GSoC 2011

I was pretty much missing over the summer, due mostly to my working for GSoC 2011. I was notified yesterday that the bulk of the code I had written was merged in to the master branch.

No, it isn't a hack, but yes, it is cool :)

Purely Pedantic Password Affirmation

PBKaC (Problem between keyboard and chair). Yes, people are the source of all problems in Computer Science, a computer does exactly what it is told to. But sometimes they can be the solution to problems too.

What if, when you entered a password, three things were sent back to the server?

1. A password hash.
2. A list of the times taken between keypress events for the password, hashed or something.
3. Some identifying information for the computer, plugins, whatever.

The server could check the headers sent back to see if this is a common computer used by the user, and if so check the password and move on with its day.

The server could also check the times between keypresses in the password for relatively spaced times in the way the user normally enters the password, providing a fingerprint for a particular user.

Suppose it normally takes me 30ms to reach from "F" to "T", and fifteen to get from "O" to "."; if the password was entered differently the user should be redirected to a secondary question page; either they broke a hand, or someone else entered their password.

Think of it as non-random password screening. It would stop bots in their tracks, and would create only a small problem for users.

Page Speed Testing

While it is true that the average Internet user is no longer buzzing along at a healthy 56Kbps, that doesn't mean page load speed isn't important. Perhaps your viewers are on a spotty wifi connection, are using a phone to access your site, or really are using a modem.

 You might wan to try out Google's Page Speed lab. It checks for common problems with website page loading speed and gives examples of what can be fixed.

Speedy websites are fun to make, easy to maintain, and helpful to users. If you want to be proactive (before the site is built), here are some tips on how to build site speed in to the development cycle:


Lesson 1: Fun to make
1. Make a small bonfire out of your Dreamweaver, Rapidweaver, Publisher, and and (God forbid) Frontpage discs.
2. Run away before the smoke from burning discs gives you cancer.

3. Now, pull out your favorite text editor and start coding! I like Geany, because it auto-completes HTML tags, highlights CSS, JavaScript, and PHP embedded in HTML and a whole slew of other things, while being lightweight. As a side note, one of my favorite features is Ctrl + Shift + O, which opens the file that your cursor is over, say you had embedded a CSS file, placing the cursor over it and hitting the combo would open it up for editing.

4. Code like the wind!
5. Test.
6. Repeat 4 and 5 until you have the same page you did originally. I usually get the size down by three or four times by hand coding.
7. Run your site through the w3c validators and put a fancy badge on your page.

Where is the fun in this? Well, first of all, you know what every page does and have gained new knowledge in the fields of JS/CSS/HTML, soon enough, you'll be able to re-write entire sites in a few hours for great speed enhancement.

Lesson 2: Easy to maintain
Being your site is now W3C compliant and small, changes are really easy! Want all the text on your site to be purple and flashing? Change it through CSS in thirty seconds. Holiday themes are easy to make now!

What else can you do though? How about separating out the common stuff in each page to a separate php file? And the navigation to a nav generator? Now all of the pages on your site are updated at once when you upload a new one.

This isn't the best practice, but in my opinion, it works for small sites. Why not separate out variables, like phone numbers to a separate php file? Then you can just echo the variable wherever it is needed. Result: Want to change xxx-xxx-yyyy to xxx-xxx-yyyx? You can in a very short amount of time; and you don't have to worry about missing pages!

Lesson 3: Helpful to users
Users that have screen readers installed will thank you, along with users that are on spotty/slow connections. Oh, and your server admins will be happy too, imagine using half the bandwidth through smarter pages?

The Entertainer

I received an Arduino in the mail a few months ago, and was playing around with some scripts on it to try things out. It isn't much, but it works; here is the intro to "The Entertainer" that will play on a small speaker:


"Entertainer.pde"

/*
Plays "The Entertainer"
 
 circuit:
 * 8-ohm speaker on digital pin 8

Based Upon
 
 http://arduino.cc/en/Tutorial/Tone
 
 */
 #include "pitches.h"

// notes in the melody:
int melody[] = {
  NOTE_D3, NOTE_DS3,NOTE_E3, NOTE_C4, NOTE_E3, NOTE_C4, NOTE_E3, NOTE_C4,    NOTE_C4,NOTE_D4,NOTE_DS4,NOTE_E4,NOTE_C4,NOTE_D4,NOTE_E4,NOTE_C4,  NOTE_D4,   NOTE_C4};

// note durations: 4 = quarter note, 8 = eighth note, etc.:
int noteDurations[] = {
  4, 4, 4, 2,4,2,4,1,  4,4,4,4,4,4,4,2,4,2,1};

void setup() {
  // iterate over the notes of the melody:
  for (int thisNote = 0; thisNote < 18; thisNote++) {

    // to calculate the note duration, take one second 
    // divided by the note type.
    //e.g. quarter note = 1000 / 4, eighth note = 1000/8, etc.
    int noteDuration = 1000/noteDurations[thisNote];
    tone(8, melody[thisNote],noteDuration);

    // to distinguish the notes, set a minimum time between them.
    // the note's duration + 30% seems to work well:
    int pauseBetweenNotes = noteDuration * 1.30;
    delay(pauseBetweenNotes);
    // stop the tone playing:
    noTone(8);
  }
}

void loop() {
  // no need to repeat the melody.
}

"Pitches.h"

/*************************************************
 * Public Constants
 *************************************************/

#define NOTE_B0  31
#define NOTE_C1  33
#define NOTE_CS1 35
#define NOTE_D1  37
#define NOTE_DS1 39
#define NOTE_E1  41
#define NOTE_F1  44
#define NOTE_FS1 46
#define NOTE_G1  49
#define NOTE_GS1 52
#define NOTE_A1  55
#define NOTE_AS1 58
#define NOTE_B1  62
#define NOTE_C2  65
#define NOTE_CS2 69
#define NOTE_D2  73
#define NOTE_DS2 78
#define NOTE_E2  82
#define NOTE_F2  87
#define NOTE_FS2 93
#define NOTE_G2  98
#define NOTE_GS2 104
#define NOTE_A2  110
#define NOTE_AS2 117
#define NOTE_B2  123
#define NOTE_C3  131
#define NOTE_CS3 139
#define NOTE_D3  147
#define NOTE_DS3 156
#define NOTE_E3  165
#define NOTE_F3  175
#define NOTE_FS3 185
#define NOTE_G3  196
#define NOTE_GS3 208
#define NOTE_A3  220
#define NOTE_AS3 233
#define NOTE_B3  247
#define NOTE_C4  262
#define NOTE_CS4 277
#define NOTE_D4  294
#define NOTE_DS4 311
#define NOTE_E4  330
#define NOTE_F4  349
#define NOTE_FS4 370
#define NOTE_G4  392
#define NOTE_GS4 415
#define NOTE_A4  440
#define NOTE_AS4 466
#define NOTE_B4  494
#define NOTE_C5  523
#define NOTE_CS5 554
#define NOTE_D5  587
#define NOTE_DS5 622
#define NOTE_E5  659
#define NOTE_F5  698
#define NOTE_FS5 740
#define NOTE_G5  784
#define NOTE_GS5 831
#define NOTE_A5  880
#define NOTE_AS5 932
#define NOTE_B5  988
#define NOTE_C6  1047
#define NOTE_CS6 1109
#define NOTE_D6  1175
#define NOTE_DS6 1245
#define NOTE_E6  1319
#define NOTE_F6  1397
#define NOTE_FS6 1480
#define NOTE_G6  1568
#define NOTE_GS6 1661
#define NOTE_A6  1760
#define NOTE_AS6 1865
#define NOTE_B6  1976
#define NOTE_C7  2093
#define NOTE_CS7 2217
#define NOTE_D7  2349
#define NOTE_DS7 2489
#define NOTE_E7  2637
#define NOTE_F7  2794
#define NOTE_FS7 2960
#define NOTE_G7  3136
#define NOTE_GS7 3322
#define NOTE_A7  3520
#define NOTE_AS7 3729
#define NOTE_B7  3951
#define NOTE_C8  4186
#define NOTE_CS8 4435
#define NOTE_D8  4699
#define NOTE_DS8 4978

The Uselessness of Passwords

The Public

Most people that put passwords on their computers assume too much about the security of the system they operate on. Rule of thumb: unless you have specified an encrypted hard drive, you don't have one. The password you put on your machine will keep me (or anyone else worth their salt) out of your files for all of ten seconds.

For Mac OSX a simple Command + S while booting up will do the trick (on old macs you can delete the first run file so the mac goes in to setup mode and requests a new username and password, that will then allow access to your files)

For Windows, how about an F9 to safe mode?

For linux, what about changing the boot options in your boot manager to go in to safe mode, or simply choosing the safe mode section?

For all operating systems, if your stuff isn't encrypted we can still pop in a linux live cd and copy anything we want over.

So, how do you keep someone from doing this? Well, it requires hard-disk encryption (which is dangerous, because if you forget the password, you're SOL, and if you write it down, there is no point). A locked boot manager, that boots directly to the hard drive (with a good password, different than the BIOS). A good, strong password, and requiring a user name upon login will help too. The computer must have a lock on it, as if it is stolen, most of your defenses fall, except the hard disk encryption if you have any.

Network/Computer Admins

So, what if you have a whole slew of computers?

"Aha!" the school computer admin exclaims, "I know, I'll disable users from booting in to safe mode, by setting an Administrator password, lock the BIOS so they can't boot Linux, disable running third party executables on the desktops, and, um, disable listing of the C:\ directory by students!"

This is a very real example taken from the school district I was educated at :) Hmm. Students have nearly unlimited physical access to the computers. I would just pop out a clock battery, and hit a pin, resetting the BIOS; maybe I did this, and maybe not. Maybe when I did it, the clock was reset to the year 1400 (before the epoch?) and software freaked out before I fixed it.

Oh, and by the way, if you type: file:/// in to Firefox it shows the listing of the root directory, easy enough to grab a password file from a trusted app, and then run it through your password cracker later (in Windows). Also look out for applications like AutoCad that allow command line access through their interface.

A note to the administrators of schools and businesses across the world:

• Your subjects are motivated to do what they want.
• They outnumber you
• They probably outnumber you enough to brute-force a problem
• You have other obligations

You will not win, assume every connection to your network is hostile, and client machines are always needing a re-image.

Idea: Frensel Lens Foundry

While browsing around the interwebs, I came across the fact that Frensel lenses have a great ability to focus sunlight. Naturally, I was surprised to find that such a great invention is being so under-utilized. (kind of like deck prisms which have just been "discovered" recently)


Anyhow, it turns out that these powerful lenses can be found in projection televisions, and best of all, people give these things away on Craigslist, because the TVs are broken.

A rather devilish plan came to me: why not melt aluminum cans in to small ingots? Sure, the use of these ingots would be rather limited, but you never know!

A quick trip to YouTube confirmed that things like steel could be melted with a lens about the size of a television, it has a melting point about twice that of Aluminum.

And now comes the really cool part: maybe it could be automated, an Arduino to track the sun and move the lens, a chute to feed aluminum cans, and some kind of a pot to catch the molten metal.

I like the idea of dumping the liquid in to a muffin tin, ensuring the metal comes out properly, although it could simply be poured back in to another soda can with the lid removed.

If for nothing else, the ingots could be used to save space while you gathered enough cans to take them to the recycling center.

Liberate Your Data!

Google has announced a new project from the Data Liberation Front team that will eventually help you download all of your data from Google, making their job that much harder to keep you as a customer. That is fine and dandy, and will be lovely once completed, but what do we do in the mean time? I know that you keep weekly backups of your computer, and probably monthly backups of your on-line presence in at least one location away from your computer that is, at minimum secured from fire and water, right?

If you do; this article probably isn't for you. Being an avid user of Google, I'll show that, along with Facebook, and Firefox Bookmarks and Software Keys hiding on your machine.

 Gmail:
Sorry, the options are limited here, either you set up a sync with a desktop client and copy the messages you get there, or you print all of your archived messages to PDF. Please don't print them to paper, that defeats the whole purpose of email.

Google Contacts:
This one isn't too bad, in the main Gmail window open your contacts.

Then choose More Actions > Export:

From there you will get many options for export, I choose to export all of my contacts in the Google format:

Once downloaded please rename the file from google.csv to something useful, like "contacts-export-2055-02-31.csv".




Google Docs
Open up Google Docs 


Select some documents, then from the "Actions" menu, choose download.

A dialog will pop up asking you how you want to download the documents, at the top, choose the tab for All Documents, then download in any format that works for you (I choose ODT because it is an open standard that is going to be around far in to the future).

This time your export is named something appropriate, like "documents-export-2011-08-02.zip".


Facebook
Facebook isn't as nice as Google and only sometimes works, when it does, your download may take days to process; get out while you still can!

First, open your account settings:

Then select, "Download a copy" of your Facebook data.

 

Then, press Download twice:

Within a few days (this only works about half of the time) you will get an email telling you that your download is ready, you can then click it, login to Facebook again, and download a zip file with all of your stuff. Note that my whole Facebook probably has ten Mb of data, it isn't big by any standards, yet it still takes a long time; probably because Facebook is stuck using MySQL and PHP for half a billion users. Those MySQL databases can't handle it, so they have to have lots of redundant servers and things have started going funky recently with keeping the information in each concurrent (I've started getting notifications about the exact same message hourly recently). Get your information out before Facebook begins to have seizures and starts dumping your stuff.

Firefox Bookmarks
This isn't that big of a deal: Open your bookmarks manager, Firefox > Bookmarks > Show All Bookmarks (Ctrl + Shift + O) then from the Import and Backup dropdown choose Backup. You will get a JSON file filled with your bookmarks.

Note that recent versions of Firefox also backup locally every few weeks.

Software Keys
Use the Magical Jellybean Keyfinder free version to view the software keys on your system and save them to a text or csv file.

New: Google Takeout

This is the new technology discussed at the intro to this post, head over to google.com/takeout and choose what you want to download, eventually all Google services should appear here, but for now you get Picassa, Google Contacts, Buzz, and Google+.