Personally, I like Friday 13th. It's usually been pretty good for me. But for this one, I won't be surprised if computer abusers are planning some big attack tomorrow. I've just spent a big chunk of my day upgrading and securing some of the websites that our free software cooperative supports for a customer. The number of attacks in the access logs is surprising - and I've been fixing other people's cracked servers for over a decade. It makes me wonder if someone is finding and recruiting exploitable systems for tomorrow. If you have a website, please check that any web applications on it are installed correctly and the latest secure versions. I've been seeing a lot of attack attempts for Joomla and WordPress in particular, even on sites which don't run them. That says something bad about either the success rate of attacks for them, or the stupidity of their attackers. In our case today, the damage seems to have been minimal (touch wood!), with the customer merely being banned from some networks for a while. It could be so much worse, like this BBC News report about Cotton Traders Card details stolen in web hack (which is part of why I suggest small online shops avoid storing credit card details on their site - leave it to the payment gateway). Finally, there are some new scams like Conmen abuse web address checks on the horizon for online shops, so make sure you've got your 3D-Secure rules set correctly by now and be cautious about sending goods before you're sure you've got the money. I think all web card payment systems are a risk, so please try to limit your risk. Update: If you do get attacked, try to help track the attackers down so we can get other results like the Jail sentence for botnet creator. I wish our governments would concentrate on toughening up blatent computer misuse law and stop tightening copyright law in secret.

Jeff Bailey asked:

"Heya Brits! Any of you still driving cars at ~ 1.15 according to the Daily Mail"

Yes, I am. I drove on Monday (at 1.18/l) because it was the least bad option for the journey. I try to avoid it and I felt bad afterwards (literally - it was too damn hot and each part of the journey was too short for the cab to cool down), but the car was available and the other choices involved not attending some events. On Sunday, I used my bike instead, but I was I wondering if the world is full of Sunday drivers today or whether I was really riding that badly. You name a junction on my route and I seemed to get into a conflict with a car at it. Today's bike trip went much better, even getting thanks from a coach for pulling aside halfway up an incline, but I had to take avoiding action as I re-entered the village because of a police car. I'm pretty damn sure that wasn't my fault, but I do wonder when it's the police. I'm still riding without a helmet, without ill effects. Gunnar Wolf was getting a breeze through a different kind of helmet but I think it's telling that cyclists "feel naked" rather than actually being naked (usually, at least). Have we got too used to being cocooned in metal boxes while out on the roads? I've always ridden and walked a lot - is this why I don't miss the hat much? I must remember to drink more in summer without it, though. I share Criag Sanders's scepticism about the protests and Chrisitan Perrier's enthusiasm for bike-pools. I don't agree with many of Russel Coker's views on oil prices but they are interesting reading, even so. I'm taking part in JamBustingJune for the West of England region and BikeWeek 14-21 June 2008

After thinking it over a couple of times, I did it. I told you here about the World Naked Bike Ride. Thousands of bikers, in over 130 cities around the world, voiced their concerns about the lack of caution drivers have towards us, about the abuse of fossil fuels for urban transportation, about the easy we are not to be seen. Many among us have been run over by careless drivers (in my case, no consequences except a broken helmet - And yes, MJ: although the impact was on the flat surface of the road and not on the kerb, the strength of the impact still amazes me). We feel naked against the motorized traffic. So, the WNBR decides to show it by taking the streets of our many cities - Naked.
It was a completely different experience of the massive naked Spencer Tunick photo, as we were there not just to show our freedom and enjoy, but to get the people to look at us. There were some of the same elements of comradeship and trust we had there (and, of course, that many of us learnt in Finland when we became GNUdists at DebConf 5's unforgettable saunas).
Anyway... I did not make the full route (I rode Chapultepec-Z calo-Diana, ~15Km, but missed the Diana-Gandhi-Cibeles part, maybe some 5Km) as I had an appointment I was already late for. But it was a unique, great experience. If you are interested, we got a fair share of press coverage. Oh, and I must say: I am famous now. And in my favorite newspaper, nothing less :).

I maintain a number of web shops for our webmaster cooperative and one of our main challenges is to encourage people who put things into their basket/cart to actually buy them. How to avoid shopping cart abandonment by Graham Jones makes some points that I've identified as possible reasons for people not buying in the past: comparisons, robots and not trusting the site enough to give payment details. There's not much we can do about robots or people comparison-shopping at a technical level, but we try to build some trust by publishing the shop owner's geographic address and telephone number (which I think is required by law in England for most web shops now), making sure the SSL certificate and domain registration details are correct, using reputable payment providers and being clear about delivery charges and terms. The point about the slickness of the checkout process is a good one and one that we've only recently started to work on. We've had pretty good results from making the checkout slicker on one site. It looks like two-thirds of people who click the checkout button now continue to buy, putting it comfortably ahead of current UK averages but I need to tweak our stats calculator to make the report directly comparable. Nevertheless, I think those improvements will be added to our other shops as soon as possible. I share Graham's low opinion of the oft-quoted Amazon. We've also been looking at other web shop software besides OSCommerce for a new project, so now would be a good time to change to something new if it improves the checkout a lot. We've made OSCommerce's checkout a lot smoother, but it's still essentially OSC. Is there a good checkout which you'd want to use as an example? The other challenge is getting visitors onto the site in the first place. How To Build Links By Patrick Altoft explains the basics as well as I've seen recently.

For some reason (maybe related to upgrading openssl recently), my Jabber client became unstable. Instead of fixing it the right way, I simply upgraded to Emacs 22.2 (which also got me the emacsclient --eval option mentioned on this blog previously). It still wouldn't make SSL connections at first, but a quick application of [jabber.el] Anybody using emacs-jabber with Emacs 22.2? fixed it. That's the wrong way to fix that bug, but it's not quite as wrong as misusing computers to try to fix copyright infringement. MediaDefender denial-of-service attacked a TV production company, as described in Inside the Attack that Crippled Revision3 on May 29th, 2008 at 07:49 am by Jim Louderback in Polemics MediaDefender or MediaDestroyer? That's the wrong way to fix that bug, but it's not quite as wrong as making treaties mostly in secret, under NDAs to try to evade local copyright law-makers. The US government, the European Commission, Japan, Switzerland, Australia and a handful of other countries are meeting in a secret negotiation on a new treaty

"that undermines civil rights and privacy, and which many say will change the substantive rights the public has to use copyrighted works or inventions."

Read more at Act On ACTA and then contact your law-making representatives.

There is a bit of discussion on Planet Debian on dbus and HAL and how to handle the daemon restarting. Basically, our "hardware abstraction" layer is actually more like a policy layer: the kernel provides the real hardware abstraction, but its access control features are not fine grained enough, and there is no revocation of privileges. Right now, there are two systems in use: X11 for keyboard/video/mouse, and dbus/hal for the rest. X11 has no problems with access control, because any process that wants to talk to the X server is owned by the user sitting at that terminal, and when that user logged off, the X server got uninteresting for us. For other hardware, that model doesn't entirely work. KVM is unique in that it only affects one user, and there is a clear definition of that user going away. To summarize my desired policies:

Sound

is similar, but I often log out in the evening and have something playing while I fall asleep, so the policy on the sound device is that access is prolonged even after logging out.

USB drives

should be accessible to the user that plugged them in, and stay with them, even after they logged out, until they are disconnected. I'd like to have block level access to them and run my file system drivers in user space (so I can format a pen drive without administrative access to the machine). That does not apply to all USB drives, though, so I'd like to be able to "recognize" certain volumes and handle them differently, not so much as a security but as a safety measure.

Smart cards

should be like KVM, really. No one but me should ever be able to talk to my cards, because causing a DoS is just so easy — enter the wrong code three times, and I have a big problem. Obviously, that is part of the security that my card provides (if you want to upload Debian packages in my name, you have to steal my wallet and get my PIN right in the first three attempts).

USB phone handset

I'd like that phone to be able to receive calls anytime, even when no one is logged in, and the currently logged on user should be able to make a call (but not over my account).

Specialty hardware

like the JTAG adapter hanging off USB on my box need a different policy too.

Any of these (except for the smart card) might mean that the device could be connected and used for a very long time, longer than I can sit at the console. Unlike humans, who get only mildly annoyed if the display closes and applications need to be restarted, there are serious data consistency issues if connections break and need to be rebuilt — and the policy needs to allow for rebuilding the connection securely. If we want to allow for handing over a resource to a new instance of the server or the client, then the protocol needs to be aware of this, as we need to synchronize server and client state after a connection breakdown. It might be possible to create a session management layer for certain services (analogous to X11 toolkits that transparently handle rebuilding the widgets on restart without bothering the application about it), but it'd probably be difficult to do without a full protocol redesign, as data loss is simply not as acceptable as when talking to a human who can pick up the pieces and go from there.

I have a massive headache right now and my chess board is buried somewhere in the mess that is my room, so I had a bit of trouble understanding damog's latest post, and it got me wishing for a way that my computer could help me here. Obviously, displaying chess boards has been possible for a really long time, but there is no common data format yet which could be used to express a state or movements in a way that would allow my browser to display them. Any XML experts out there who want to write a DTD?

Probably due to some mistake or just an excess of randomness in the world, our webmaster cooperative has been invited to Bridgwater College's Computing Advisory Panel meeting next week and it looks like I'm going. The interesting agenda items are:- 5. Current Curriculum offer 6. Computing and ICT Sector Developments - Education and Training - ICT Diplomas - Distance Learning - Specialist training / apprenticeships 7. Meeting Employer Needs I've asked some nearby cooperatives and social enterprises for comments and I'll probably highlight things like Linux opens London's Oyster and Specsavers sees clear benefits in open source when arguing for more free software use and emphasising "worker needs" rather than "employer needs", but please send me any other suggestions in a comment on this blog post or an email.

Today is World Environment Day 2008 and also Recycle Week in the UK. Locally, our poor recycling record has attracted attention. The main Somerset CC area averages 50% recycling and composting, while North Somerset only does 36%. This will cost us money, as explained under the subtly-titled local newspaper article 'REDUCE WASTE NOW OR FACE A 12M FINE' It's very annoying to read a Conservative councillor say

"The message we really have to get out to people is that this is their problem too."

We know it's a bloody problem. Have you tried to use your stupid recycling system? Criticism of the stupid collections is strangely absent from the local Lib-Dem's Mid table place shouldn't be good enough when it comes to recycling (Mike Bell) and I can't even find recycling mentioned on local Labour sites - I think those two groups may have been in coalition when the stupid system was introduced. It's left to local residents to explain the problem. Local waste collections have been simplified recently but it still seems bloody awkward, taking different types of waste to different places. The most recent edition of the council's North Somerset Life magazine explained that they don't collect plastic bottles from the doorstep because it would add 10 per year to our local tax. I'm damn sure it already costs me more than that to store them and ferry them into town over a year. The only people rewarded by saving that 10 seem to be those who live near the town centre collection point, drive to that Tesco anyway, or don't recycle plastics. Why reward them? Speaking of Tesco... those national and local favourites have applied to build Two more Tesco stores for Weston [The Weston Mercury] including one directly opposite another supermarket. The application number is 08/P/1230/F if you want to respond. The planning system seems my main chance to protect my local environment at the moment. Next Monday evening at 7.30pm, 08/P/1070/F - Erection of 5 storey building to provide 14 flats, restaurant and office with basement parking following demolition of restaurant will be considered by a Kewstoke village council planning meeting in the village hall. As I understand it, the public may make statements at the start of the meeting and 2 Kewstoke Road is currently the Castle.

So Obama will be (sorta) kicking off the general election campaign in Bristol VA, right down the road from JR's produce and just over the state line from me in Bristol TN. Why here? It's an interesting, quirky choice. They seem to have put this town hall togther at the last minute, renting VA high's gym only yesterday. The small number of tickets went fast (gone at 10 am this morning), so I didn't hear in time to get one, or even get on the waiting list. I'll try to get up early enough to see the circus outside tomorrow morning.

(Is this a network?) Terry Lane asked:

"Do you know of any reason why someone would suggest we consider placing blogs on more than one server? I think his main concern would be related to SEO and - I'm assuming here - Google."

There are some small reasons, mainly about various sorts of reliability: what if the server catches fire, what if someone filters out adverts from the server, what if the server gets labelled as a spammer or splogger, and so on... but I believe they're outweighed by ease of management and having all your site on one server. If the search engines label your IP address as a spammer, you can get another IP address as a short-term fix, but in general, the search engines are always a major threat to a blog-based business. If they label one server as a spammer, I think it would take the guys at google or whatever about 0.1 seconds to spot the link to another server. The best tactic is to avoid looking like a spam source in the first place... I guess if you're hosting several blogs on shared servers, like I do, splitting your blogs across several servers is a good idea for those reasons, which is part of why I do it... In any case, make sure you download backups in case your hosting goes like this:- The Planet (EV1) Data Center Catches Fire - 9000 Servers Offline If a blog becomes really popular, the usual tactics of mirroring and distributed load-balanced hosting can be used, but I don't think that was the question here. Even after all those, I can't think of any real killer reasons to split a blog across multiple servers if you're on your own dedicated server already. Have I missed a reason?

Today's xkcd makes me want to get a hat. Update: heh.

(How I get TV) The British Broadcasting Corporation, the largest UK public service broadcaster, is seen as a slow lumbering beast and a bit clueless about technology, as you can see from the comment when I wrote about Click: Free=beer and facebook-flaming recently. I think that's a pretty typical view. For example, the BBC has recently helped to launch Freesat which is good in some ways (free-to-air and maybe more standards-based than Sky) but still publishes half-truths like

"Installing a satellite dish is a job for professionals"

(On balance, it's no harder than installing most TV aerials, in my opinion, but remember you get no warranty on DIY.) It's pretty much the same situation online, which is why stories like The BBC and innovation [DavePress] and Good news for websites - BBC told to link out more! continue to be news, nearly 12 years after the BBC's website launched. (Source) One of the few areas where BBC triumphs is probably news-gathering, picking up stories that are unpopular with both business and government, like BBC NEWS: Towns triumph in broadband tests which follows the Experts Say Ofcom Wrong About Rural Broadband storm online. I recently helped The Doon of May team look into internet connectivity and I was surprised how bad it was in their location: a bit of attention from BBC News is most welcome. If you'd like to try receiving the BBC - or some other national broadcasters in Europe - by satellite, I'm currently taking Questions About Cycling on Satellite over on my Cycling Fans blog.

(Guess I arrived early.) Dear Reader, I'd like to read any opinions on these three:- 1. when I get new information about a story I've already written about, should I make it a new blog post and/or add it to the old post or something else? For example, I've got new links about the Yahoo's good anti-spam actions which is sort-of linked to last week's spammer registrar post. 2. what should I do with links to sites where I've commented? Should I make a new feed like my bookmarks feed, silently ignore them, or something else? Last time I did a link post, mildly irritated comments followed on one of the planets. 3. Tonight is my first full Kewstoke village council meeting. Main (non-routine) topics include Sand Road Lay-by, Crookes Lane Memorial Seat, the newsletter, replacing the gazebo on the village green, coopting more councillors, completing the Crookes Lane Footpath, the 2007-08 accounts and reviewing the Sand Bay Management Plan. Any comments on any of those?

I used to help staff more exhibition stands than I do now. Part of the reason I stopped was that few free software people seem to appreciate the basics of running a good exhibition stand and I got bored of arguing that we should give people space, avoid putting a counter across the stand, keep notes of contacts made and basic stuff like that. So, it was good to read Connecting People: Making an exhibition of yourself - the exhibitor and the linked Business Startup Coach shares Exhibition & Trade show secrets which repeat many points I've made before. Don't want to listen to me? Listen to the marketing experts. Some time after noticing WDPRS, I tried reporting as much spam as possible for a while, to hosters and registrars based on WHOIS details. Some hosts and registrars were good at dealing with spam (Yahoo and walla.net.il were exceptionally good) many were bad (bresnan.net, registrationtek.com, publicdomainregistry.com (PDR), ait.com, omantel.co.om, ttnet.net.tr) and some were ugly (Tucows/OpenSRS wrote back to say they don't do anything about domains they register, while ENom and Moniker never sent human answers). So it's no surprise to see ENom, Moniker, PDR and AIT on the list of

"Top Ten Worst Spam Registrars Notified By ICANN"

ultimately taken from this report.

I lent someone my old Palm IIIe as a data entry device for an exhibition this week. I don't use it much since I got a Samsung K608i last year. They weren't comfortable with using their smart phone as a data entry device. I can understand that: I'm still pretty slow at phone-typing and it corrupted data when its memory filled recently. The batteries had been removed from the Palm to avoid them leaking, so it needed reloading with useful Palm free software for data entry. The first problem was that I decommissioned bouncing a while ago and that was the last machine to sync with the Palm. I wasn't keen to pull it out of the store cupboard and connect all the wires, but my current desktop machine nail doesn't have a 9-pin serial port for the cradle and that's the only connector on the Palm. Actually, it's not the only connector: the Palm has an InfraRed emitter and I have a Belkin F5U230 USB-IrDA dongle thing. I don't use it that often, but it worked enough to connect nail to the internet through my old mobile phone. That was a while ago and I forgot the specifics, but eventually I noticed the key phrase in the irattach man page:-

"Note that there is another USB driver for those devices called ir-usb which is NOT compatible with the IrDA stack and conflicts with irda-usb. Because it always loads first, you have to remove ir-usb completely."

Sure enough, I checked the lsmod output and found ir-usb there, screwing stuff up. A few modprobe -r commands, then I simply ran

"irattach irda-usb"

and saw the irda0 network device appear. Still one thing to do: beam the actual applications. This was pretty easy because I remembered reading that obexftp defaulted to IRDA sending when I was getting bluetooth working. All I had to do was enter a command like

"obexftp --irda --put db.prc"

and the Palm asked if I wanted to accept it! Yes! First test with obexftpd for receiving files wasn't encouraging, though and I can't see how to use sobexsrv for this: I'll probably write next week whether we get any data off the Palm! The Palm IIIe is too old to hotsync over infra-red, as far as I can tell. I've got a roundabout route through the K608i but it doesn't seem to be very reliable. Anyone got any expert tips?

Are opticaljungle.com and publicdomainregistry.com the same people? Their addresses look identical but their phone numbers are different. Both appear to have some connections to directi.com. Is there any way to check if they are the same people? I don't know how to verify US companies when they appear not to want to be verified... Domain Detectives thinks they're both directi

Tomorrow (Thu 29th) at 7.30pm is the Kewstoke annual village meeting. That should be my first meeting as a councillor, if I get back from London in time. (I hope I do - councillors who miss meetings get this sort of criticism but at least village councillors aren't paid that much: I think expenses for all 12 or so councillors totalled under 60 last year.) Apart from the two reports, the agenda is a good summary of the challenges affecting the village this year: Cygnet Liaison, Sand Bay Management and the Toll Road.

During the last 4 days, I didn't read Planet. So I started an interesting exercise and wanted to comment very briefly on a few entries I just read quickly to catch up. My Planet premium, so to say..

• (not Planet related...I read that on NASA mailing lists...some of which I'm subscribed since 1988) NASA's Phoenix lander successfully landed on Mars. This is actually the first successful soft landing on Mars since 1976 (recent landings were hard ones, with airbags....or failures). This stunning picture shows the spacecraft with its parachute during its descent on Mars. It was taken by the HiRISE camera of Mars Reconnaissance Orbiter. The very first time a spacecraft photographs another one while it's landing. Amazing, right?
• Marga and the Spanish keymap: I can't disagree with your comments, Marga. Still, that's a though issue: changing the behaviour of a keymap that's used by millions of users is not a trivial change. OTOH, you're right and that tilde should be dead, indeed. I think there is barely no other option than a fork, here: have both keymaps, one with asciitilde and another one with dead_tilde on the same key combination and let users choose. That keymap should be named "es-standard" to avoid changing the existing "es".
• John Goerzen biking to work: John is among the people I never met but who I know I share ideas and vision of life with. So, seeing him comment on alternative ways to commute to/back work is a pleasure for me (alternative transportation systems with the goal of abandoning the heresy of individual cars is part of my hobbies....while I still don't always apply these principles myself). And, well, seeing someone writing that this is still possible in the flat MidWest of the country that contributes the most to climate change is a relief for me: change can happen.
• Joey reads USENET again. Long time since I last read news... In the past I used to have my own feed, through UUCP. I still receive a lot of my mails by UUCP, though (bubulle@kheops.frmug.org comes this way)
• Pollocks were in Europe. Andrew is another of these people I feel like having connections with while we never met. Next time, plan a stop in Bubulle Hotel and visit Paris, Andrew.
• Dirk mentioned Bike the Drive, which I assume to be a bike-related event in Chicago... Yet another occasion to see there's still some hope for alternatives to cars in the US of A...
• Kartik is back home in Mumbai after some months working in Bangalore (and not enjoying it). I'm happy for him that he can be again with his family.
• Ganneff also bikes. Of course, he does it the geek way. Would you have guessed? Joerg, are you ready for the DebConf daily running tour which I plan to do in Mar del Plata?
• Manoj is the last Emacs user, along with /me
• Jaldhar who I have much respect for in the project, still supports the US republican party, the most conservative party in the so-called western world. It is still completely out of my understanding how FLOSS "spirit" can fit with this (the same stands for the political stance of Eric "Gun" Raymond, indeed). Mysteries...
• Lucas wonders how to find cheap flights. Voyages SNCF (aka Expedia), the online travel agency of the French railway company, always gets my preference. Yes, French *railway*.
• MJ also posts about biking. I have to mention that easy bike-on-demande systems in cities are one of the best ways to develop this. Barcelona's system seems pretty cool. Paris' Velib is amazing and so is the system in Lyon (who initiated the movement in France). All this is something I personnally follow pretty closely (I'm a addicted reader of the French professionnal magazine named "Ville et Transport", "Town and Transportation") in the hope it also develops in my Suburbia.
• Too many technical issues on Planet. I can't follow..:-)

England swings like a pendulum do! There's another fuel price protest and the coverage in the London press is pretty biased, with occasional balanced reports and very rare dissenting opinion. One of the favourite whines on news-and-nutters phone-ins is "waah, I live in a village, I need my car". While that's true for some people, most villagers could switch to bicycles for many journeys without problems. At the moment, the biggest problem with cycling to town is the number of cars on the small lanes, followed by the number of potholes. Switching to cycling or walking will have a triple benefit: fewer cars on the road will free up space for cycling, wear the roads out less and reduce fuel demand (so petrol should become cheaper for those who really need it). Over the last few days, I've been happy to read Bike The Drive 2008 [Dirk Eddelbuettel], Mountainbike, By Joerg Jaspert and How to Start Bicycling to Work, by John Goerzen. A couple of tweaks to that last one: in England, I don't think that a cycling helmet is necessary. I've not worn one for the last few months (it went mouldy after a rain storm) - I find I can hear traffic better and many drivers seem to give me more room on the road. I wonder if helmet-wearing "dehumanises" cyclists to drivers? The safety data seems rather confused, but it's a personal choice. If you feel safer with a helmet, wear one. I also wear ordinary business or casual clothes, relying on a good quality commuter saddle rather than cycling shorts. I suspect that drivers here are developing a sort of blindness to the "screaming yellow" hi-vis jackets, so I don't wear those - but sometimes I wear hi-vis reflective armbands if I'm wearing black in the dark. I agree completely with the comments on that page about being predictable, Cateye lights and pannier bags. Finally, Bike Week 2008 starts on 14 June, which would be an ideal time to try a group ride - or just get a free breakfast for cycling into town.