noscript

I've been using the flashblock Firefox extension for a long time. There's nothing more annoying (to me) than going to a Web site littered with a bunch of flash movies which slow the page load, distract me from the important content, or crash my browser. The flashblock extension replaces each flash movie with a link you can click to enable that flash movie, allowing you to enable only the individual movies you want to view.

The noscript Firefox extension disables all JavaScript in your browser. You can temporarily or permanently whitelist Web sites in noscript, allowing JavaScript from the sites you trust. This is a good idea: just start reading some of the stuff at Planet Websecurity if you need convincing.

Unfortunately, the two extensions are incompatible, because flashblock uses JavaScript to replace the movies (and noscript disables JavaScript). Until this week, I'd chosen flashblock over noscript, because my annoyance with flash exceeded my fear of JavaScript. I really can't defend that decision. shrug

But this week I took another look at noscript and discovered that noscript can disable flash in the same way that flashblock does. Looks like the developer(s) added that feature in version 1.1.0 (August 2005). Guess it's been that long since I'd tried noscript (or else I didn't look at the feature list very well). Anyway, I've switched to noscript.

dailylit.com

A recent issue of Wired clued me in to dailylit.com. dailylit.com has a bunch of public domain publications (mostly classical literature) which they have carved up into bite-size chunks deliverable via RSS feed. So you can go to dailylit.com, pick a book, and subscribe to it in your RSS reader. You get a post every day (or 3 times a week, or every weekday) which you can read in a couple of minutes. It's pretty cool. I'm reading Sir Arthur Conan Doyle's A Study in Scarlet (the first Sherlock Holmes story).

There's also the feature that each post comes with a link to tell dailylit.com to release the next post (rather than waiting until the next day). This feature has a caveat if you're using an online RSS reader like Google Reader: although dailylit.com immediately puts the next post in your feed, the post won't show up in your reader until the RSS service checks the feed again (which might take hours).

Be warned that the catalog at dailylit.com isn't nearly as extensive as something like Project Gutenberg. But the selection isn't bad, and it's a neat way to read a book.

Sirens of Song (Internet radio)

I'd never tried Internet radio, but became interested when I read a recent polishlinux post about how to listen to Internet radio. The post didn't say much about how to find content, so a quick google search yielded www.live365.com. live365 has lots of stations of all kinds of music. I've been enjoying Sirens of Song (which has its own site at www.sirensofsong.com).

OOXML Monkey in the Wrench

I've been meaning to write about the OOXML nonsense, but just haven't had time. Microsoft failed in its recent (but probably not final) attempt to have OOXML listed as an ISO standard file format. Groklaw has the details of the vote.

The Groklaw article also discusses Microsoft's version of the results--Microsoft tried to spin it as a success. When I first skimmed Microsoft's press release (which I saw on Google News before reading any intelligent analysis), I was fooled into thinking that OOXML had passed.

There has been a lot of criticism of the ISO process, accusations that Microsoft has effectively purchased the votes that they did get. Hopefully ISO can reform some of their processes before the next vote on OOXML (which I think happens in early 2008).

DIY Laser Microphone

At times (can't think of specific examples) I've seen movies (or watched TV shows, or read novels or comic books) in which someone eavesdrops on somebody else by pointing a laser at a glass window separating the speaker and the eavesdropper: the idea is that the speaker's voice vibrates the glass in a way that the laser can detect. I figured that was science fiction, but a recent LifeHacker post suggests that it's possible, easy, and inexpensive. Pretty cool.

clock drift in Linux VMWare guest

Today I installed CentOS 5 as a VMWare guest (VMWare server, CentOS 4 host) and had a few problems. The first problem was that when it came time to partition the drive, CentOS didn't think I had any storage. A helpful post on the CentOS forums pointed out that I needed to select LSI (not BusLogic) for the SCSI controller.

And then I found that the clock drift was really bad, and NTP wasn't working for some reason.

http://kbase.redhat.com/faq/FAQ_43_9259.shtm suggested adding the following line to the .vmx file:

tools.syncTime = "TRUE"

This (by itself, anyway) didn't work for me.

http://www.djax.co.uk/kb/linux/vmware_clock_drift.html suggested appending the following items to the kernel command line (in lilo.conf or grub.conf):

nosmp noapic nolapic

That worked like a charm. That article also suggested appending 'clock=pit' if the guest clock runs fast (mine was running slow).

AVP2

IGN has downloadable trailers for Aliens vs. Predator: Requiem. Gory, but cool. I liked the previous film--not a great movie (can't touch Alien, Aliens, or Predator), but fun. And this one looks even better. Can't wait.

Dark Side of the Rainbow

Last week Leo Laporte on the This Week in Tech podcast (episode 109) mentioned something called the Dark Side of the Rainbow, which I'd never heard of before. The idea is that if you play Pink Floyd's Dark Side of the Moon while watching The Wizard of Oz, you'll see and hear a degree of synchronicity: moments where the music and the film seem to intersect.

I've got a copy of that CD, and last night I picked up a copy of the movie on DVD to try it out. All in all, pretty lame. Maybe it's more interesting if you're not sober.

Another worthless Internet rumor propagated by people with too much time on their hands (although it seems like I had enough time on my hands to try it myself *shrug*).

But last night I noticed something interesting about Toto: I don't know how that dog managed to keep so calm with all the histrionics going on around him/her while they were filming that movie.

Crashing e-passport readers

An RFID expert named Lukas Grunwald presented some interesting research at the recent DefCon. Grunwald was able to read the data from the RFID tag in a US passport, clone it on a writable RFID chip, and replace the image data (the e-passport RFID tag data includes a JPEG2000-format version of the passport's owner). The new image data contained a buffer overflow exploit which Grunwald demonstrated was able to crash two RFID readers. Grunwald's point is that if the readers can be crashed by altering RFID data, the readers could probably also be exploited to do things like approving an expired passport or altering what a customs official would see on his/her screen after scanning the passport.

'Customize Google' Firefox extension

I just discovered the Customize Google Firefox extension. It has a large number of user preferences which affect your use of Google services. Many of the preferences are privacy-related, including some anonimization features. It can also remove ads in some contexts, and add links to other search engines in some Google search results.

But this extension is interesting to me because it can force HTTPS traffic for Gmail and Google reader, which is especially beneficial for a laptop on a coffee shop wireless network, for example. A recent blog post on dmiessler.com makes a good argument (with packet-sniffing evidence) for encrypting your Gmail traffic. (One of the comments on that post is what directed me to the extension.)

EPEL repository

A new 'extras'-type repository recently opened for Red Hat Enterprise Linux and CentOS: Extra Packages for Enterprise Linux (EPEL). It has packages for versions 4 and 5. This can supplement the extras at CentOS extras and DAG's RPMs.

DNSUnpinning review process

I got email late today saying that my Firefox extension is being retained in the sandbox (staying in development) pending user reviews. So if you are so inclined, I encourage you to post a user review. As an incentive, by downloading the extension, you'll be able to view the source code for a simple Firefox extention (it's got an .xpi extension, but it's really just a zip file). So if you ever had the urge to write an extension, this might be a good place to start.

If you'd like to post a review, you can either sign up for a developer account and post the review that way (here are a few notes about that), or you can write an external review (I assume that comments to this blog would work for that). If you sign up for a developer account, you'll be able to see the extension's sandbox page. Or you can visit the project home page.

To review the extension, go to about:config and search for the network.dnsCacheEntries item. You should be able to see this item's value change between 0 and 1 when toggling the extension menu item. If you run your own DNS or aren't afraid to fiddle with your hosts file, you might be able to observe the browser caching (or not caching) IP addresses.

I don't have access to a Mac, so a review of the extension by a Mac user might be useful. And the more details your review provides, the more likely it is to have an impact on the evaluation process.

DNSUnpinning Firefox extension

I wrote a Firefox extension yesterday. Nothing very exciting--it just toggles a user preference. It's called DNSUnpinning, and can disable/enable IP address caching in Firefox. This has consequences for the same-origin policy in Web browsers: some phishing-related attacks take advantage of the fact that browsers tend to cache IP addresses for 60 seconds.

I created a developer account at the Firefox Add-ons site according to the MozillaZine page about sharing extensions. If you'd like to check out the extension, it's currently available on my DNSUnpinning page. The extensions now goes into a review process, and if it's accepted, it'll start showing up on the list of official Firefox extensions.

Light bulb comparison

Yesterday Neutral Existence published an interesting comparison of incandescent, compact florescent (CFL), and LED light bulbs. Looks like CFLs come out on top, with incandescent in last place. The blog post also points out that LED bulbs have less mercury in them than CFLs, and that LED bulbs may get cheaper over time.

I've never tried LED light bulbs (and only recently bought my first CFLs), but I have an LED flashlight, and I like it. It doesn't seem to focus light as well as a traditional (incandescent) flashlight, but it's pretty bright, and I never have to worry about replacing the bulb. And the batteries seem to last a long time.

Link goatsed

A co-worker just pointed out that a link in my OSCON 2007: Thursday post went to a ghastly gay male porn site. I think it was the correct link at the time (or I may have copied it down wrong), or else something happened to that domain. Anyway, my apologies to anyone who followed that link (slides for the vim talk) and was appalled.

Evil advertisement

Just saw something terrible on TV. They took the Ripley-in-power-loader v. alien queen fight at the end of Aliens and turned it into a DirecTV commercial.

Part of me just died. Horribly.

OSCON 2007: Friday

OSCON Friday is much like Wednesday and Thursday, but it's a half day: keynotes, two sessions, a final keynote, and a final schmoozing session. The Friday keynotes were pretty good. The first was from Philip Rosedale of SecondLife. He gave a demonstration, which was my first time to actually see Second Life. It looked pretty cool, and he displayed some data graphs from inside the virtual word. He said that lots of people use it for telemeetings. They're beginning to offer voice features, so people will probably start using it for teleconferencing. Some of the components of Second Life are open source, and Rosedale was encouraging the community to contribute to the project.

Next was Jimmy Wales of wikia, which hopes to fulfill Wales' ambitious goal of giving everyone free access to the entire sum of human knowledge. Wales also announced wikia's acquisition of grub, Web-crawling software which lives on unused computer cycles (sort of like SETI@home, but less pointless).

Simon Wardley then spoke about information technology commoditisation. I believe his point was that open source means allowing people not to have to spend all their time building entire infrastructures from scratch, because someone else has hopefully already done it for you and has open-sourced the code. And Simon evidently really likes ducks.

Nat Torkington, OSCON program chairperson, gave a farewell keynote. He's stepping down from OSCON organization duties (and perhaps leaving O'Reilly altogether--not sure). A (paraphrased) quote from his talk was "ignore the noise and make some signal" (participate in and contribute to a cause about which you feel passionate).

The last keynote was "Pimp My Garbage" by an electronics engineer named James Larsson. Larsson like to make interesting things out of computer equipment that other people want to throw away. His creations have to be seen to be fully appreciated, and he took the notion of building a better mousetrap to a hilarious conclusion.

The first session I attended was "Subversion Worst Practices" [sic] by Ben Collins-Sussman and Brian W. Fitzpatrick, a couple of Google software engineers who moonlight as subversion developers. They gave a good list of things to avoid when implementing version control, like storing ISO images in a repository, skipping out on backups, and manually editing repository files.

I was wanting to go to "Testing With Selenium" as my second session, but it was cancelled (selenium is an in-browser unit testing framework, which can be a good way of automated javascript testing). So I went down the hall to "Running Your Programming Language on Parrot", and was quite promptly confused. shrug

So I had some time to kill Friday afternoon. I decided to go to the Chinese Garden and the Japanese Garden. I didn't much care for the Chinese Garden, which was pretty small. It was $7 and 30 minutes of my life I'll never get back. It was OK, but nothing special. It didn't seem very well-kept: the water was pretty murky, and cobwebs were everywhere.

But the Japanese Garden was awesome. It was $8, it's in Washington Park (western Portland), and it was really beautiful and peaceful. I spent a couple of hours there, and took several pictures (I posted them to flickr). I highly recommend this to anyone with a couple of hours to spend in Portland.

Here are a couple of my favorite pictures:

OSCON 2007: Thursday

Enjoyed about half the keynotes too much this morning. The first one was cool: Ben Fry of processing.org showed some data visualization animations that have to be seen to be believed. And Steve Yegge of google gave an irreverently hilarious discourse on branding, and pointed out that branding is something that open source really lacks.

My first session was "Vim for PHP Programmers" by Anerei Zmievski (although the content was not very PHP-specific). This was an excellent talk with lots of neat Vim tricks. It was way too much material for a 45-minute presentation, but he made his slides available, so I'll be able to go through them later. As a Vim noob, I'm quite keen on learning tricks like easily wiping out the text between paired curly braces (or angle brackets or parentheses).

In a couple of the sessions I've attended this week, including today's "Untangling the Web: Dealing with Legacy PHP Code" by Clinton Nixon, people have expressed significant disdain for templating engines in PHP. I've used smarty for a couple of years and really like it. So I guess I don't really understand this sentiment. shrug

"Cache That" by Gopal Vijayaraghavan talked about APC, an opcode and data cache for PHP (Gopal is the lead maintainer of APC). This was pretty interesting, and he talked about some subleties of using APC.

My favorite talk of the day was "PHP Addons for Fun and Profit". (I didn't get the speaker's name, but she said that her blog is coffee.geek.nz). This talk was incredibly informative, with lots of good stuff about memcache and eaccelerator. I'm looking forward to giving memcache a try.

Cloverfield poster

I'm a pretty big J.J. Abrams fan: I really liked _Alias_ (well, the first two seasons, anyway), and I've been enjoying _Lost_. So I'm looking forward to the next Star Trek film (Abrams is directing it).

But I'm really looking forward to the "Cloverfield" film (or "Slusho", 1-18-08, or whatever). Looks like it'll be a pretty cool monster flick. The released the movie poster today, and it's awesome.

OSCON 2007: Wednesday

Wednesday and Thursday of OSCON are made up of 40-minute sessions after a morning of keynotes. This morning's keynotes started with Tim O'Reilly himself. He talked about how successful Web sites these days are more about user data than they are about the software driving the sites. He listed flickr and del.icio.us as examples, and he listed a few new sites, as well:

1. freebase: "a structured, searchable, writeable and editable database" of just about anything/everything
2. dabble DB: looks like an impressive online spreadsheet service
3. open ads: "the web's largest ad-space community"
4. hadoop (an Apache project): "a framework for running applications on large clusters of commodity hardware"

Tim also mentioned that StumbleUpon had been purchased by eBay (I didn't know that).

Next were a couple of guys from Intel: James Reinders (a suit) and Dirk Hohndel (looked like he belonged on a snowboard in the Swiss Alps). They talked about the new Intel Threading Building Blocks, a C++ parallelism library (you'd use this library to write software to take advantage of a multi-core architecture). Intel has open-sourced this technology, and there's even an O'Reilly book about it. Hohndel also mentioned moblin.org: Linux for Intel-based devices.

Next up was Simon Peyton-Jones, a researcher who talked about concurrent programming. He said that one approach to addressing the challenges of concurrent programming is to wrap code in a database-like transaction (with a transaction log) to acheive atomicity (like a journaling filesystem, I guess). At that point my eyes started glazing over, and I became hypnotized by his bright red sweater with a picture of a red-eyed treefrog on the chest. (It was really a very interesting keynote, and he's a good speaker--I just didn't understand a whole lot of it.)

Then Tim O'Reilly interviewed Mark Shuttleworth of Canonical. As I'm not a passenger on the Ubuntu bandwagon, and was still recovering from the amphibious atomicity assault, I went looking for coffee or something.

During the course of the day, I attended a handful of sessions, including a couple about nagios (a host- and service-monitoring system) and APD (for profiling PHP code). I enjoyed David Verba's "Practical Design For Web Developers", a discussion of user-centered design (whose 'further reading' bibliography included several interesting-looking books). Perrin Harkins' "Care and Feeding of Large Web Applications" was also pretty cool: he talked about the challenges of devoloping, maintaining, and distributing an enormous Perl-based codebase (the Arcos CMS/CRM).

But my favorite of the day (and maybe of the whole conference) was Joseph Smarr's High Performance JavaScript. I highly recommend the slides from his talk about the development process of the Plaxo online calendar and address book synchronizer.