destroying democracy the easy way

A recent slashdot post caught my eye. It involves two of my favorite topics: e-voting and lockpicking. According to the slashdot article, Diebold (a company which makes e-voting machines) recently posted, on their own freaking Web site, high-quality images of the key which can be used to unlock the access panels on their e-voting machines. The images were apparently good enough that it was possible for someone to make a quick trip to Home Depot, buy a metal file and a few blanks of the right kind of key, file the keys to the correct shape, and start unlocking Diebold machines.

Word to the wise: next time you feel like photographing your keys (and let's face it, who doesn't love photographing their keys?), put the pictures in a scrapbook on your bookshelf, not the Internet.

flickr: more 'screw the users!' from yahoo

Yesterday photo-sharing Web site Flickr (owned by yahoo) announced some changes which have angered lots of their users. Each flickr user will have to start signing in with his/her yahoo account username/password (lots of users currently log in with a flickr username/password, so they'll have to change), and there are some new limits being imposed on flickr data (there will soon be a limit of 3000 contacts and a limit of 75 tags per image).

I only recenty started using flickr, and have used my yahoo account for all of that time. And the new limits don't affect me. So this isn't too big a deal for me personally. But it's another example of arbitrary changes imposed with little or no warning or user involvment, much like the recent utter ruination of yahoo TV. Not everything they do is horrible: I like the new yahoo mail (beta). But if they keep alienating their users, they may find that their shiny new upgrades aren't that good for business.

Image inputs in MSIE7 -- revisited

My previous post was a whinefest about image inputs in MSIE 7. This problem turns out to be worse than I thought. In that post, I said that the problem could be circumvented by taking either of two measures, one of which was changing to a submit-type input element. Today I found out that this solution is inadequate, because the name/value pair are still not sent in the POST data if you hit return rather than clicking the submit button.

<* input type="submit" name="ick" value="gakkk" />

If you actually click the submit button in a form (in MSIE 7) containing the above code, then the ick/gakkk pair will be included in the POST data. But if you just hit the return key in the form (which is how I typically submit forms), the ick/gakkk pair won't be sent.

So, I'll have to stick with the other corrective measure and put the ick/gakkk pair in a hidden input, replacing the above HTML with this:

<* input type="hidden" name="ick" value="gakkk" />
<* input type="submit" value="MSIE 7 blows" />

Crap.

Image inputs in MSIE7

I saw a post in the last couple of days saying that <* input type="image"> doesn't work in MSIE7. I've recently been working on a project which happens to have one of these elements. I tested it in MSIE7 today, and sure enough, it doesn't work. But it's broken in a very subtle way.

The element in my project looks like this...

<* input type="image" name="ick" value="gakkk" src="button.jpg" />

...and the interface to which this form POSTs looks for the ick field. Looks to me like MSIE7 just doesn't send any name/value data in one of these elements when the form is submitted. All the other form fields make it into the POST data, just not the ick/gakkk pair.

Either of the following seemed to make it work as expected:

1. turning the input element into a normal type="submit"
2. moving the ick/gakkk name/value pair into a hidden input element in the form

I don't know if this is a bug in MSIE7 or if it is intentional behavior. The W3C HTML4.01 recommendation for the input element lists the name and value attributes, with no obvious (to me) exception for image-type input elements.

*sigh* Just one more stupid thing I have to remember when designing Web applications.

Ice storm aftermath

Pictures taken after an ice storm in Versoix, Switzerland. The icicles on the trees are pretty amazing.

This was posted on digg.com, where several of the commentors said that since the ice blew in off Lake Geneva, it's not really an ice storm. Whatever. It's a lot of ice.

Brrrrr.

superhero/supervillain quiz

There's a pretty cool quiz at http://www.thesuperheroquiz.com/ which tells you which superhero you most resemble. I turned out to be the Hulk (70% likeness). This puzzled me until I remembered answering "all the way YES" to "do you anger quickly/easily?".

After you take that quiz, there's a link to find out which supervillain you most resemble. Looks like I have an 86% correspondence to Dr. Doom: "Blessed with smarts and power but burdened by vanity." (That latter part might sting if it were less accurate.)

gmail backup

Today there was a report of some data loss for 60 gmail users. They lost all their mail, their address books, etc. Lame.

This prompted me to look into methods of backing up my gmail account. Looks like it's a simple as changing a gmail setting (enabling POP3) and setting up a POP3 account in your favorite mailer (Thunderbird, Outlook, ...). It's a straightforward procedure. It takes a while to download all your mail the first time, and thereafter it just downloads new messages. It probably wouldn't allow a user to restore a mangled gmail account, but it would at least provide an external backup of all the messages. Unfortunately, it doesn't look like this process preserves message labels.

And it looks like you can export your address book, too: click 'contacts' (left-hand panel) and then click 'export' in the upper-right.

vmmouse for Linux VMWare guest

I decided to give Ubuntu a try to see what all the fuss is about. But I wasn't ready to install it on my laptop (I'm in the middle of a project in which I rely quite a bit on the laptop), so I decided to try Ubuntu in VMWare server on my desktop. Ubuntu installed OK, but the mouse didn't work well: I had to click in the VMWare window to make the mouse work in Ubuntu, and then I had to press Ctrl-Alt for VMWare to release the mouse (to use it anywhere outside the VMWare window). It was doing this even after I installed VMWare-tools.

That's a real drag, all the more so since that doesn't happen when running Windows XP in VMWare (the mouse 'just works': you can just roll the cursor in and out of the VMWare window and it works as it should).

The trick is to install the 'vmmouse' driver (which comes with VMWare-tools) in X.org in the Linux guest. (This solution comes mostly from a post by 'zaroff' on the Ubuntu Forums.)

After installing Linux in VMWare server, click VM->Install VMWare Tools... on the VMWare menu. This makes Linux think you've just mounted a CD with a couple of files on it (the 'CD' will probably show up on the desktop). Unpack the .tar.gz file, cd into the vmware-tools-distrib directory, and run the vmware-install.pl installer.

When I did this, I found that when the installer re-wrote /etc/X11/xorg.conf, it didn't put in a DefaultDepth directive in the "Screen" section, and I had to add a DefaultDepth 24 line to that section.

Next you need to install the vmmouse driver. A good start is to run the following inside the vmware-tools-distrib directory:

find . -type f -name 'vmmouse*'

You need to copy the correct vmmouse driver (depending on what version of X.org your Linux guest is running) into the X.org input modules directory. For an Ubuntu 6.10 Linux guest, I needed to copy the XOrg/7.0/vmmouse_drv.so to /usr/lib/xorg/modules/input. (A friend was having the same trouble running a CentOS 4.4 guest: he needed to copy XOrg/6.8.x/vmmouse_drv.o to /usr/X11R6/lib/modules/input/.)

Next you need to make 2 changes to /etc/X11/xorg.conf:

1. add Load "vmmouse" to the "Module" section
2. change Driver "mouse" to Driver "vmmouse" in the "InputDevice" section

Then restart X (or reboot).

Fedora Legacy Project Closing

I maintain several front-line servers (exposed to the Internet) which have run Fedora Core 3 (FC3) for a couple of years, and I have relied on the Fedora Legacy Project to provide security updates for those servers. The Fedora Legacy Project is a community project providing security updates to versions of Fedora and Red Hat which are no longer supported by Red Hat.

The project has gone above and beyond, and I'm grateful for their efforts.

Last Tuesday (12 December 2006) they quietly announced that they will no longer be providing updates for FC3, FC4, or any other damn thing. I say 'quietly', because I didn't hear about for nearly a week. I don't think it made digg, Slashdot, or any of the other technology-related Web sites that actually have RSS feeds. I'm not upset that they ended support--I'm happy that I was able to run that Linux distribution (especially one as volatile as Fedora) for as long as I did. But for the support to dry up with no warning (at least, I didn't see it coming), and for me to get that news less than a week before the holiday break at my work, really sucks out loud. Now I have to bust my hump to install a operating system with some measure of support on all those servers before Friday.

Thanks for all the advance notice! Happy freakin' holidays!!!!!

Downloading YouTube ...

Saw this yesterday and thought it was cool. The All-In-One Video Bookmarklet lets you download videos from YouTube, Google Video, and a number of other Web sites. You save the bookmarklet (go to the above link, and then on that page right-click on the All-In-One Video Bookmarklet link and pick the bookmarking option), go to the Web page of a YouTube/Google/whatever video you want to save, and then hit the bookmark. You'll get a page which allows you to download the movie in one or more formats.

If you want to try this out, here's a link to a short and funny video about a cat with depth perception problems (remember that you'll have to go save the bookmarklet first). That video makes me laugh out loud every single time (I think it's the sound that really does it for me).

ePassports

For months I've been reading about these new passports. And for months I've been meaning to go get a passport, in hopes of getting the old kind. I'm probably already too late.

The new passports have RFID chips in them. RFID stands for radio frequency identifier. An RFID chip is a small device which transmits short-range signals which uniquely identify the transmitter. This sort of thing has been used for years for stuff like electronic toll collection systems. You have an RFID transmitter in your car so that you can roll through the toll booth without stopping to pay. The toll booth electronically records your passage, and you get billed later.

Unfortunately, RFID raises all kinds of security and privacy concerns. RFID tags are useful, because they can be read so easily. No physical connection (like swiping a credit card or ID badge) is required: proximity is sufficient for an information exchange. But this means the information can be collected by someone other than the intended recipient. It's been shown over and over again that information stored in RFID tags can be read surrepticiously with inexpensive, off-the-shelf equipment. A recent example involves RFID chips in sneakers.

And now they're putting these things in passports, and the same kinds of remote information retrieval have been demonstrated. Government agencies implementing these technologies say that it's safe. But what else are they going to say? They've invested a lot of money in these systems, so they're not necessarily objective or fothcoming.

One of the things in my job that really annoys me is the "Ooooh, shiny!" mentality: people see something new, and they want it just because they thing it's cool, not necessarily because it's a good idea. This is the feeling I get about RFID in passports. I think people are jumping on a bandwagon without taking the time and effort to do reasonable risk analysis.

A number of interesting RFID countermeasures have surfaced:

• an RFID personal firewall, which aims to restrict RFID communications within a certain distance
• special wallets which block RFID transmissions (it's a Faraday cage in your pocket)
• some people even recommend throwing your new passport in the microwave for a few minutes to fry the chip

Bruce Schneier has a good write-up about the new passports.

Maritime movies: eating and crashing

A couple of interesting posts made it to digg.com homepage overnight. One concerns a company which makes tables for boats. These 'capstan' tables are expandable, like a rectangular table which can be enlarged by adding leaves. But these tables are round, and they get bigger or smaller just by rotating them. Check out the movie clips. (Here's the digg post w/ comments.)

The second clip shows an accident in which a boat crashes into a bridge (apparently no one was hurt). This is a moving bridge--I saw one of these at OSCON in Portland. This one isn't a drawbridge, but a 'lift' bridge: the motorway lifts straight up using cables and pulleys, leaving room for the ship to pass underneath. When watching the video, pay close attention to the bridge at the beginning of the clip. (Here's the digg post w/ comments.)

interesting pictures

I took a couple of weird pictures recently.

The other day I was about to leave my apartment for work, and I saw this just outside my door. The faucet was dripping, and it made a cool-looking ice stalagmite:


And the other night I was throwing away a beer bottle (yes, I'm destroying the environment--talk to my state legislature), and it made a funny sound when it landed. When I looked at the trash can, I saw that the bottle had landed on the edge, and the bottle's tip had come to rest on the table. I thought about computing the odds against this, but then decided just to go get another beer.

I'm in Dilbert

A co-worker referred me to the 22 November 2006 Dilbert cartoon, and I thought it was pretty funny.

Yahoo TV Completely Ruined

I've used Yahoo TV listings for years. They changed it the other day, and the new version is utter crap. It used to be simple and fast. Here are a few of my more vitriolic gripes:

1. the page loads a little bit at a time as the user scrolls down the page: so browser searches don't work, and it's very slow
2. you can only browse in 3-hour increments: if a show starts prior to the current 3-hour block, you can see that something is showing, but you can't see what it is
3. it doesn't remember that I only want to see my favorite channels: it defaults to showing every channel offered by my cable provider

Two digg posts about this have made it to the front page, and there's a post on Yahoo's blog about the change. The comments on all three of these are overwhelmingly critical:

• http://digg.com/design/Redesigned_Yahoo_TV_Gets_A_New_Do
• http://digg.com/tech_news/Yahoo_Gets_Trashed_By_Users
• http://yodel.yahoo.com/2006/11/28/anything-good-on-tonight/

I'm really hoping they'll change it back (or at least make it suck less). I admit to being generally inflexible: I typically don't like change under the best of circumstances. But this is pretty disappointing. There are several other sites offering online TV listings. Guess I'll switch to whichever one pisses me off the least.

Lockpicking Guide

Locksport International (LSI) has created a pretty interesting guide to lockpicking. It talks about the techniques of picking locks and how to make the tools:

LSI Lockpicking Guide (HTML)

LSI Lockpicking Guide (PDF)

There's also lockpicking101.com, a set of forums about lockpicking.

248 ways to annoy people

I thought this was pretty funny:

http://www.dbooth.net/internerd/annoy.cfm

#216 is my favorite, with #185 a close second.

Interview w/ Slackware's Patrick Volkerding

I used the Slackware distribution of GNU/Linux for several years. It was my first distribution, and I think it's a really interesting project. That distribution's creator, Patrick Volkerding, recently sat for a 90-minute interview with the Linux Link Tech Show (direct MP3 download). I'd never heard his voice before. It's a good way to waste an hour-and-a-half.

Griffith Observatory Reopens

Looks like the Griffith Observatory reopened today after a $93 million four-year renovation and expansion project. It was closed during my visit to LA a few months ago, which was disappointing. Oh, well. Maybe next time.

Perils of e-Democracy

The following article details some of the hazards of electronic voting. It's somewhat long, but it's very interesting (and a bit frightening):

How to steal an election by hacking the vote

I especially like the default password of '1111' on the voting machines, and the fact that this is probably still the password on a large number of these machines. And the fact that the same key (the same little chunk of metal) will access the memory card on every single machine.