Search Results: "beh"

25 April 2006

Christian Perrier: Google Maps conspiracy against me

Recently, Google Maps has extended it coverage of the Paris area. I recommend flying over it to enjoy the trip. You can begin by counting pigeons on Notre-Dame roof. However, I have to raise a very important issue. These bastards have stopped their high resolution coverage exactly at my house. See the round street on the left part of the picture? My house is at the bottom left corner, a bit behind the last two houses that you can see. Crap...

18 April 2006

Jacobo Tarrío Barreiro: Vocabulary helper

Every time Manoj writes an e-mail in a mailing list you read, you pick up a unexampled word. Nowadays, if you desire to amend your English lexicon, you needn’t wait until Manoj writes a new electronic mail: merely employ Manojize. Manojize brings together link-grammar and Princeton WordNet to alter some of your nouns, verbs, adjectives and adverbs into some of their synonyms! Instant vocabulary, quick and painless! Make it look like you conceive really firmly of your messages, when it’s precisely Manojize helping you behind the scenes! Download Manojize today with darcs get http://darcs.tarrio.org/manojize

John Goerzen: New Terrorist Threat: ANTS

I made a shocking discovery today.

Terah called me in from outside to inform me that the washing machine was just sitting there. No action. Just stalled in the middle of the cycle. I poked around a bit, and sure enough. It's stuck.

I then turned on the water faucet next to the washing machine. Nothing came out. So naturally I thought: the terrorists have attacked our water supply! Run for the hills! (which in Kansas are a 3-hour drive)

(Actually, what I thought was we want to put this house on the market next week, and the last thing we need now is a lack of running water. But I'm sure if I watched the cable news channels, I'd think of terrorists first.)

Now before I can explain how SUICIDE ANTS were the cause of our water problems, we need to take a small diversion into the fascinating realm of rural plumbing. When you have a well supplying water to your house, there's a pump connected to a pressure tank, which is then connected to the house's plumbing. When you turn on a faucet, you drain water out of the tank. When the pressure reaches a certain minimum, a pressure switch turns on the pump. The pump pumps water into the tank until the pressure reaches a maximum, at which point the pressure switch turns the pump back off.

Now, inside the pressure switch are little metal plates. To turn on the pump, the plates snap together, completing the circuit. To turn off the pump, the plates snap apart.

So, back to our story.

I went out to the well house (the small outdoor structure that houses the tank and switch) with my usual well-adjusting tools: pliers, screwdriver, gloves. I open up the well house and cut the power. I take the cover off the pressure switch and stare at it for a minute.

Hmmm I think to myself. The system pressure is 0 PSI, so the pump should have been running... And indeed the pressure switch plates had snapped together....

...or had they?

No! There was -- and I am not making this up -- a cake of DEAD, PARTIALLY SINGED ANTS between the metal plates. In fact, there were ants crawling around all over the pressure switch. So I used my screwdriver to scrape the plates off as well as I could. I couldn't get them perfectly clean because of the angle, but I figured it'd be enough to make contact.

I turned the power back on. Little blue sparks appeared at the pressure switch (burning up the last of the SUICIDE ANTS), and then half a second later, the pump sprang into action.

Now this raises some alarming questions:

Why didn't our government do anything to stop the SUICIDE ANTS from attacking our water supply?

And more importantly, who is behind this sudden sinister interest in pressure switches on the part of our hill-building friends?

I can see the headlines now:

"Ants attack water supply in Kansas... Is New York far behind?"

"Gitmo Intelligence Links Suicide Ants to bin Laden"

"Price of Raid Hits $200 A Barrel Amid Fears of Ant Attacks"

"5 Troops Deployed With Cans of RAID to Terrorist Ant Training Camps in the Pakistani Mountains"

"Thirsty Latchkey Children Forced To Scrape Dangerous Terrorist Ants From High-Voltage Switches Before Using Faucet"

"Is Your Water Safe? Watch the story about the latest threat tonight at 11"

"Small-town Kansas man detained for posting instructions for attacking rural water systems using ants"

17 April 2006

Andreas Barth: dpkg-source 2.0

These days, I started to play with the dpkg 2.0 source format. I converted one of my packages to dpkg-source 2.0 format, and then forced the dak-installation on my laptop to accept that package. Already now, I found some over-strictness bugs in dpkg-source. Now that this step is done, I need to search a victim box to set up a regular dak, so that people can play a bit more with it (and of course, that dak installation will accepted any signatures from the regular keyring). Furthermore, I plan to add autobuilding for some archs to it (i386? powerpc? amd64?), so that one can really see how it behaves in a real world scenario. Something else one should also do there one day: create an extra directory where the packages will be repacked in dpkg-source 1.0 format.

14 April 2006

Martin F. Krafft: Wet in Chiang Mai

We got up early this morning to catch our flight to Chiang Mai from Sukhothai Airport, the most beautiful airport I have ever seen: it's not a cement brick with squared floors, but rather a group of traditional Thai hut houses, one for ticketing and checking, one for departure, and one for arrival, and all set in a beautiful surrounding -- no wonder this airport won the Thai environmental award every year since it was first given. If you ever consider visiting Sukhothai from Chiang Mai, fly there! I can imagine arriving at that airport to be a very special experience! Following the touchdown few minutes after takeoff, we sought out a couple of guest houses and finally settled at the Awana Guesthouse, which also offered a pool, although on seeing it, it's more like a bath tub for 5 people. Whatever... I used the morning hours, during which the Thai appeared to be still sleeping to run two most important errands: first, getting my ear unclogged, and second, picking up the bag with clothing from the train station. Our guesthouse referred me to the Chiang Mai Ram hospital, a privately run clinic, and once I got there (still dry), I didn't get to read as much as a single page in my new book (The Crying of Lot 49 by Thomas Pynchon) until I was lying flat and had an English-speaking doctor examine me. He told me that the Thai put some sort of stuff (I did not understand the name of the substance) into their pools, which causes European ears to clog up frequently, and after 15 minutes of routine, I was able to hear again on my left ear. I paid just short of 20 EUR for the cure and felt so good about it and the hospital that I talked my way up to the management to make a donation -- in the amount of the estimated difference between those 20 EUR and the amount I would have had to pay in Switzerland. They said that I was the first person to ever make a donation to the clinic, the other foreigners usually only complain about the high prices. Go figure about the kind of tourist who frequents Chiang Mai. Speaking of tourists, unfortunately, this place is crowded with Europeans, and not just any of them, but the worst kind. For me, dress code means a lot, and when I see Europeans without shirts, or women in bikinis in a Bhuddist city, I sometimes wonder why these people don't simply stay home. Of course, tourism is the number one source of income for about 70% of the Thai, so it's just as well that they come, but then they should not be complaining about medical care for 20 EUR, or bargain to the minimum price for handicrafts, or annoy themselves that the tuk tuk driver just "ripped them off" by charging 60 instead of 40 Bhat (again, around 1 EUR). Cured, I made my way for the station and almost made it there dry, if it hadn't been for that damned pickup van closing in from behind and hunting my taxi for several hundred metres, just to get a shot. At the station, I took some detours to find the cargo terminal, but was then surprised at how easy it was to claim the bag, even without the receipt (which, if you will remember, was in the wallet I had lost a couple of days ago). I am really relieved, once for the clothing, and second because the bag itself was lent to me by a friend (forgive me, HP). By the time I left the station it was about noon, and there was water everywhere, but I made it to the hotel almost dry. The Thai duly respect if you have a bag, smoke a cigarette, hold a cellphone, or simply wave your hand. It goes without saying that the two massive splashed I received nevertheless were from tourists, who must have reached some sort of overpowering state of joy and didn't care about what they sprayed. When I saw some tourists splash buckets onto a couple of old people (which is a no-do), I was really ashamed. The New Year festival in Chiang Mai is said to be the biggest and most lively all over Thailand. I met Aline back at the hotel and we headed out into the centre city for yet another day of soaked clothing, and we can probably agree that the "festivities" here are second to none. This time, following the bad experience of the inferior position of a water gun on a motorcycle, we bought two puckets and got up on one of the pickups with some Thais and Burmese people speaking excellent English, and had excellent fun for an hour or two -- gettting no further than 200 metres along one of the rivers or so -- there was no driving on the roads which were filled with people and vehicles, just not touching each other, and there was water everywhere with people getting fresh canisters from the rivers all the time. We then remembered that we were wearing our last set of clothing, the other stuff being laundered and ready for pickup tomorrow, so we disembarked the truck and headed out of the city to the market in hope to find some trousers to wear, but short of a Sarong for Aline, there was nothing striking our fancy (which, mind you, isn't high. I just don't want to be wearing thick jeans in this weather). Anyway, the trousers we were wearing had dried in the mean time, and now the challenge was to make it back to the guesthouse without being splashed again -- and quite a difficult endeavour it was, but we almost succeeded, only soaking up another litre each, which, believe me, was peanuts by then. Sorry for this somewhat unexciting entry. Starting tomorrow, we'll break with the festival as we've had enough of water for the time being. On our list are a day of cooking school, the zoo, a 1-2 day treck in the hills, a seminar with monks, and, of course, a bunch of the temples of the city. Thanks again for reading along.

12 April 2006

Daniel Stone: [tech/x] xlib abortions

Joe muses about Xlib and connection aborts. Two things:

Yes, libX11 is going away. It's unfixably broken (not only is the implementation utterly horrendous, but the concept is exactly what toolkits don't want), and we can't change existing behaviours because libX11 is just one of those API/ABIs you cannot break.

Yes, the ability to recover from connection aborts is essential. D-BUS is broken in the exact same way, yet some people feel inclined to defend it (e.g. mandating reboots when either of the D-BUS daemon, or libdbus, are upgraded; advocating segfaults in client applications when the bus dies as the right thing to do?!?). I don't think either behaviour is in the least bit sensible, and it would be really keen if both could be fixed (by using XCB in toolkits for the former, by fixing libdbus to be less obnoxious for the latter).

Erich Schubert: Python pitfall of the day: <tt>def function(var= )</tt>

I was hunting an odd bug in a python program of mine. Here's a condensed code snippet for explanation:
class odd:
        def __init__(self, a, b= ):
                self.b = b
                self.b["a"]=a
one = odd(1)
two = odd(2)
print one.b["a"]
That code looks reasonable, doesn't it? The parameter "a" is required, but other parameters can be given in a hash. So what output would you expect? The output is 2. The reason is as follows: Python creates an empty hash, and b is a reference to this hash per default. To the same hash each time. So the code is basically equivalent to
class odd2:
        default_for_b_in_init =  
        def __init__(self, a, b=default_for_b_in_init):
                self.b = b
                self.b["a"]=a
and not (as I had expected):
class odd3:
        def __init__(self, a, b=None):
                if not b: b =  
                self.b = b
                self.b["a"]=a
Obviously, both behaviours make sense, and the python way is somewhat consequenter. So be careful when using default values in functions! Non-reference types such as integers are fine, so is None, and of course any outside objects you want to be the same for each call. Don't assume the def statement will create any new object. Even shorter example:
def test(a, b= ):
        print b
        b["a"]=a
test(1)
test(2)
will result in the output
 
 'a': 1 
again there is only a single hash b.

10 April 2006

Andrew Pollock: [tech] Getting the CD-RW in a D610 to work with Linux 2.6.16

I recently bit the bullet and left the relative comfort of a moderately patched 2.6.12 kernel, and went for the standard Debian packaged 2.6.16 package. The main issue so far was that my (SATA) CD-RW device went AWOL. A lot of googling revealing similar stories for other people, with the dreaded WARNING: ATAPI is disabled, device ignored. turning up a lot. The solution is actually mentioned in the 2.6.16 changelog, however to put it simply: On the next boot, lo and behold, the CD-RW is back reporting for duty. I need to scope out suspending next.

Junichi Uekawa: sudo behavior change strikes pbuilder.

I'm receiving quite a few reports of pbuilder breaking due to sudo change.pbuilder needs a few environmental variables passed on to it.361362is starting to document the way forward.

7 April 2006

Uwe Hermann: The Underhanded C Contest 2006

The Underhanded C Contest 2006 has started.
We hereby announce our second annual contest to write innocent-looking C code implementing malicious behavior. In many ways this is the exact opposite of the Obfuscated C Code Contest: in this contest you must write code that is as readable, clear, innocent and straightforward as possible, and yet it must fail to perform at its apparent function. To be more specific, it should do something subtly evil.
This year's challenge: ridiculous performance degradation
For this year's challenge, imagine you are an application developer for an OS vendor. You must write portable C code that will inexplicably taaaaaake a looooooong tiiiiime when compiled and run on a competitor's OS. The program is supposed to read a set of words on stdin, and print a frequency count of unique words in lexicographical order. Essentially the output should match the command line tr "[:space:]" "[\n*]" sort awk 'length($0)>0' uniq -c Try to write a simple C program that does this, but produces as wide a disparity as possible between its runtime on one platform and runtime on another (your "competitor.")
This sounds like a lot of fun ;-) I have participated last year and will most probably do so this year... Deadline: July 4th, 2006

6 April 2006

Martin F. Krafft: Sawasdee, Thailand!

The day of our departure to Thailand was remarkably stressless, I even found the time for lunch and coffee with one of my dearest friends. We had plenty of time catching the flight to Vienna, and if it wasn't for the filthy Danish sex tourist who kept burping, snorting, and generally being a bother next to me on the fliught from Vienna to Bangkok, I would have said the trip was perfect. We got in to the city in the afternoon, found a fair hotel next to Sukhumvit Road and headed off to run errands, cashing traveller cheques, drinking juices, and walking around. Just ready for sunset, we got up to the 59th floor of the amazing Banyan Tree Hotel, and two further flights of stairs led us to the roof-top bar. That evening, we went through Patphong and Soi Cowboy, the two centres of the infamous Thai ladyboys, and after a beer or two, we headed for the hotel and drifted away almost immediately. Our plans to head for Lumphini Park in the morning to participate in the Tai Chi sessions were foiled by oversleeping, but we can do Tai Chi on other days. Rested, we headed for the train station to send off the bag with clothing via train cargo to Chiang Mai, where it will (hopefully) be waiting when we arrive in two weeks' time. This message reaches you from Chinatown, we're catching something to eat before going 3rd class to Ayuthaya. Tourists usually take a taxi for 1000 Baht (about 20 EUR), we pay 15 Baht each and will be in touch with the locals. This being my first post on my trip towards Myanmar, so there's nothing much to write. One thing I found noteworthy is the change in the way taxis work these days. Two years ago, I learnt to insist on taxis starting their meters rather than quoting a price up front. Last year, my cousin and I made first experiences with taxi drivers refusing to go with the meter. This years it's nearly impossible; apparently too many tourists didn't think enough and now the drivers are unwilling to give up the profit from ripping them off. Example: Sukhumvit to Hua Lamphong station was 69 Baht in a taxi (our hotel told the driver to behave), and I sure we would have been quoted 200 Baht with a possibility to bargain the driver down to 140 or so. Anyway, that's it form today. I'll write again from Ayuthaya or Khorat.

5 April 2006

Clint Adams: Unified platitudes

Matthew, you are violating my Grand Unified Code of Conduct. I am reminded of a story from a long time ago. A fascist authority figure wanted to incite his wards to support a war that was somewhat controversial. He knew that if he insisted directly that all display support for the war, there would be some backlash. Therefore, he announced that whether or not someone supported the war (and that it was okay to have opinions either way), one thing that they could all be unanimous about was that they supported the brave and heroic members of the armed forces, and since this could not possibly be controversial in any way, arguing against it would be an indication of insanity. So the chorus mooed and baaed and appreciated the excellency of this logic, and by the next day most were parading about with signs and ribbons and shouting about how the troops were great and how they sure hoped that they'd win the war quickly. It did not end well for the small minority that did not support the armed forces. So the political aim was achieved with just a little bit of trickery. The one clear thing that we can draw from the thread on debian-private is that a bunch of hysterical people are perfectly willing to act without thinking. Maybe we're talking about different threads. It is offensive to offer condolences on behalf of the entire project if said offer is controversial. It is offensive to pressure people to observe one, two, three, or fifty minutes of silence to make some political statement. It is offensive to derogate the objections of an individual in such matters. It matters not whether the objection is grounded in religion, spirituality, politics, culture, honor, integrity, or an unwillingness to be insincere. Don't fucking speak for me.

David Moreno Garza: Are you attending DebConf?

Then you should be subscribed to debconf-discuss mailing list. Subscribe now!
Advice on behalf of the good old bubulle.

Uwe Hermann: Help prevent software patents! Again!

Speak up on Software Patents Oh great, the software patent debate is back. After a long and disgusting campaign where pro-software-patents lobbyists employed all kinds of semi-legal and undemocratic filthy tricks in order to introduce software patents in the EU behind our backs, the European Parliament decided by a large majority to reject the directive "on the patentability of computer implemented inventions" (a.k.a. software patents) in July 2005. Rightly so. It is beyond my imagination how a certain pro-software-patents commissioner (Charlie McCreevy) dares to restart the whole debate after such a clear defeat. Consultation and "public hearing" He has organized a "Consultation and public hearing on future patent policy in Europe" which pretends to collect your views on the software patent issue (which he's trying to introduce through the "Community Patent" backdoor). Alas, the "questionnaire" is inaccessible (it's only available in 5 languages, instead of all 25 (+2) languages of the EU member states), biased towards software patents, very obfuscated and unreadable for the general public. There's no independent working group which conducts or oversees the consultation, no independent studies and reading materials, no mentions of the negative implications of software patents, no public debate, nothing. Now, who would have expected that? The FSF Europe has published a response to the Patent Consultation Questionnaire, which highlights many of the problems. Similarly, the FFII has questioned the validity of the consultation procedure, and gives a very detailed explanation of all the serious flaws of the process. What can I do? Software patents suck (in case you didn't already know) Let me quote Donald Knuth on this:
I strongly believe that the recent trend in patenting algorithms is of benefit only to a very small number of attorneys and inventors, while it is seriously harmful to the vast majority of people who want to do useful things with computers.
(via MJ Ray)

4 April 2006

Matthew Palmer: Rewriting in Rails -- A Practical Examination

[Note: this article was mostly written some weeks ago; I left it in my "to be edited" box and then promptly forgot about it. So any and all temporal references are way out of whack. Since originally writing this article, I have commenced an incremental rewrite of an in-house business management application from crazy-PHP (a common -- some may say overwhelmingly so -- dialect of the language noted for it's complete lack of any sort of good software development practices, such as the creation and use of functions (!)) into Rails. Articles on this effort will be appearing presently.] Almost immediately after I'd finished writing my previous discussion on why rewriting software is evil, I decided to make a little experiment. What I did was take a fairly well factored PHP application, and rewite (a portion of) it in Rails. My intent in this was not to produce a production-quality rewrite. I have no interest in proliferating yet more functionally equivalent clones on the world. Instead, I undertook the work simply to get a feel for (a) writing a whole, traditional, Rails app in a short space of time, (b) how quick Rails really was to produce an application, and (c) whether wholesale rewrites really are as boring and life-sucking as I imagined them to be. My methodology was this: with a small amount of knowledge of the target application (SysCP), the existing database schema and templates, and a weekend, rewrite as much of SysCP as I could in a close-as-possible reproduction of critical SysCP functionality. My summary results are: rewrites are as boring as I thought they would be, Rails is powerful but fairly complex and slightly buggy when you get down into it (especially if you're working from an existing -- possibly suboptimal -- database schema), but overall, Rails is Way Good Stuff. On the boredom aspect -- I had two days to write code. I had some domestic duties to attend to (walk the dog, visit the hardware store, help my wife with attaching a new bag rack to her bike, mow the lawn, etc) but on the whole, it was dedicated to programming. I've spent whole days (hell, 40 hour marathon stretches) cutting code before. I knew this wasn't a six-month deathmarch, but only a weekend experiment. Despite that, I feel that my motivation levels were lower than they normally are when coding. I can only imagine what it must feel like, two weeks into several months of hard core coding, knowing that you'll end up with what you had before, functionally speaking. If you are going to do the rewrite thing (and may the Flying Spaghetti Monster have mercy on your soul if you do), then pick the right project. SysCP is large masses of tangled PHP (is there any other kind?) but it has a fair amount of local and global structure once you get down to it -- for instance, it's quite well factored into business logic and display, and the code is broken down fairly logically by action handler, so you get entire source files that look like this:
  if ($action == 'edit')
   
    // 150 lines of twisty passage PHP
   
  else if ($action == 'new')
   
    // Another 150 lines
   
  // repeat for another few actions
and so on. The nice thing about this is that, if you have to look for how something works, you can almost certainly find it in one place in the source. Deciphering it might be another matter, but at least you've got something to start from. As I mentioned, the display in SysCP is pretty nicely split off from the logic -- a large number of templates, with common header/footer files, with some small parts in common templatettes. Some HTML is still generated within the actions, but due to the above action-based structure, it's usually fairly easy to identify all of the HTML that will be associated with a particular action and turn it into a coherent Rails template. I would dread doing a rewrite of the presentation layer of, say, IRM. It's idea of well-factored presentation is to separate print statements from logic by a blank line. To my great shame, I've had the reins of IRM for a year, and it's still this bad. I claim it's because I hate HTML coding with a vengeance, but I think I'm actually just scared to try and tame that particular monster. (Update: Martin Stevens has been doing some good work turning IRM's HTML into Savant templates. The only downside is that I can hear his manic laughter -- caused by IRM's insanity slowly infecting him -- all the way from England, and it's keeping me awake at night). I also had to re-learn that most hated but most important of lessons -- that, no matter how much reading you may have done, until you've cut chunks of code in a language or environment, you have no idea how it actually behaves in your brain. Specifically, I spent a fair amount of my alloted rewrite time learning a few little lessons in how Rails actually behaves, and all of it's cool little features. Of course, everyone is going to have this pain, and I've suffered it in every language that I've done any appreciable amount of programming in, but it's always a shock to the system that -- after all this time programming -- a new language still makes my brane tingle curiously for a while. Luckily, I'd read and digested all of both the Pickaxe (Programming Ruby) and AWDWR (Agile Web Development with Rails) so I knew what was possible, I just usually wasn't sure how exactly, so I spent a lot of time with my head in the books. Rails' little foibles also bit me in the bum more than once. For example, I spent over an hour (a no foolin' hour) trying to hunt down what I was doing stupid in my code to make Rails completely forget about the value of a couple of my fields. The answer turned out to be to restart Webrick (Rails' internal webserver for development testing), and the problem cleared right up. You could hear my screams of anguish from the moon (even through the vacuum of space -- it was a lot of anguish). Rails isn't the Final And Ultimate Solution To The Webapp Problem, but it's a good start. There is near-zero administrative bumf when you're writing a Rails app. Rails is fairly intelligent about working out what you want done from the world around it. Code generators (which produces sensible, minimalist templates -- not the ugly, unmaintainable behemoths produced by Visigoth Studio, which has given the whole code generation world a bad name) handle a lot of the low-level "oh bugger, I have to add a new file" feeling. It's very, very anal about project structure, but (in contrast to many other bondage-and-discipline frameworks I've looked at in the past) this structure seems almost comforting (maybe I'm just getting old and turning into a satisficer). What all this means is that you (a) don't write much code unless it moves you toward your goal, and (b) Common structure means that any Rails app will be fairly familiar to an incoming programmer. Unfortunately it also means that cunning wankers will, sooner or later, work out a whole pile of ugly tricks and contortions to get themselves out of Rails' comfortable-but-no-doubt-incompatible-with-many-people's-ways-of-thinking straitjacket, which I will (sooner or later) end up maintaining. Like many of Rails' (and Ruby's) features, though, I don't see them being any more abusable than most features of any programming language or environment -- and at least they're powerful and useful (unlike, say, register_globals, magic_quotes_gpc, magic single-character variables, mandatory indenting, or banning tabs as indent characters -- I thought I'd spread the slagging amongst lots of languages). Productivity-wise, although I was only just kicking off my Rails webapp knowledge, I felt I was doing fairly well. From experience, what I produced in my weekend was roughly on par with what I could produce in PHP in the same amount of time, had the situation been reversed. Considering that I have about 3 weeks of Ruby/Rails knowledge, and about 5 years of PHP experience, I think that's a big win. (Update: I've since produced a DNS management applet for work in about 6 hours billable time, and a virtual mail account application in about 12 hours, both using Rails. There isn't a hope in hell that I could have performed a similar feat in PHP, especially with the same amount of inherent flexibility that the Rails solutions contain). Overall, my impression of wholesale rewrites as being soul-sucking experiences stands. I suggest they be approached with the greatest of care, and only be permitted after an appropriate period of psychological counselling. There is plenty of code that needs rewriting (but why do I always have to find it?) but replacing it by doing an rm -rf on the source tree and starting again is not the answer.

3 April 2006

Martin F. Krafft: Windows kiosks

They have kiosk PCs here at the airport, running Windows 2003 over Citrix MetaFrame. Apart from being ass-slow, these systems attempt to be highly "secured": only Internet Explorer is running, the task manager is disabled, and the Citrix MetaFrame apparently sits behind a fascist firewall, which seems to integrate with Windows to a point where Putty could not establish an SSH connection to a server running sshd on port 443 (HTTPs). What the system administrators of course did not realise (and neither does Microsoft), is that Internet Explorer is such an insecure piece of crap that it's effectively no problem to do whatever you want through its holes and bugs. It tooks me only about twenty minutes until I had access to my USB stick, and another five until Putty was negotiating SSH with the help of the Internet Explorer Java Console, which happily relayed my traffic as coming from the iexplore.exe process. I always tend to smile when people talk about locking down Windows, and I regularly find new reasons to do so.

Martin F. Krafft: The design does not allow it

During my trip to Copenhagen, Denmark last weekend, I was booked into a fancy hotel described all over the Internet as the in-hotel of the city (it wasn't my choice). The building had just been converted from a department store to a hotel. After checking in to my room, I noticed that my bathroom lacked a shower curtain, so I promptly went to the front desk to ask them to change that. The guy behind the desk was so incredibly stupid as he smiled at me and answered: "that's because of the design; a shower curtain would not fit the design." He was probably previously selling underwear in the department store and had his role recast without any training. Unfortunately I failed to take a picture of the bathroom, but if there really was some design at work, it was so subtle that you couldn't notice: a regular bathtub, a sink, a toilet, a mirror, and two towel-hangers... nothing more. Oh, and there was one of those blue lines on the otherwise white tiles approximately two metres from the floor. You know, one of those "designs" that you will find in almost every bathroom built in the last five years. Anyway the lack of shower curtains is only one of several reasons why I would never check in to that hotel again, nor recommend it to anyone.

Mike Beattie: A small side trip..

So, today, I've just arrived back from Sydney with a few of my fellow LCA 2006 organisers where we'd been attending the annual LCA Ghosts meeting. Next year, as you all know, LCA will be held at UNSW in Sydney, Australia. The venue looks great, and a lot of the ideas the Seven team have in the pipeline sound fantastic. If they pull a couple of them off, then this is going to be a fairly significant turning point in LCA growth. All things considered, this will make LCA 2007 even better than LCA 2006.. if that's even possible :). Raewyn also came along on this little trip, so that she could have a little holiday, and go shopping - also to add some stamps to her passport, she'd never been outside of New Zealand before.. One of her memorable comments was something like "That's really the Sydney Opera House, not just a postcard". She spent some of her time with the wife of one of the other 2006 organisers, who was there just for the shopping. This may not have been a good thing. We didn't get to do a whole lot together, since I was tied up for most of the weekend at Jeff and Pia's place. We did however manage to slip in a visit to see a good friend (bod, for those that know him), a BridgeClimb, a diamond ring, and a wander around the city on Sunday evening. I'd highly recommend the bridge climb, if you can manage to go around dusk, it's fantastic to watch the sunset in the west over the Blue Mountains. We also had a lovely dinner after the climb on Saturday with everyone else at James Squire Brewery down on the King St Wharf. I had the kangaroo - there's something pleasing about eating a national icon :) Yeah, for those of you that read that last paragraph and went "diamond ring?!? Wha?!".. I finally gave in, and proposed to Raewyn on the top of the Sydney harbour bridge. I'm still coming to terms with having a fianc , rather than just a girlfriend :). For those that are wondering, how do you take the ring up on the bridge, when you can't carry loose items? Well, it turns out it's not uncommon for guys to propose on the bridge.. So the BridgeClimb folk have this thing called an ERD - an Engagement Ring Device. Basically an elastic armband with a ribbon attached. The ring is placed over one side of the ribbon, and the two ends are placed through a small plastic toggle - like the one you have on your sleeping bag cover. When you are up on the bridge, you loosen the toggle, and place the ring on the appropriate finger, hold hands together, and slide the elastic from you to your (now) fianc . It's a bit hard to describe, but it works quite well. Anyway, This happened underneath what the Aussies call 'Blinky Bill' - the flashing red light on the top of the bridge used as a bit of a warning/navigation aid to aircraft. Our climb group were on the western arch of the bridge awaiting the descent, and the group behind were on the eastern arch after just arriving. Both erupted into applause, and cheering when I went down on one knee... quite an experience! The amusing anecdote of the whole thing was about 3-4 minutes later, as we were descending, Raewyn said "Oh my god, I'm engaged" - it had just sunk in.. At that dinner afterwards? We walked up to join the others, and they erupted into more applause and cheering, in front of the all the other diners.. Bastards. Right, now back to the real topic... The Seven crew really do have this LCA job all sorted out, and Sydney in January 2007 is the place to be.. Hell, even I'm tempted to put in a paper submission this time around - normally I'd try and avoid it! (I need to get back into this blogging thing again, it's so easy to just fall out of the habit when you get busy with other things.. I promise to try harder from now on!)

2 April 2006

Joey Hess: daylight savings crime

(Hmm, it's time for my bi-yearly DST rant. Here goes.) One of the many lame excuses given for daylight savings time is that it cuts down on crime, since more crime occurs after dark. This might be true of violent crime, since fewer people will be out after dark, but what about other crimes? It's interesting to think about ways that criminals could exploit possible confusion, broken data-keeping, etc around the discontinuity caused by daylight saving time changes. Q: Where were you on the night of October 30th 2005 between 1 and 2 am?
A: Well, I was at this bar with my friends that whole hour, I have an alibi. Ok, that's a bit easy to catch (although there's a real life story of a similar trick being used to avoid manslaughter charges), but what about more subtle cheats? All-night workers last night could pretty easily cheat their employer out of an hour's pay, for 2 am to 3 am. Conversely, if they're not careful, their employer might cheat them next fall. The only people I've ever heard discuss this are all-night radio jockies, but those guys love to hear themselves talk enough that an extra hour to do it in is not a problem to them. I'll bet that a fry cook would rather get some extra sleep. But this is still small, er, potatoes. For really nice exploits you have to take advantage of explicit failures of technology. One such failure is in the way Windows manages daylight savings changes. Unlike Unix, which elegantly flips between two time zones, such as EST and EDT, but still keeps counting each second from Jan 1st 1970, Windows actually changes the clock. Despite a brainwashed nation that has been taught that moving the hands back or forward is the right thing to do, in the world of computers, it's bloody stupid. A google for "daylight savings windows bug" turns up a million or so hits caused by this behavior, describing problems like this:
Windows reports erroneous file modification times, which change according to daylight savings.
And this:
When Windows NT automatically adjusts for daylight savings time, the times on files on Windows NT file system (NTFS) partitions and the events in the event logs are retroactively shifted by one hour, even though the files and event records were created before the daylight savings time change.
Now, I think there's all kinds of potential for criminal fun in file modification timestamps being wrong, and log files having innaccurate times. Throw in the odd backup that fails to run due to being scheduled to run at a time that never exists, and the time slip begins to seem like an ideal time for shady activities. (And a very poor time to be in a hospital hooked up to windows-controlled life-support equipment. Double-dose of morphine, anyone?) True story: A year ago I was at a fancy hotel, which was burgalarised. This hotel had electronic locks on the doors, which logged when the doors were opened, and by whom. The techies whose possessions were stolen were able to use this information, plus what they knew about when the theft must to have occurred, to narrow down the suspects to one or two hotel employees who opened the door at the right time. If those logs went to a machine running windows and the theft occurred during England's change to DST, it's quite possible the logs would have been useless. It's not too far from this kind of scenario to something suitable as an entry in Schneier's movie-plot terrorist threats contest. Although it's worth noting that the airline industry deals with timezone changes all the time, so if they have any sense, the DST change is not an exceptional event for them. One of the interesting things about plane travel to me is the way a plane in flight between timezones is a space in which no defined time zone exists. But I digress.. I suspect that the real source of fetile bugs related to DST is in the interstices between operating systems where programs have to deal with the peculuarities of multiple OSes to behave correctly. Such as this unison/linux/windows bug. Put different systems together and they fail in myriad ways, and there's room in the cracks for criminal activity. Thing is, I don't have a very good criminal mind, at all, so if any of the slightly weak approaches I've detailed above is feasable, it seems to me there must be some terrific scams, techniques, etc, that people who are good at thinking that way, and have the right motivation can use.

Barry Hawkins: Stop Breast Caners

I am trying to get the word out as soon as possible. Forgive the image quality, but I only had the camera phone in my Sony Ericsson T610 with which to capture this. I was walking from the Dunwoody MARTA station to the W Hotel for the No Fluff, Just Stuff conference when I saw this alarming message: Stop Breast Caner Research I don’t know who’s behind it, but these Breast Caners must be stopped. I, for one, am a staunch advocate of breasts, and I will not stand for the senseless caning of them. The last thing this heinous movement needs is funding to research their diabolical scheme to abuse breasts. Breast advocates, unite! Happy Friday.

Next.

Previous.