Perils of e-Democracy

The following article details some of the hazards of electronic voting. It's somewhat long, but it's very interesting (and a bit frightening):

How to steal an election by hacking the vote

I especially like the default password of '1111' on the voting machines, and the fact that this is probably still the password on a large number of these machines. And the fact that the same key (the same little chunk of metal) will access the memory card on every single machine.

20 Worst Video Games of All Time

The following article lists what the author things are the 20 worst video games ever...

http://seanbaby.com/nes/egm.htm

And the reason I think this is blogworthy? I had a copy of the #1 game as a kid. Yeah, it sucked.

Season 3 premiere of Lost

I watched the season 3 premiere of Lost tonight.

I bought season 1 on DVD a little over a year ago having never before watched the show. I was hooked after about 2 episodes. But by the time I finished watching season 1, season 2 had already started. I didn't want to come into the season partway, so I just didn't watch season 2 until I bought that on DVD about a month ago.

So tonight was the first time I'd watched Lost in prime time. I gained two pieces of insight from the experience:

1. Lost rocks
2. commercials suck

I'm just hoping that season 3 of Lost is better than season 3 of Alias.

*NIX directory listing into MSExcel

Today a co-worker asked me to help him prepare a report of email accounts on a Linux box running postfix. He wanted a list of the inboxes, their sizes, and their dates of modification. He wanted it in a text file that he could import into a spreadsheet program. After some experimenting, we came up with the following:

ls -lt --time-style=long-iso /var/mail/
  | grep -v ^total
  | awk '{ print $5 "," $6 , $7 "," $8 }'
  | sed -re 's/$/\r/'
  > /tmp/mail_list.csv

The -lt argument to ls gives the long listing and sorts by modification date (in descending order), and the --time-style=long-iso argument ensures that the timestamp format is uniform for all files (without it, you might get one timestamp format for files younger than about 6 months and a different format for older files).

The slash at the end of /var/mail/ is also important, as /var/mail is often a symlink to /var/spool/mail/, and ls -l /var/mail lists the symlink rather than the contents of the referenced directory.

ls -l of a directory typically produces a line resembling total NNNN (where NNNN is some integer) at the beginning of the output, so the grep -v ^total filters out any line starting with 'total'.

The awk command pulls out the 5th, 6th, 7th, and 8th columns of the space-separated text and formats the output as CSV (comma-separated variable). A couple of lines of output might look like this:

41951950,2006-09-13 05:29,root
723,2006-06-13 14:37,martinez

The sed filter inserts a carriage return character (\r) in front of each newline, giving the text DOS line termination (saves us the extra step of running unix2dos on the output file).

Finally, the output is redirected to a file which can be downloaded via an SFTP client and then opened in MSExcel by simply double-clicking on the downloaded file.

Unholy Version Control

Not long after lunch today my Subversion repository hit revision number 666.

My first instinct was to draw a pentagram on my computer monitor in goat's blood. It then occurred to me that I had neither a readily-available supply of goat's blood nor the means to acquire any.

It also occurred to me that drawing a pentagram on my monitor in goat's blood might make it difficult to use my computer and that my employers might find the whole thing somewhat difficult to understand.

So I just pushed along to #667.

_Lost_ season 2

Last night I finished watching Lost season 2 (I bought it on DVD last week). Wow. Can't wait for season 3 to start (looks like that's on 4 October).

_Manhunt..._ by James L. Swanson

The other day I finished reading a really good book called ManHunt: the 12-Day Chase for Lincoln's Killer by James L. Swanson. I never knew (or didn't remember) that Booth wasn't acting alone: he was the ringleader of a larger conspiracy whose original plan was actually to kidnap Lincoln and take him into the Confederacy. Then when Lee surrendered at Appomatox, Booth and his co-conspirators changed their plans and created a scheme to kill not just the President, but also Vice President Johnson and Secretary of State Seward--all on the same night. In fact, General Grant was supposed to be attending the play that night in the same box as the Lincolns. If Grant hadn't changed his plans, he might have been there when Booth attacked.

It was a fascinating book. It appears to have been very well researched, and the author has a gift for narrative prose (this is coming from a reader who typically has trouble being interested in reading historical accounts).

Video of 'bumping' locks

Today I found a video demonstrating the 'bumping' technique (see a previous post of mine). It looks frighteningly easy.

http://video.google.com/videoplay?docid=-5177213949300140850

LA trip

I went on vacation with friends to LA about a month ago. It was a fun trip. I flew out with L, K, A, and M on Saturday 5 August to LAX. We rented a car and drove to Valencia, where we met H and R.

I've uploaded some of my pictures from the trip to a Flickr set.

We went into Hollywood on Sunday and walked up and down Hollywood Boulevard. It was pretty cool seeing the stars on the sidewalk. I especially enjoyed the Kodak and Grauman Theatres.



We ate at the Wolfgang Puck restaurant (Vert) in the Kodak Theatre. If you get the chance, try the chicken salad.

On Monday, K, L, A, and M went to Six Flags (Magic Mountain), and H, R, and I took a day trip. This was probably my favorite part of the vacation. It was very relaxing and beautiful. We had lunch at a little French restaurant in Ojai, and then we stopped and took a few pictures of the lake at Ojai. Then we went to Santa Barbara and spent an hour or so on the beach. Santa Barbara is really pretty, and I think I'd like to go back and spend some more time there. We also walked around in Ventura for a couple of hours before heading back to Valencia. That night, H, R, L, A, and I had dinner at a great place in Valencia called BJs. They have really good beer.



We spent Tuesday at Universal Studios. My favorite part was the Waterworld show. I hadn't seen the movie, because I'd heard it was pretty bad, but the live show was awesome. (I've since watched the film. Wow, it's really terrible.) I don't usually do roller coasters (translation: never), but L convinced me to ride the Mummy. It's an indoor coaster, and it was pretty fun (except that the woman sitting next to me desperately needed a shower, and she kept elbowing me in the face). We rode it twice and got pictures. We took the studio tour, and that was very cool. It was neat seeing the outdoor sets that I've probably seen in scores of movies and TV shows. That's an impressive amusement park--it's really huge.

Wednesday we moved from Valencia to Santa Monica, and we drove out to Burbank to see a taping of "The Tonight Show." That was really interesting to me. They filmed it in real time, so the whole thing just took an hour or so. The band (with Kevin Eubanks) played during the commercial breaks. I was amazed at how small the set is. They really make it seem much bigger on the show. Mariska Hargitay was supposed to be the first guest that day, but she cancelled due to a family emergency. I hadn't heard of the guests who did appear: a rather forgetable actress, a very forgetable musical guest, and an interesting fellow named Travis Pastrana, who did a double backflip on a motorbike at the X Games.

Thursday we just hung out on the the beach, lounged around at the hotel, and checked out the Santa Monica pier. That night we ate a delicious meal at
Sushi Roku at Santa Monica and Ocean.


Friday we drove from LA to Vegas. We'd planned to fly, but that was just a day or so after the terrorist scare. None of us wanted to deal with airport security, and it was just a four-hour drive, so we braved the heat and headed into the desert. It wasn't what I expected. I guess I was expecting the Sahara with nothing but sand and dunes, but there were plants and mountains. It was really quite beautiful. We stayed at the Golden Nugget that night. E and D met us there, and it was really great seeing them. That night we walked around on Fremont Street and saw the light show.


Then Saturday A, H, and I flew home. We expected trouble at the airport (because of increased security measures), but it was no big deal. I think M said it was less than 30 minutes between our arrival at the airport and getting through security.

Nightmare

Just had a nightmare. I don't remember much, but I remember that there was a woman, and she was some sort of time paradox. If I were to encounter her, it would somehow erase my own history--I'd never have existed.

I woke up, and she was standing in my room, talking to me.

That's when I actually woke up, because I think I was moaning and crying out.

What do you do when even your nightmares are stupid?

Defeating locks by 'bumping'

This is probably one of the most interesting things I've read in a while. It's about defeating consumer-grade locks with a method called 'bumping', which I guess is somewhat similar to picking, but supposedly faster and more reliable. Assuming the accuracy of the article, it's scary how easily these locks can be nondestructively defeated.

http://www.engadget.com/2006/08/24/the-lockdown-locked-but-not-secure-part-i/

At any rate, I learned a lot about how locks work.

OSCON day 5

Short day today (just two morning sessions after the keynotes). Damian Conway gave a very funny keynote about patents. He's a really good speaker.

My first session was "Extreme Perl Makeover" by Peter Scott. This was another 'best practices'-type talk. The speaker suggested a couple of useful-sounding Perl modules: Text::Outdent sounds good for doing HERE documents without having to move them over into column 1, and Inline::Files lets you have several separate data sections after __END__.

Next was "Perl Hacks You Never Knew Existed" by chromatic. Just about everything he said went right over my head. But his talk got me interested in the Attribute::Handlers and Attribute::Method modules, which implement the subroutine attributes that I've seen in Catalyst and Class::Std. I managed to overcome the urge to get chromatic to sign my new copy of Perl Testing: A Developer's Notebook.

OSCON day 4

One of this morning's keynote speaker was a fellow named Jason Scott. He made a documentary about the online bulletin board systems of the 1980s. His Web site is www.textfiles.com.

Some pretty cool sessions today. The first was "Subversion Best Practices" by Ben Collins-Sussman and Brian Fitzpatrick (both from google). A lot of what they said I'd gotten from the documentation. But they talked about a couple of features I hadn't heard of: autoversioning and autoprops. And they described a neat trick involving making the document root of a Web site be a working copy of a project, with a hook such that the working copy is updated whenever there's a change in the repository.

Next was "Low-Maintenance Perl" by Perrin Harkins. Most of his talk was along the lines of "don't do this in your code". Most of the things he discouraged were things I hadn't heard of or knew to be generally 'bad'. So that was somewhat encouraging. Damian Conway and Larry Wall were both in the audience--if this made the speaker nervous, he didn't show it.

After lunch (which was provided by OSCON [Aramark]), I went to "SQL Outer Joins for Fun and Profit" by Bill Karwin. He solved several interesting problems with outer joins. He used a syntax that I hadn't really seen before: he put row-elimination statements in the ON clause, stuff I'd only ever seen in WHERE clauses. He pointed out that the WHERE clause isn't evaluated until after the join, so it's often quite beneficial to eliminate rows in the ON clause (fewer Cartesian products that way).

Next was "Writing Maintainable Code with PHP" by Laura Thomson from OmniTI. I actually found her point of view a little puzzling. She said that, in general, she doesn't like frameworks, database abstraction layers, or templating engines. As I've come to rely pretty heavily on the latter two and am interested in starting to use the former (I have yet to find a PHP framework that I don't hate), I have trouble understanding how code which doesn't use any of those components is more maintainable than code which does delegate those tasks. But overall I thought it was a good talk, and she made lots of good arguments for creating a set of coding guidelines for your organization (how variables are named, how code is indented, documentation templates, lots of other stuff).

Then there was "Understanding ZFramework" by John Coggeshall. I confess that I sort of zoned out after I learned that the Zend Framework requires PHP 5 (I'm kind of stuck with PHP 4). However, it looks like ZF has a nice input validation component written by Chris Schiflett.

Finally, I went to "The Conway Channel 2006" with Damian Conway. He talked about a couple of modules he's been working on: List::Maker and Contextual::Return. C::R looks particularly cool. It does what wantarray() does, but also distinguishes between the different possibilities in scalar context (a string, a number, a hashref, an undef, etc). The module has lots of neat features and is very flexible.

Powell's bookstore was one of the exhibitors/vendors, and they were offering a 35% discount. So I bought a copy of Perl Testing: A Developer's Notebook. It's ordinarily around $30, and I got it for around $20.

And I talked to my high school buddy for around an hour. Sure enough, he's getting married. It was really good talking to him. I hope I'll be able to go to the wedding.

OSCON day 3

Started the day by learning that my workstation at work probably has a bad hard drive. When my officemate rebooted it, he saw those two magic words...

kernel panic

Oh, well. I've (probably) got good backups.

I attended several sessions today. The first was about compiling a kernel to improve speed (only the drivers you need) and security (so a cracker can't load kernel modules--the speaker advocated a monolithic kernel, if possible). The speaker (Steve Suehring) mentioned a security-related patch called grsecurity, which sounds interesting. I wonder how it compares to the openwall kernel patch (hmmm, guess that's just for 2.4).

Next was "Maximum Netfilter" by Michael Rash of Solirix. He talked about several netfilter-related programs. fwknop does something called single-packet authentication, which is a more secure (albeit less convenient) version of port-knocking.

Then I went to "The Madness of AJAX" by Andrew van der Stock (it was about AJAX security). That was actually a little scary. Not because of anything that I've coded or something a co-worker has coded (I don't feel the need to run home and rewrite a bunch of AJAX), but the speaker did several demonstrations which were just spooky. Looks like several of the PHP AJAX toolkits have significant input validation problems, which are a little too reminiscent of register_globals. I'd like to buy a book on the subject, but there don't really seem to be any books on AJAX security (too new, I guess).

I finished out the day by attending the Perl lightening talks (a bunch of 5-minute presentations). It was sort of a strange potluck, punctuated by a rather bizarre performace called "A Perl module installation in 5 unnatural acts". But it gave me a few things I'll want to read about later: App::Ack (source code searches), Perl::Critic ('use strict' on methamphentimines), and stubmail.com (a re-implementation of SMTP by the SPF guy).

And I got voicemail from an old high school buddy of mine. Haven't heard from him in nearly 5 years. I suspect that he's renewing contact to send me a wedding invitation (good for him, if that's the case [good for him, in any case]). Maybe we'll be able to stay in touch this time.

OSCON Day 2

Another couple of tutorials today. The first was "Advanced Perl DBI" by Tim Bunce. He showed up 15 minutes late, which was fairly annoying. But it was otherwise a good session. I learned lots of interesting and useful things. For example, fetchrow_arrayref() is faster than fetchrow_hashref(). And not a little bit faster, but several times faster. I like the convenience of fetchrow_hashref(), so that I can reference column values by name, rather than array index. But I learned that I can get much the same effect (and much more efficiently) using fetchrow_arrayref() and bind_columns().

I also learned that the DBI has built-in profiling capabilities, and prepare_cached() can be used in place of global statement handles.

The afternoon session was about testing Web applications. Part of the tutorial was about Grinder, a free load-testing tool (apparently, most such tools cost obscene sums of money). It looks pretty hard to use, but might be helpful. But most of the session was about a unit-testing tool called Selenium, which is also free. By contrast, it looks pretty easy to use. I downloaded it and ran the default test suite in Firefox. Two of the tests failed: they dealt with popup windows, which Firefox blocks by default. I then disabled popup blocking and re-ran the suite, and all the tests passed. Pretty cool.

Looks like my workstation at work has gone crazy. The kernel thinks that all the filesystems are read-only. I can't even reboot the thing remotely--I'll have to get my officemate to do it manually tomorrow. I never had this problem with Slackware, but I've now seen it three times with RedHats (twice on Fedora and once on CentOS). I'm wondering if it's LVM. I've never actually really used LVM features (like resizing a partition), so maybe I should go back to normal partitions.

The restaurant here in the hotel has an amber ale on draft called Drop Top. It's yummy.

OSCON day 1

I'm at OSCON this week. I flew here yesterday (without incident). There were at least three other OSCON'ers on the DFW->PDX flight. The goodies aren't as cool this year: the bag is a canvas tote (we got nifty backpacks last year), and there were no really fun toys inside. Oh, well. I registered early, so I got the _AJAX Hacks_ book.

The wireless access is pretty spotty. I remember it being more reliable last year. Maybe it'll improve as the week goes on. The internet connection in my hotel room didn't work yesterday afternoon, but it's good now (it's how I'm doing this).

My room is a lot smaller this year (which is fine). But it's a nice view--I can see Mt. Hood. We actually flew right past Mt. Hood on the way in yesterday (I was surprised by how close the plane flew to the mountain).

This morning's tutorial was MySQL optimization. It was very informative. The speaker took the approach of optimizing queries over server configuration tuning (although he talked about that, too). Lots of good information. Looks like there's a possible InnoDB replacement engine coming out later this year called Falcon--that's good news, in case Oracle changes the InnoDB licensing or something (that came up in a question this morning--the speaker [Jay Pipes] said that it's "business as usual" for two years).

This afternoon was 'Higher-Order Perl' by Mark-Jason Dominus. He's really funny. The first half of the talk was really good (lots of the second half went right over my head). He talked about iterators, which was very interesting (good alternative to File::Find). He started his talk (which he gave barefoot) by throwing two chairs off the podium.

Perl's Class::Accessor

If you find yourself writing a Perl module for a class with a large number of attributes and a correspondingly large number of accessors and mutators ('getters' and 'setters'), you might want to try Class::Accessor. With Class::Accessor as a base class, your module can just declare its attributes, and Class::Accessor will generate all the accessors and mutators (and the constructor) automatically.

(Your Perl distribution may not include Class::Accessor, in which case you'd need to install it from CPAN.)

Here's an example of how you might use Class::Accessor:

package MyPerson;
use base qw/ Class::Accessor /;
MyPerson->mk_accessors(
  qw/
    fname
    mname
    lname
    birthdate
    address
  /
);

1;

Then in your Perl program:

use MyPerson;

my $person = MyPerson->new(
  {
    fname     => 'Homer',
    mname     => 'Jay',
    lname     => 'Simpson',
    birthdate => '1 January 1970',
  }
);

my $birthdate = $person->birthdate(); # $birthdate is now '1 January 1970'
$person->address('742 Evergreen Terrace, Springfield'); # sets the address attribute

Note that you didn't have to explicitly write a constructor--your code just gives new() a hashref of the attributes you want to set.

You can now even use MyPerson as a base class. Another package can inherit from MyPerson and add its own attributes:

package MyCustomer;
use base qw/ MyPerson /;
MyCustomer->mk_accessors(
  qw/
    billing_address
    shipping_address
  /
);

1;

The documentation for Class::Accessor is worth reading--it offers ways to declare read-only and write-only attributes (the former would only have accessors, and the latter would only have mutators).

Lightswitches are evil

I really hate standard lightswitches.

Evidently, I have this irrational, deep-seated aversion to touching lightswitches. Dunno why. But when I want to turn one on or off, I just naturally swing at it with the intention of barely and briefly touching it with my fingertip.

Trouble is, I usually miss. Which angers me. So I swing at it again, only harder, to punish it for evading me. So, of course, I miss again, which angers me more. This continues until I typically end up hitting the lightswitch with a shoe or something.

If I had any sense, or if I were a normal person, I'd just calmly and sanely sweep my whole hand down (or up) over the lightswitch. But that apparently entails more physical contact than my neurosis can withstand.

Maybe I need one of these: http://www.gogglemarks.net/index.php?action=display&tag=fightswitch

Recovering Grammer Snob

I just read June Casagrande's _Grammer Snobs Are Great Big Meanies_ (Penguin, 2006). It's a guide to avoiding common grammatical errors and to dealing with people who think they know more about the English language than they actually do.

The book is awesome: very helpful, and very, very funny. It's only about $14 retail, and worth every bit. I borrowed it from the library, but I'm going to buy a copy. (The book has a website at http://www.grammarsnobs.com/.)

Here are a few notes (to myself) that I jotted down while reading the book.

'correct' (perhaps not unanimously):
e-mail
website
preventive (not preventative)
'entitled' for rights/privileges, 'titled' for the name of a book

The _Chicago Manual of Style_ (used for books) recommends using the Oxford comma. The _AP Stylebook_ (used for newspapers [and, arguably, blogs]) recommends omitting the Oxford comma. (The Oxford comma is the second comma in the following sentence: This blog is simultaneously pedagogical, pedantic, and pedestrian.)

Newspapers tend to use _Webster's New World College Dictionary_ (too bad for colleges of the old world), and books tend to use the _Merriam-Webster Collegiate Dictionary_.

A screed is a long discourse. And a cool word.

Use 'which' for nonrestrictve clauses, and 'that' for restrictive clauses:

1. This blog, which has a silly and misleading title, will be useful and/or interesting to a very small number of readers (on a good day).
2. The _Best of Blondie_ CD that I bought last night is really bitchin'.
   

'prurient' means interesting (even lurid). 'purient' (to my dismay) does not appear to be a word at all. (I blame dog food manufacturers.)

Web 2.0 URLs w/ Apache

(Yes, the term 'Web 2.0' is ridiculously overhyped.)

Let's say you have a Web application which takes two optional GET variables v1 and v2. Let's assume that v1 is always an integer and that v2 is always a character string. We'll also assume that a DirectoryIndex index.php directive has been applied:

http://www.example.com/somedir/index.php?v1=27&v2=hello

And let's say your application has an administrative interface in an 'admin' subdirectory:

http://www.example.com/somedir/admin/admin.php

Try putting the following in your Apache configuration (this assumes that mod_rewrite is enabled):

RewriteEngine on
RewriteBase /somedir
RewriteRule ^admin - [L]
RewriteRule ^(\d+)/([a-z]+)/?$ /somedir/index.php?v1=$1&v2=$2 [L]
RewriteRule ^([a-z]+)/(\d+)/?$ /somedir/index.php?v1=$2&v2=$1 [L]
RewriteRule ^(\d+)/?$ /somedir/index.php?v1=$1 [L]
RewriteRule ^([a-z]+)/?$ /somedir/index.php?v2=$1 [L]

(You could put this in an .htaccess file if your Apache configuration applies an AllowOverride FileInfo directive to this part of your content area.)

You application should now be accessible by any of the following URLs:

http://www.example.com/somedir/hello/27/
http://www.example.com/somedir/27/hello/
http://www.example.com/somedir/hello/
http://www.example.com/somedir/27/
http://www.example.com/somedir/

The first and second URLs should set both variables, the third URL should set v2 only, the fourth should set v1 only, and the fifth should set neither (the fifth URL should still run the application because of the DirectoryIndex index.php directive).

Of course, it doesn't have to be '27' and 'hello'--it can be '42' and 'foobar', or whatever.

And your admin interfaces should still be accessible as before (the dash in the 'admin' RewriteRule means 'no alteration').

In the example I've used PHP as the hypothetical Web application, but the language doesn't matter--this is all Apache magic. But if you want to test this with some PHP code, try this in index.php:

header('Content-type: text/plain');
$v1 = '';
$v2 = '';

if ( isset($_GET['v1']) && $_GET['v1'] ) {
   $v1 = $_GET['v1'];
   printf("v1 is %s\n", $_GET['v1']);
}
else {
   printf("v1 not set\n");
}

if ( isset($_GET['v2']) && $_GET['v2'] ) {
   $v2 = $_GET['v2'];
   printf("v2 is %s\n", $_GET['v2']);
}
else {
   printf("v2 not set\n");
}