iMessages

Posted on 2011-06-09 by jcs

Now that the excitement over the WWDC Keynote has died down, people are beginning to think about the new features and what they will mean. One interesting take on that is that iMessages is really a very disruptive technology. There are plenty of folks yawning and mumbling about how it’s nothing more than Apple’s version of Rim’s BBM and, anyway, who cares? And if you do care, haven’t you heard about GTalk and WhatsApp?

What those yawning are missing, I think, is that fact that iMessages is (reportedly) transparent. The user will fire up the Messaging app as always but if the recipient is another IOS device it will use iMessages instead of SMS. There are 200 million IOS devices deployed now so on the day that IOS 5 is released, the carriers are going to lose a bunch of revenue. To be sure some of those IOS users will be texting folks on other platforms but there’s going to be a lot of IOS-to-IOS messaging and the carriers won’t be getting a piece of it. Now add in the fact that Android will certainly do something similar and it’s easy to imagine the bottom dropping out of the SMS market.

Many people are excited and happy about that prospect. Over at TechCrunch, MG Siegler is enjoying a bit of schadenfreude at the carriers’ expense. As he correctly points out, SMS is tremendously overpriced, especially when you consider that it uses a control channel and is essentially cost-free for the carriers.

Fabrizio Capobianco over at Mobile Open Source says that SMS is going away. He predicts that the revenues from SMS are going to disappear and suggests that the carriers move up the food chain while they can. Capobianco and Siegler agree that it’s going to take a while for SMS to go away and, really, it probably won’t completely—after all, it’s just there so why not leave it? I do agree with them that the huge profits from it will soon be a thing of the past.

On the other hand, I’m not sure that any glee is called for. If the carriers lose the SMS profits, they will surely try to regain them through increased fees in other areas. Then everyone, whether or not they text, will be paying more.

Still, I see this as another step towards the oft predicted commoditization of cell service. A march that ends with the carriers providing a bit pipe and little more.

Posted in General | Tagged | Leave a comment

Encrypting (Some) Dropbox Files

Posted on 2011-06-08 by jcs

A while ago I wrote about the developing ‘scandal’ involving Dropbox’s supposed admission that they could read your data. As I remarked at the time, no one with an ounce of sense ever thought otherwise but the question did remain as to what a user could do to protect sensitive files from rogue Dropbox employees or subpoenas. When I wrote that, there didn’t seem to be any good answers short of encrypting the files yourself. That takes a bit of discipline, of course, and could lead those with insufficient amounts of paranoia to not bother just this once.

Now Andrew over at WEB UPD8 has a nice post that shows us how to encrypt some or all of those files automatically. He does this by using EncFS. EncFS use two directories: files put in the first show up encrypted in the second. The idea is that you put the encrypted folder in your Dropbox and place the files you want encrypted and synced with Dropbox in the other directory. The nice thing is that you can put nonsensitive files in the Dropbox as before and they won’t be encrypted.

EncFS uses the Linux fuse facility but solutions exists for the Mac (macfuse) and Windows (BoxCryptor) so Andrew’s idea is portable to the big three. This is a really nice hack and if you are using Dropbox and worried about keeping your data private, you should head over to WEB UPD8 and read all the details. If you’re on the Mac there are directions for setting EncFS up here.

Posted in General | Tagged | Leave a comment

More Password Analysis

Posted on 2011-06-07 by jcs

A week ago I wrote about the analysis of the Gawker passwords. Now Troy Hunt has provided a similar analysis based on the SonyPictures.com compromise. He looked at 37,608 accounts from the LulzSec torrent and analyzed the passwords for

  • Length
  • Types of characters used
  • Randomness
  • Reuse of passwords between accounts

You really should head over to Hunt’s blog and read the article—there are lots of interesting results.

Sadly, all our favorite passwords are there, although seinfeld beat out password for first place and 123456 came in fourth. Like the previous Gawker analysis, Hunt’s results are alarming. Companies are going to have to start doing more to increase password safety. It’s a sure thing that the users aren’t going to.

You may remember that I’ve written about Hunt’s work before on my old blog. If you didn’t take my advice then and read his series of posts on passwords, you should do so now—he has a lot of useful things to say.

Posted in General | Tagged | Leave a comment

The History of UTF-8

Posted on 2011-06-06 by jcs

Via the Programming subredit I was led this History of UTF-8 by Rob Pike. I already knew some of that history (such as Ken Thompson and Rob Pike designing UTF-8 on a paper placemat at a diner) but much of the story is new to me. Pike felt compelled to set the record straight because of a persistent story that UTF-8 was designed by IBM and then first implemented in Plan 9.

In fact, the IBM folks had called Pike to vet a design of theirs but Pike didn’t like it because their scheme couldn’t synchronize a byte stream with less than one character being consumed. So Pike and Thompson went to dinner where Thompson sketched out the encoding on the famous placemat. They returned from dinner and while Thompson banged out the packing and unpacking code, Pike started working on the graphics library. The code was done the next day and in another day they had it running in Plan 9.

This is a great story and if you have any interest in Unix (or Plan 9) history, it’s well worth a read. The story comes complete with the code that Thompson wrote that first night as well as some subsequent code, which is, apparently, pretty much what is running in Plan 9 today.

Posted in General | Leave a comment

Two Interviews

Posted on 2011-06-05 by jcs

Recently Ken Thompson and Dennis Ritchie sat down for interviews: Thompson with Dr. Dobb’s and Ritchie with IEEE Spectrum. Ritchie talks mostly about he and Ken inventing Unix—the occasion for both interviews was Thompson and Ritchie winning the Japan Prize for their work on Unix—and the early efforts to make it portable.

Thompson talks about developing Unix, Dennis Ritchie, and the Go language. The best line in either interview, as far as I’m concerned, was Thompson saying that he, Rob Pike, and Robert Griesemer started the Go project because they all hated C++. That’s sure to ruffle some feathers but it’s a sentiment that many can identify with.

Both interview are short and leave you wishing for more but they’re interesting talks with two of the giants in Computer Science.

Posted in General | Leave a comment

Scrolling The Other Window

Posted on 2011-06-04 by jcs

Trawling through the old Emacs COTWD twitter entries I came across something I didn’t know. In some situations, such as help screens, Emacs will open another window but keep the focus in the current window. When this happens, Emacs will tell you that you can scroll the other window down with C-M-v but it doesn’t tell you how to scroll the other window up. I long ago discovered that you can do that with C-M-- C-M-v but it’s annoying to have to type the two chorded keys. Today’s discovery was that the correct way of doing this is to type C-M-S-v. That’s a lot more convenient because it’s easier to scroll up several pages. Of course, this works no matter what’s in the other window so it can be helpful to quickly check documentation or code in the other window without leaving the window you’re working in.

Posted in General | Tagged | Leave a comment

The Hits Keep On Coming

Posted on 2011-06-03 by jcs

It appears that kicking the hornet’s nest worked out better for Lisbeth Salander than it has for Sony. The “hacker group” LulzSec has again embarrassed Sony by compromising SonyPictures.com and exposing user data for over one million users. Fortunately for Sony, the group did not have enough computer resources to download the whole database although it did take about 51,000 user records. Unfortunately for Sony, LulzSec has demonstrated once again how clueless Sony is about even rudimentary security. You can read LulzSec’s announcement on Pastebin here.

Consider this:

  • The compromise was by an elementary SQL injection attack. How is this possible today? How is it possible especially for Sony who, one would think, would be on the alert after the PSN and subsequent disasters?
  • The stolen data included passwords, email addresses, birthdates, and whatever opt-in data, such as telephone numbers, the users included.
  • None of this data was encrypted.

All of this suggests that if Sony wants to sue and prosecute people for modding the PlayStation console, they better attend to their security first. Of course, it’s already too late for that. I wonder how many of those users who had their personal information exposed are already talking to lawyers. Sony is very likely to discover that those who live by the lawsuit, die by the lawsuit.

Posted in General | Leave a comment

Pharen

Posted on 2011-06-02 by jcs

I don’t know what to think of Pharen. It’s a little compiler that compiles a Lisp-like language into PHP. PHP seems to be almost as universally reviled as it is universally used, so perhaps this is a useful thing as well as a nice hack. Still, a little voice in the back of my mind keeps repeating, “If you want PHP go use PHP.”

On the other hand, Aubrey Jaffer the author of SLIB and SCM, the Scheme implementation on which Guile was originally based does this sort of thing all the time. After making the same off-by-one mistake in C too many times Jaffer started coding in Scheme. As he put it, “Periodically, a manager will mandate that I perform my work using some particular language or technique (buzzword). I usually comply by writing (adapting) a translator from SCM to that language.” I’ve always admired his approach to this (he’s even written device drivers in Scheme and used his schlep compiler to translate the Scheme code to C.

So perhaps Pharen is a good thing. What do you think?

Posted in Programming | Leave a comment

Magic Trackpad

Posted on 2011-06-01 by jcs

My main machine, at the moment, is a 27 inch iMac. It came with the Magic Mouse, which is an optical mouse that has a multi-touch surface on its top shell. It’s a great mouse and I really like it but I have a glass desk which means that I need to use a mouse pad for the optical tracking to work. That’s a problem because with that giant screen I was always running off the edge of the mouse pad and would have to pick up the mouse to reposition it.

So last weekend I bought a Magic Trackpad. Until I got my MacBook Pro I had always hated trackpads. For some reason the designers of every laptop I had ever used before the MacBook thought it was a great idea to have a tap on the trackpad represent a click. It’s one of those things that sounds good and natural but is terrible in practice. Terrible because it’s very easy to accidently trip the click simulation and yank focus away from whatever window you were working in. Say what you like about Apple but they think about stuff like this so their trackpad implementation was intelligently done. My MacBook is an older model so the trackpad had only limited gestures: a two-finger swipe was a scroll and, of course, the scrolls were inertial to make it easy to move large distances. The Magic Mouse added a gesture that would page forward and backwards in Safari and photos.

The Magic Trackpad has a full set of gestures and is much larger than a laptop trackpad as you can see in the picture.

http://irreal.org/blog/wp-content/uploads/2011/06/wpid-magicmouse.jpg

It’s really easy to move around with it and it doesn’t take up as much room as the mouse pad did. All in all, it’s a giant win for me.

Posted in General | Leave a comment

As I Was Saying

Posted on 2011-05-31 by jcs

No sooner had I pushed my Bad Passwords post than I stumbled on this post by Marc Bevand over at Zorinaq. Bevand reports that VISA’s Verified by VISA authentication system forces users to select weak passwords (this may not be VISA’s fault, see below). Passwords so weak that if they were used on a Windows machine they could be bruteforced in less than two and a half hours. Valid passwords under VISA’s rules must be between 6 and 8 characters long (inclusive) and use only letters and numbers. Thus the key space is 628 + 627 + 626 = 221,918,520,426,688. That may seem a big number but it’s well within bruteforce territory.

It seems there is little hope of having the banks and other financial services enforce a secure password policy. After all, 123456 and password are both valid passwords for Verified by VISA.

All of this is a shame because VISA is, of course, a tempting target and it’s not unreasonable to assume that sooner or later someone will manage to get their password hashes. From there, it’s an easy step to bruteforce them and start looting accounts. It’s also a shame that responsible customers who would like to use secure passwords are prevented from doing so. It’s hard to see any reason for VISA’s password policy other than some PHB assuming the mantle of security expert and just decreeing them out of ignorance.

Just as I was getting ready to publish this, I read some additional comments to Bevand’s post and there are two more points worth mentioning from them.

  1. The password policies for Verified by VISA are set by each VISA card issuer so the culprit in this case is the individual bank. Another commenter reported that Barclay’s doesn’t even hash the passwords, which is truly shocking.
  2. Apparently, (at least some) banks will reset your password given your birth year and month and some card data. This commenter remarked that it hardly matters that the passwords are weak since an attacker could just reset them using data that is reasonably easy to obtain.
Posted in General | Tagged | Leave a comment