January 02, 2009

500 'Worst Passwords of All Time'

Amazingly, even my very worst, crummy, seemingly obvious, password that I use for many sites where no money changes hands did not make the list of alleged[*] The Top 500 Worst Passwords of All Time.

I should probably use more special keys; I tend to letter/number combos when it matters.

Many years ago I had a numerical password for a bank account that no longer exists. That number has been very useful worked into things since then.

[* -Why “alleged”? They don’t actually say how this list was produced….]

Spotted via BoingBoing

Posted by Michael at 09:35 PM | Link | Comments (2)

December 30, 2008

So Much for Safe Browsing (Temporarily)

Via Ed Felton, news of a medium-sized bombshell in Researchers Show How to Forge Site Certificates:

Today at the Chaos Computing Congress, a group of researchers (Alex Sotirov, Marc Stevens, Jake Appelbaum, Arjen Lenstra, Benne de Weger, and David Molnar) announced that they have found a way to forge website certificates that will be accepted as valid by most browsers. This means that they can successfully impersonate any website, even for secure connections.

This is a big deal. But as Ed explains, it is based on an making worse a known weakness in the “MD5 with RSA” hashing algorithm. It can be fixed by having Equifax, which uses this now shown-to-be-insecure hast, replace the hash with something better. And having Equifax (and anyone else using it) revoking all existing certs based on this now vulnerable hash. (Which will cause a new wave of people ignoring security warnings…)

And, as Ed wisely notes,

… this is a sobering reminder that the certification process that underlies web site authentication —- a mechanism we all rely upon daily —- is far from bulletproof.

Posted by Michael at 01:21 PM | Link | Comments (2)

December 10, 2008

Seeking Tools for Web Page Design

I am a guy whose idea of a web page design tool has always been stuff like Kompozer, and I’ve got the homepage to prove it (although, actually, most of that was done by hand back in the day….).

But I was admiring a nice looking web page with good graphics and drop-down boxes the other day, and wondering how they’d done that. A quick look at the codes suggests it was done in iWeb 2.0.4. So I went looking for that.

Turns out, shoulda figured given the i, that’s its for Mac, and I’m a PC guy.

I even went so far as to see how you might install a Mac tool on a PC. VMware? OK, been thinking of that to run Ubuntu next to XP. External hard drive? OK, got a few spares acting as paperweights. Bittorent a pirated copy? Forget it.

So … anyone know of a good, ideally free, XP-compatible (or maybe Ubuntu-compatible) web design tool that makes cool pages easily?

Posted by Michael at 02:30 PM | Link | Comments (5)

November 21, 2008

Florida Teen Films His Suicide On Webcam

It seems I’ll be on Channel 10’s 6pm news broadcast explaining why tragedies like this one — Pembroke Pines teen broadcasts suicide on webcam — don’t mean that we need a special set of cops and regulators for the Internet. (Earlier Channel 10 story, saying up to 1500 people were watching his broadcast; eventually someone called the Pembroke Pines cops, but they broke in too late to save Abraham Biggs Jr.)

The facts are grisly:

A Pembroke Pines teenager told an Internet audience he wanted to kill himself by drug overdose — and then he followed through on his macabre threat while a live webcam captured it, according to the Broward County Medical Examiner’s Office.

Abraham Biggs Jr., 19, ingested a lethal mixture of three different drugs early Wednesday, then continued to blog about it while others watched online and egged him on.

The end of the video — which shows Pembroke Pines police busting into his bedroom and discovering his body — remained up on LiveVideo.com as of Friday morning.

Yes, I blame the people involved, not “the Internet”.

Florida has displaced the common-law rule against suicide with some statutory provisions. The most relevant one is aimed at assisted suicide (there’s also § 782.081, banning premeditated commercial exploitation of a suicide, but that seems to me not to apply to these facts). Here’s the relevant law:

782.08 Assisting self-murder.—Every person deliberately assisting another in the commission of self-murder shall be guilty of manslaughter, a felony of the second degree, punishable as provided in s. 775.082, s. 775.083, or s. 775.084.

The obvious legal questions, were a prosecutor to attempt the probably unwise project of indicting one or more of the ‘egging on’ crowd, are
  1. Does ‘egging on’ amount to ‘deliberately assisting’?
  2. If the statute does make ‘egging on’ manslaughter, does the First Amendment prevent its operation because it protects this sort of speech?

My gut instinct — and I’ll quickly admit this is not my field at all — is that ‘egging on’ does not amount to ‘deliberately assisting’ under this statute, which was pretty clearly aimed at physician assisted suicide, and cases where someone gives a depressed person guns or pills. I see the law as criminalizing the provision of tools in the main. Perhaps this could be extended to specialized knowledge, such as telling a depressed person how to make or find a gap in a protective fence at ‘Suicide Gulch’. But I don’t see it as extending to encouragement — even if a psychiatrist might testify (let us imagine) that the encouragement was a necessary element of the victim’s decision.

Good thing, too, because the second question is much harder…

Posted by Michael at 02:51 PM | Link | Comments (5)

November 07, 2008

What's the Point of This Stuff?

Most of the time I understand the theory behind email sp*m. People are hoping I’ll click a link or reply. In the end they either want to sell me something, or they want to spoof some information from me. Similarly with blog sp*m — either it’s ads, or an attempt to raise their Google rankings by showing a link from here (with a decent Google rank) to there.

But there are two kinds of sp*m I do not get at all.

The first kind is the blog comment with a link to a web site of garbage characters. Usually when I click, there’s nothing there. What’s the point? Is the botnet just practicing?

The second kind are email messages like the one I just got twice today, which I quote in its entirety, compete with original formatting:

Dear Sir,
I will like to know if it is possible for me to make
reservations of plane tickets in your travel agency for one of our
members and to pay remotely with international card accorded with
authorizations.
I remain on standby of a favourable response from your office. Please
confirm this booking and forwards fare as soon as possible.[Accra to
Cairo to Paris]
Name: [1] KOFI OPOKU
Date is 15th of November 27th of November 2008.
Best greetings.
Dr Aileen Winch

Any ideas?

Posted by Michael at 11:26 AM | Link | Comments (11)

October 11, 2008

Google's Time Machine

Goole has a Time Machine. Search the web as it was in January 2001.

Posted by Michael at 11:50 AM | Link | Comments (1)

August 29, 2008

Ubiquity Looks Cool

Mozilla Labs » Blog Archive » Introducing Ubiquity.

The Borg marches on?

Posted by Michael at 09:26 AM | Link | Comments (0)

August 28, 2008

Wheeeee

Go to google images. Search for something. Then copy/paste this code in your internet address bar:

javascript:R=0; x1=.1; y1=.05; x2=.25; y2=.24; x3=1.6; y3=.24; x4=300; y4=200; x5=300; y5=200; DI= document.images; DIL=DI.length; function A(){for(i=0; i<DIL; i++){DIS=DI[ i ].style; DIS.position=’absolute’; DIS.left=Math.sin(R*x1+i*x2+x3)*x4+x5; DIS.top=Math.cos(R*y1+i*y2+y3)*y4+y5}R++}setInterval(‘A()’,5 ); void(0)

Refresh for extra vigor.

Posted by Michael at 12:00 AM | Link | Comments (2)

August 05, 2008

Offline Wikipedia -- Only 3.5GB

WikiTaxi offers you an offline snapshot of the Wikipedia. The full English dump is only 3.5GB. (An abridged version is a svelte 25MB.)

Did you ever want to take Wikipedia with you while you are offline? Call on WikiTaxi: It is a portable application that delivers the Wikipedia of your choice to wherever you go.

WikiTaxi enables you to read, search, and browse Wikipedia offline. No Internet connection is needed, all pages are stored in a WikiTaxi database. Because Wikipedia is constantly growing, WikiTaxi uses compression to make sure that the database stays reasonably small.

WikiTaxi is up to date. It works with the original Wikipedia database dumps, which are updated regularly every few weeks or so. If you feel that your offline Wikipedia is getting to old, you can go online to download a more recent version or just copy it from a friend.

Not only is this just simply kewl, but I imagine scholars looking for a way to measure changes in the wikipedia will love this.

Posted by Michael at 11:44 AM | Link | Comments (2)

August 04, 2008

'88% of YouTube is Original Content'

Groklaw, 88% of YouTube is New and Original Content, Professor Says.

The citation is to this (long) YouTube presentation, “An anthropological introduction to YouTube” by Dr. Michael Wesch, an anthropologist at Kansas State University.

(Lots of other interesting stuff there too.)

Posted by Michael at 02:14 AM | Link | Comments (1)

July 13, 2008

Google Privacy Notice Visibility Varies by Location

Ted Byfield notices something interesting: Google: ‘Privacy? Depends—where are you?’.

Documenting and figuring out how Google treats different language/national groups differently is going to be a full time job for someone…

Posted by Michael at 12:00 AM | Link | Comments (7)

July 11, 2008

A Taste of What Real-Time Data Can Do

From Emergent Chaos: Leveraging Public Data For Competitive Purposes who will I hope forgive me for quoting an entire post, but it’s just so amazing:

The Freakonomics blog pretty much says it all:

The latest: importgenius.com, the brainchild of brothers Ryan and David Petersen, with Michael Kanko. They exploit customs reporting obligations and Freedom of Information requests to organize and publish — in real-time — the contents of every shipping container entering the United States. From importgenius.com.

There’s a neat ticker on the bottom of their page showing a trickle of these data. Watch it for a few minutes: it’s mesmerizing and provides a sometimes beautiful window into the wonders of international trade.

Talk about a not-so-covert channel leaking what your business is up to on a daily basis. What the Petersens and Kanko are onto is yet another unintended consequence of globalization. It makes me wonder what other sources like this are out there and accessible via the Freedom of Information Act. Similarly, as one commenter on the above article asked, how soon before people try to game the system:

I wonder if something like this will lead to a rise in ‘creative’ customs declarations. Say a proxy company to take that new shipment of 22,000 digital thingies that are then immediately sold to Apple and thus mitigating the chances of someone predicting the street date of their latest offering
Posted by Michael at 12:24 PM | Link | Comments (0)

July 08, 2008

DNS Cache Poisoning Exploit Sorta Patched

Do you run BIND as a caching resolver? If so, I gather this new exploit, CERT VU#800113 DNS Cache Poisoning Issue, is a pretty big deal, and you need a patch NOW.

Update: Links to more about this at Emergent Chaso, Massive Coordinated Vendor Patch For DNS. Patches for products other than BIND are out or will be soon.

Posted by Michael at 03:31 PM | Link | Comments (0)

July 02, 2008

Today's Discovery In Applied Informatics

I have found what I believe to be one of the last types of information for which search on the Internet remains utterly useless: finding where fireworks stands might located in the South Dade area.

I did discover that there’s a store in Key Largo, but that’s kinda far.

The big July 4 celebration in Coral Gables at the Biltmore has been canceled again — perhaps permanently. And the family doesn’t want one of those boxes they sell in Publix this year…

Posted by Michael at 11:27 PM | Link | Comments (0)

May 05, 2008

If You Wait Long Enough, Everything Comes Back Into Style

If you wait long enough, everything comes back into style, and it seems that on the Internet the process is even faster than in fashion. Example: Hand-coding HTML is in fashion again. The article says “still”, but I think it’s really “again”.

Posted by Michael at 08:52 AM | Link | Comments (0)

April 28, 2008

Timewaster or a Waste of Time

Although I am often a sucker for online timewasters (and never more than during the exam-writing season!), and although I gather some folks love this thing, I’m having some trouble figuring out the attraction of Pass the Ball, a shockwave object.

Can someone explain?

Posted by Michael at 09:50 AM | Link | Comments (2)

April 19, 2008

I've Been Joe-Jobbed Again

Someone has emailed the entire universe a series of cheap ads for tawdry goods forging my email address in the “from” line. It is not the first time I’ve been ‘joe jobbed’ but it seems to be an even more thorough job than in the past.

As a result, I’m getting a flood of mailed bounces, rejections, spam complaints and the like. No doubt many systems will now blacklist my address. And so on.

And it makes finding the real mail a bit of a needle in a haystack problem. Not to mention that if I tried to mail you, misspelled something, and it really bounced, I’ll never notice.

If you need to reach me in the next few days, or more, please consider the phone if I don’t reply.

Posted by Michael at 03:14 PM | Link | Comments (4)

April 06, 2008

Another Reason Why Comcast Isn't My ISP

Most of the reasons that Comcast isn't my ISP have to do with its aggressive opposition to net neutrality. But there's also a substantial quality of service issue: see, for example, Steven M. Bellovin, An Outage from Managing P2P Traffic?.

Not that I love AT&T, or that their net neutrality politics are so much better. But their service seems somewhat better, and they're a little less in-your-face about their views.

Posted by Michael at 08:25 PM | Link | Comments (1)

April 01, 2008

Gmail Unveils 'Custom Time'

Google has unveiled what looks to be a Really Useful Service as an enhancement to its Gmail (eternal Beta). They call it “custom time”.

New! Gmail Custom TimeTM  

Ever wish you could go back in time and send that crucial email that could have changed everything — if only it hadn’t slipped your mind? Gmail can now help you with those missed deadlines, missed birthdays and missed opportunities.