (and swift), such as:

my $hash = "";
$hash .= ('0'..'9', "a".."f")[int(rand(16))] for 1 .. 8;

my $text = qq(Currently <break strength="weak" /> it is $currtempf degrees <break strength="weak" /> in $city <break strength="medium" /> Current conditions <break strength="weak" /> $currcondition <break strength="medium" /> Rest of day predicts <break strength="weak" /> $todaycond <break strength="medium" />);

my $sounddir = "/tmp";
my $wavefile = "$sounddir/"."tts-$hash.wav";
my $wavefileAst = "$sounddir/"."tts-$hash";
my $t2wp= "/opt/swift/bin/"; 

unless (-f $wavefile) {
       open(fileOUT, ">$sounddir"."/say-text-$hash.txt");
       print fileOUT "$text";
       close(fileOUT);
							my $execf=$t2wp."swift -f $sounddir/say-text-$hash.txt -p audio/channels=1,audio/volume=70,audio/sampling-rate=8000,audio/deadair=2 -o $wavefile";
       system($execf);
       unlink($sounddir."/say-text-$hash.txt");
} 

print qq(SET VARIABLE SWIFTFILE "$wavefileAst"n);

Yes, again the code could be nicer.. but in this case we create a sound file for the weather conditions and then make a sound file variable. Yes, AGI supports streaming the audio and even playing it back directly from the script… so why did we chose to exit the script and return to the dialplan? Asterisk is very versatile. We like returning to the dialplan, and that’s how we code. Life is that simple. What works for you best, can sometimes be the best solution.

Ok, bringing that into the asterisk dial plan, you have:

exten => s,1,NoOp(checking parking)
exten => s,n,playback(/tmp/spaces-greet)
exten => s,n,AGI(testspaces.pl)
exten => s,n,GotoIf($["${SPACESAVAIL}" = "ERROR" ]?error)
exten => s,n,SayNumber(${SPACESAVAIL})
exten => s,n,playback(/tmp/spaces-avail)
exten => s,n,goto(weather)
exten => s,n(error),playback(/tmp/spaces-error)
exten => s,n(weather),AGI(current-weather.pl)
exten => s,n,GotoIf($["${CITY}" = "ERROR" ]?end)
exten => s,n,playback(${SWIFTFILE})
exten => s,n(end),goto(main,s,1)

Your comments are always welcome!

UPDATE — 01/10/2009

Well, the system has been upgraded a little bit… if you call +1 (212) 937-7844 and press option 6 +1 (734) 272-0909 you can choose your garage, and then be automatically called back (on the number you called from) when there are fewer than 10 spaces available.

Comments… we love to hear them.