The Cuckoo's Egg

The Cuckoo's EggThe Cuckoo's Egg

  • Tracking a Spy Through the Maze of Computer Espionage
  • Cliff Stoll
  • Geek Thriller

In the genre of 'geek thriller' this book is on a shelf of it's own.

Of course I heard about Cliff Stoll from his 'infamous' TED talk, during which he did mention this book and the events that he described.

Cliff was an astronomer/systems manager at Lawrence Berkeley Lab when he was alerted to a 75-cent discrepancy in the system accounts. This was back in the day when computers were huge and filled rooms, storage devices looked like top loading washing machines from the same era and all the screens were monochrome, black and white, green or amber. When printers were deafening and took huge boxes of green striped paper. The days of acoustic couplers, teletypes and daisy wheels. Computing time was charged to the account of each user in each department. Actually that isn't so far removed from what Amazon are doing with EC2 today.

What he found out was that someone was accessing the computer, using a GNU Emacs hack to gain system privileges, then copying the password file. This was all done using an account that had lain dormant for some time. The hacker would then seek out other computers to log into using the LBL as a gateway.

For someone like me, the book was fascinating, surely this hacker, once he had the password file, would have been one of the first people to try a brute force dictionary hack to try and 'guess' passwords. The password encryption was only one way, the encrypted password could never be de-crypted back into plain text. I don't know if that is still true of Unix systems today. Digital VAX VMS was mentioned as one of the operating systems, a name I haven't heard of for many years.

It's a real cat and mouse tale with the mouse almost getting away.

One chapter at the end describes a Unix virus. It was described as a virus but it acted more as a worm, trying to connect to other insecure systems. Cliff tried to unscramble the code to see what it's purpose was. Phoning other systems managers warning them of the dangers, what to look for and suggesting possible ways to stop it spreading. Over the phone. Nowadays that would be done using email, forums and bulletin boards on the internet. The web being a source of viruses and other nasties as well as a way of high-lighting possible security holes. This was something that simply didn't exist when this all happened. Of course the beginnings of the web existed but there was no one, not even the software vendors, showing systems managers where their computers could be attacked.

I'm sure this type of book would sell loads of copies today, either as a factual account or one of complete fiction. With The Pragmatic Bookshelf now containing fiction as part of it's Pragmatic Life series it can only be a matter of time.

Geek Thriller: you heard it here first.


Infinite Summer

Infinite Jest

Up until Monday morning I had never even heard of a book called Infinite Jest. It later transpired that I had heard of it's author, David Foster Wallace, because I already had one of his books, A Supposedly Fun Thing I'll Never Do Again on my Amazon wish list. This addition to a rapidly expanding list was no doubt prompted by none other than John Gruber, of Daring Fireball, because it was a posting by him that lead me to Infinite Summer.

Join endurance bibliophiles from around the world in reading Infinite Jest over the summer of 2009, June 21st to September 22nd.

Suitably intrigued I headed out after work hoping to find a copy in my local book stores. This is why brick and mortar shops cannot compete with online retailers. Neither of the large bookshops in town had a copy. Neither of them had any books by David Foster Wallace and there was no point ordering it from there when I had a perfectly good internet connection at home.

After a slight delay the weighty tome arrived today. Poor postman, at over a thousand pages, he must have been glad to finally drop it off.

Last night I printed five Infinite Summer bookmarks, showing the schedule, and also the How To Read Infinite Jest guide from the web-site.

This only leaves one snag... I still have about 50 pages of my current book to finish. According to the reading schedule I should have read 63 pages by midnight tonight and 94 pages by the end of play on Monday. I'm not treating it like a competitive sport, of course not, but I would like to be able to catch-up with the rest of the postings on Infinite Summer without fear of spoiling the plot!

  • Posted on Friday, 26 June 2009
  • Tagged with Books

Secure Passwords

Nowadays everyone has far too many passwords to remember. Personal ones for computers, server passwords, online shopping passwords, online accounts for paying bills as well as all the social websites that everyone signs up for, but then doesn't use. Creating secure passwords is a problem. You can't just use dictionary words because of brute force cracking and you shouldn't use the same password for everything... just in case.

There are a few software solutions, such as 1Password, that I've tried but I didn't like the fact that it generated secure passwords that I couldn't use elsewhere, like on my work laptop.

Here is the technique that I use for generating secure passwords.

Qwerty Keyboard

Select a memorable phrase or a name, the more uppercase letters the better, and look at keys on the keyboard. Instead of typing the name as it is use the key above and to the left. If you can touch type then it is just a case of using 'R' and 'U' as the index keys instead of 'F' and 'J'.

For example :-

Barack Obama becomes Gq4qdi (gqjq
Britney Spears becomes G485h36 W03q4w
Alice Cooper becomes Qo8d3 D99034

I've left the spaces in to make it readable but you get the idea.

The only snag, that I've found, is using it to enter passwords into Mobile Safari because the numeric keys aren't displayed on the same screen, to save space.

So you have generated a very secure password using a really simple encryption technique.


This Is "Spinal Tap"

This Is 'Spinal Tap'This Is "Spinal Tap"

  • Ethan De Seife
  • Film

The book looks into the reasons that the film has such a cult following and exactly what ingredients are required for a cult film. Studios have tried to create one mechanically but have always failed.

It also details the cinéma vérité look of the film, dissects some of the scenes and the explains some of the edits. Apparently it was reduced to 80 minutes from 4 hours of footage. The author takes things a little too far when comparing the song placement in the film to that of Seven Brides For Seven Brothers.

For anyone who is a fan of the film this is a quick and insightful read.


Design Patterns In Ruby

Design Patterns In RubyDesign Patterns In Ruby

  • Russ Olsen
  • Programming

A few years ago I didn't know that design patterns existed when writing software. It was only when I started tinkering with Ruby, because of Rails, that I heard about a book called Design Patterns : Elements of Reusable Object-Oriented Software written by the mythical sounding "Gang of Four".

Whenever I've been writing Ruby code in the past I've always had the nagging feeling that I'm doing it wrong. There is obviously more than one way to tackle a problem but I never know if I've taken the correct path. Countless blog posts have been devoted taking a class, or a method, and re-factoring it, making it leaner and cleaner. I guess the only way to learn is to write it so that it works, then go back to it over time and re-factor it. Surprisingly, after reading this book, that's what I'm doing now to one of my little Ruby projects.

The book takes 14 of the classic patterns and considers them from the point of view of Ruby code. It covers the background and basic Ruby concepts and idioms in the first part before launching into patterns. The third part discusses patterns for Ruby and looks into the Rails code.

For a book that is so heavily code related it is surprisingly easy to read away from the keyboard. But to really understand how the code works you would need to run and tweak it to see what makes it tick. That's what I intend to do next.

A book to always keep near you for those times when you feel that someone must have dealt with this coding problem before.


Amanda Palmer & Henry Rollins

Finally footage of this monumental meeting surfaces.

Apparently, back in 2007, Amanda Palmer was asked if she would like to be a part of Hammer Conversations and who would she like to talk to. Henry Rollins was one of the people on the short list and he was available.

Considering that it was just an informal chat in a museum I don't think that I've seen either of them look so uncomfortable. Amanda was constantly adjusting the microphone and stand, by miniscule amounts, something that she also does between songs at her shows. Henry looked as if he was curling up into a ball, possibly not that at ease with the mic on a stand instead of in his fist.

Unfortunately the video ends at the 95 minute mark. According to eyewitness accounts Palmer embraces Rollins for a full 3 and a half seconds. For Henry that's a personal best.


Daring Fireball t-shirt

Daring Fireball t-shirt

Being a reader of Daring Fireball for quite a few years I was pleased to find this fine garment in the post.

  • Posted on Monday, 04 May 2009
  • Tagged with Geek, T-shirt

Rails Magazine

Today I received my copy of the first Rails Magazine in the post. I haven't read it yet, so don't expect an in-depth review. But it did bring back memories.

When Santa, via my parents, delivered my Sinclair ZX81 back in the early eighties he gave me a copy of Your Computer with the ZX81 on the cover. The magazine contained letters, reviews, articles and, most importantly, code samples that you could type in. Just like Rails Magazine. So for a few years I would get it delivered every month from the paper shop. But one magazine wasn't enough so I also used to get Computer and Video Games magazine. This, as it's title suggests, really only contained programs dedicated to the fun side of computing. I spent many happy hours trying to type in programs for the Pet and the Vic20 only to discover that they wouldn't have a hope in hell of running.

Some readers where obviously a dab-hand at a black art known as machine code. To do this on the ZX81 you had to create a REM statement on the first line to contain the program, so it had to be exactly the right size. Then you would type in a loader program and enter the hex characters. Before you ran it you had to make sure it was saved, to cassette tape naturally, because once it was running the only way to stop it was to kill the power.

One evening I had spent about half an hour typing these characters in. They had to be 100% accurate or the program wouldn't run. Someone opened the bedroom door and, being of a nervous disposition, I jumped, knocking the ZX81 with the 16k ram pack and lost everything that I had spent so long typing in.

After that came the Dragon 32 and Dragon User magazine. I think that I'd ditched Computer and Video Games by then, being more of a serious programmer.

Back before downloads, cover mounted DVD ROMs, CD ROMs and both floppy disk formats I remember getting programs on a floppy vinyl 45rpm record. This contained about 4 programs for different computers and you recorded the sound onto audio cassette and loaded it in as you would a program that you had saved yourself. Ah, happy days!


Caching

Who would have thought that this site would need to use page caching? Well, to be honest, it doesn't. The one Mongrel cluster was rendering the pages absolutely fine. The site doesn't get a whole heap of hits. But after watching the Rails Lab screencasts by Gregg Pollack on tuning and optimizing Rails applications, I decided to give it a try.

The Advanced Rails Recipes has two good recipes, Preserve Files Between Deployments and Segregate Page Cache Storage with Nginx, which along with screencasts helped a lot. I was only ever going to venture into Page Caching as the posts and the pages remain static.

All in all it was really easy. I knew about symlinking using Capistrano so it was just a case of setting my Enki fork to use page cache for the index and show actions for posts and pages. The problem I had wasn't with the caching, which worked fine, it was with expiring the pages if they are changed. Enki has the administration controllers in a sub-folder so for some reason I couldn't just use expire_page post_path(post) in the post sweeper, to get around that I just had to build up a string matching the post path manually, expire_page "/#{year}/#{month}/#{day}/#{slug}". There is no doubt a way around that using routes, but I haven't found it. So if I add a post, it will zap the main index page, the archives page, the tags page and also the page of any tags that are associated with the new post. Simple. The only other problem was with the Nginx config settings. I had to change the ones in the book slightly to use $document_root instead.

Before I deployed the caching changes I added the RPM Lite from New Relic to see the response times. Apart from the occasional, self-induced, spike it was all running fine. The /posts/show controller action was taking the most time, essentially the rendering, but looking at the stats post-caching the slowest controller action is the sitemap, and I guess I could cache that.

Now that the site is running completely from static HTML pages it makes me wonder why I bothered setting up the database, Rails app, capistrano, directories etc when I could have just run it on my iMac and rsynced the changes up to the server. In fact that's really how this site started. I just had an index page with server-side includes dragging in dated post entries.

When Brent Simmons described his publishing system earlier this year I found it really inspiring. No databases, no code (as least running on the server), easy to backup, just templates and scripts run locally and synced to the web-server. That's all you need. Nothing big, nothing fancy. Of course, I wanted to learn more about Rails by using it on a live site... and it has been lots of fun.


The Creative Habit: Learn It and Use It for Life

The Creative Habit: Learn It and Use It for LifeThe Creative Habit:
Learn It and Use It for Life

  • Twyla Tharp
  • Self-Help

Not another self-help book? Well, yes, and highly recommended by none other than Merlin Mann.

Twyla Tharp is an American choreographer who has created more than 130 dances, either for her own company, or for theatres and ballet companies around the world. The world of professional dancers is not a sphere that I've ever wanted to enter. Personally I hate dancing, I'm white therefore I have no rhythm, I'm from England therefore I'm very reserved. So why read a book by a dancer? This is where the whole self-help, wanting to improve myself, thing comes in.

To be honest reading this book isn't going to give you creativity to excess. You won't suddenly start writing like a great novelist or start painting like a great master. But you'll be able to notice the dark corners where inspiration and creativity hide, and maybe bring them out into the light once in a while.

For some, unknown, reason I did expect to get more from this book. I can't quite think why because I am, as a developer, very technical and not creative at all. Possibly I should read it again, looking more into how to take some of the ideas and putting them in the context of software development.

If you are a person who has creative endeavours, then you may get more from it than I did.

One thing that did make me think... the work of a writer is held on paper, or, in this day and age, in electronic form. A painter's work is held on canvas, a photographers work, again paper or electronic, but how can a dance be recorded? Before video cameras how were these things recorded? If you have 10 or 15 people leaping around a stage how do they know where to run and when to leap? Is there some kind of notation, like music, some kind of shorthand for it. If a company wanted to stage one of Twyla's early works how would she tell the dancers what to do? From memory?

  • Posted on Tuesday, 03 March 2009
  • Tagged with Book Review

No Agenda

No AgendaNo Agenda

Live from Gitmo Nation, Crackpot Adam Curry and The Buzzkill John C. Dvorak, present No Agenda.

The number of times that I've been walking around listening to this podcast and laughed out loud... times too numerous to count.

I started tuning in a few months ago and listened to a few of the new shows. I liked it so much that I downloaded the previous 60. Of course I knew Dvorak (Dvorak dot org slash blog, have a drink) from TWIT and Cranky Geeks but didn't really know anything about Curry.

What's so different about this is Adam's frequent and passionate use of industrial strength expletives. If only Leo would drop the f-bomb just once, god love him.

I have learnt so much over the last few months, about :- fine dining in San Fran, wine, sausages, politics, economics and how to smuggle a six foot plus white male into the U.S. using a CostCo card. I shall be eternally grateful for their collective wisdom and insight.

For every 1,000 downloads Adam and John will plant a tree in Gitmo Glade there-by reducing your carbon footprint.

Vegans or Canadians may be offended.

  • Posted on Monday, 02 March 2009
  • Tagged with Podcast

The Kermode Awards 2007

Best Actress: Sandra Hüller (Requiem)
Best Actor: Toby Jones (Infamous)
Best Animation: Richard Linklater (A Scanner Darkly)
Best Sound Design: David Lynch (INLAND EMPIRE)
Honorary Award: Christopher Guest
Best Director: Guillermo del Toro (Pan's Labyrinth)
Best Film: Pan's Labyrinth

Yes, a little trip down memory lane to 2007 when a bespectacled Dr. Mark Kermode announced the awards. Filmed in black and white and delivered in just over 9 minutes to an empty theatre, apart from the odd cob-webbed skeleton. After this years awards weighed in at a hefty 21 minutes, with stars jetting in from around the globe, what will be in store for 2010.


New Pedestrian Crossings

The town centre has been gridlocked for months. The council has been hard at work hacking down the old traffic lights and pedestrian crossings signals and erecting shiny new ones.

For those gentle readers who live outside the U.K. This is how the old system worked.

You'd approach the road crossing, push the button (usually on a post to your right) and the 'Wait' signal would light. Directly across the carriageway there would be a post with lights to control the traffic and also lights to control the pedestrians. Traffic lights would change from green to red and the red stationary man would change to a walking green man. You could safely cross the road. Notice that you are looking up, and over, the passing traffic. Looking across the road in the direction that you want to travel.

The new system is different, naturally. The lights for traffic are the same, but the red and green men, instead of being high and in the direction that you are walking, are on the post with the button and the 'Wait' indicator. But now the 'Wait' indicator has changed to just a red box that is lit. So you have to be looking to your right and not over the traffic. The problem, that I found this evening, is if there are 4 or 5 people waiting to cross, and you are to the right of the post with the button you can't see the red man change to green. You are totally at the mercy of the people crossing to give you an indication that all is well. If they're the kind of people who just cross when they don't see any vehicles then you could just blindly follow them. Instead of waiting for the correct signal.

So you have to be able to see the red and green men indicators to be sure that you can safely cross. This is only about 4 feet off the ground on a box, on a post. If there are many people waiting to cross, and someone is stood in front of the box then none of you can see the signal except those people really close to it. When the green man lights there is also an audible signal that it is safe to cross. If you're hard of hearing you would still need to be able to see that the visual indicator has changed before attempting to cross.

Surely whoever designed these things tested them out. As far as I'm concern these new pedestrian crossing are a huge backward step.

  • Posted on Thursday, 26 February 2009
  • Tagged with Moans

Lloyds Share Price

I've just been listening to The FT Money show podcast and to some poor soul asking when he should sell his Lloyds shares. I think he said that he bought thousands of them, as an investment, when they were £4 each, now they are down to 50p. What should he do?

When I used to buy shares I read a vast number of books and magazines on the subject. They all said :- don't get attached to them and sell them if they drop out of your comfort zone. But you do think, "So they've dropped to £3, so they must go up", they might do, then again they might not.

If you've studied the fundamentals of the company, read the all the accounts for the last five years and you've come to the conclusion that the shares are still under-valued, then keep them. If you haven't, and you're getting twitchy, then sell and invest the money elsewhere.

I used to produce graphs on my Psion 3a (those were the days), something I enjoyed doing more than the actual investing. These charts would plot the share price against the FTSE 100 and the FTSE All Share, showing variations above, or below, the market.

Also I used to plot a graph with a trailing sell price. I don't know if that's the correct technical term for it but it will do. What this did was show a point 10% below the highest price for the stock. So you buy a stock at £1.00, you would see a point at 90p, if the stock went down from there, the line at 90p would stay. Now that is always a worrying time. You've just bought a share whose price has dropped. Should you sell when it hits 90p? But let's say that the stock price goes up to £2.00, then so does the trailing sell price to £1.80. Then it goes up again and hits £4.00, trailing price also goes up to £3.60. The share price then starts to fall, it hits £3.60 and you sell with a tidy profit.

Setting the comfort zone to 10%, or whatever, is difficult because you are saying that you would sell no matter what. Even if the price drops steadily from the purchase date. Because you have already taken a hit with the purchase fees you don't want to swallow a loss and selling fees to boot.

It really is all too easy to get emotionally attached to shares. You can only really be detached if you truly believe that the stock is significantly undervalued by the market.


The Kermode Awards 2009

Best Supporting Actress: Ashley Tisdale (High School Musical 3)
Best Supporting Actor: Eddie Marsan (Happy-Go-Lucky)
Best Actress: Belén Rueda (The Orphanage)
Best Actor: Michael Fassbender (Hunger)
Best Screenplay: Garth Jennings (Son of Rambow)
Best Foreign Film: Roberto Saviano (Gomorra)
Best Film & Best Director: Terence Davies (Of Time and the City)
Fellowship Award: Terry Gilliam

Jane Parker puts Kermode in his place with her review of Slumdog Millionaire.

Related Links
Flickr - The Culture Show Group
YouTube - The Kermode Awards 2008
YouTube - The Kermode Awards 2007

Update
Best Sound: Oriol Tarragó

That's according to Mark's posting on the Kermode Uncut site. The award was due to be presented to Oriol, who has worked on The Orphanage and [Rec], in Spain but the trip was cancelled due to snow hitting the U.K.