Posts by Sean Ellis

I'm a PC

And I run Linux. For $50 less than the Windows one.

Default Deny

"I think we should be thanking the Microsoft people who provide us with the extra .Net functions in the Firefox free of charge. "

No. Sorry, but just, no. Not even close.

Ever since reading this article (http://www.ranum.com/security/computer_security/editorials/dumb/) I have a "default deny" stance with stuff from the internet. Deny Javascript, deny cookies, and sure as hell deny anything that can download arbitrary code from the net and run it on my PC.

This is why I was using FF in the first place, to get away from horrid things like ActiveX. And lo! MS come along and open up a colossal potential security hole, injecting it into a third party product, without even asking me. Sigh.

I noticed this thing a while back; it was gone from my system within the hour and our sysadmin informed.

So, Bad Balmer icon from me.

Why does it matter?

It's a web page. What does it matter what OS you are running on? Nonstandard HTML is an argument, of course, but they say that they support Firefox 1.0, so that's probably not the reason.

Specific DOM quirks? No - Firefox support again rules this out.

ActiveX components? Euucch. But, given the general level of clue displayed, this is possible.

On the plus side, I've never had to use them so far, and now I'll just go and use someone else if I can't get in.

@anonymous

"misjudged the level of your technical competence"

The problem here is not technical.

The original article seems to understand exactly what data is transmitted. Microsoft has had a terrible track record with supposedly confidential information in the business field (e.g. Scan) and for various other reasons, and it is finding it very difficult to win back trust.

The main question here seems to be: Should I trust Microsoft with my data?

But it's not just Microsoft. The default position these days should be: Should I trust ANY company with my data?

Unaccountable censorship by the back door

If a service's users generate bandwidth, then charge the users for bandwidth. Don't start discriminating based on protocol, content or address, or trying to charge both ends of the chain.

Under the proposed scheme, I see a situation where any service could be slowed down to the point of unusability, if the ISP in question fancies that they can blackmail it into paying for delivery (BBC), or if it is not playing ball with their advertisers (dephormation.org.uk), if it's competing with their other businesses (VOIP) or if they simply don't like what it says (anything).

Where's the accountability in all this? Or are we leaving it to the invisible hand of the market that has served us so well recently?

Obligatory OOo reference

And of course, don't forget to do the same "rip off Britain" comparison for the major competitor, OpenOffice.org:

China price: £0

US Price: $0 (£0)

UK Price: £0

Who's being ripped off here? Er, hang on a moment...

Heaven, God *are* in Scn documents

"No where in Scientology will you find ... belief in heaven ... or even God himself."

With respect, rubbish.

Hubbard reported that he had actually visited heaven on two occasions, for the first time "43,891,832,611,177 years, 344 days, 10 hours, 20 minutes and 40 seconds from 10:02½ PM Daylight Greenwich Time May 9, 1963", and on his second visit remarked that it was basically going downhill: "The place is shabby. The vegetation is gone. The pillars are scruffy."

As for God, "Source is the 8th Dynamic" - the ulimate revelation of Scientology - basically states that Hubbard himself is God.

These people, like all religions, should be out of the classroom (except, of course, when being studied in a comparative religion course).

As for the IT connection, they did once try to sue Usenet, so they are the IT crowd's cult of choice, scrutiny-wise.

@AC 13:21

"It's almost as if they are /trying/ to make it look like a phishing attempt!"

Indeed. When I've had to use it, Mastercard's system triggers a XSS alert in Firefox3 with NoScript installed, which you then have to override manually.

Oh, and my wife chose the secure ID password, so I can never remember the damn thing. But she did a pretty good job of choosing a secure one. I have taught her well.

However, more security = better if it's done well enough, hence the GO icon.

So...

Buy the XP version, decline the license, claim your refund* (by right, as stated in the EULA), and knock a further few tenners off the price. Then stick Unbuntu Eee on it, and Bob's your uncle.

* - Disclaimer. Refund instructions for your vendor may be on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying 'Beware of the Leopard'.

I remember that OU program

Absolutely classic experiments. What happens if you burn sodium in fluorine? Well, we all know it should be spectacular - so let's do it! But the best one was the demonstration that diamonds are not forever, illustrated by heating one up and dropping it in liquid oxygen. Brilliant.

Oh, and the Braniac thing with the Caesium was faked. Ouch.

@Darren

Given that Canonical will be getting a lot of support calls along the lines of "I installed Windows Ubuntu and I can't find my Start button! Help!", and "How do I install World of Metal Gear Damarcy 4? What do you mean, Windows Only? Ubuntu is an OS so it must be based on Windows!", this is a brave move.

In the UK, $20 is £10. This buys you two Zinger Tower Meals at KFC. 2 months support for the price of 2 burgers? I'd say that this is not "a touch steep", but an absolute bargain.

By putting Ubuntu in a box and getting it on a shelf next to Windows in physical space, it's putting it in the same mental space in the customer's mind, and raising awareness that there is an alternative, and OSs don't have to cost $200.

Nice, sliding scale

There's already a nice, easy measure that acts as a sliding scale of disincentive for having a gas guzzler. Petrol at £1.20/litre.

This is a far more fair and direct tax than the proposed changes to the road fund license or congestion charge. If you have a Porsche but don't drive it often, you are doing less damage than a Mini driven 100 miles per day. High fuel prices skew the balance the right way.

However, we need to find a way to get rail charges and service levels sorted out fairly so that we can shift more cargo and people back onto the trains.

@AC

"However, the theory is just that, and has NOT been experimentally verified."

As the first commenter says, there are *much* more energetic events happening many times a day somewhere in the universe. This is experimental verification that the theories are not wildly wrong. Just because it's not us who are running the experiment, doesn't mean that we can't observe the results.

Nintendo DS teach excellency in English

Make well and happy studious in harmonious language!

Nintendo ediicate success with most excited training legimen, never to make doredom. Studious will be engage in repeats of english trial to sure complete mastermind of idiotic english languages.

@Kain Preacher

If my recollection of the teachings is correct, "an eye for an eye" was not a carte-blanche for poetic revenge, but rather a statute of limitations on reparations that could be claimed against a wrongdoer.

So yes, get back the $70,000. But "locking her up with rapists", as another poster has suggested, is getting us seriously into Daily Mail Reader territory.

@Gav

"Never can follow why people always gripe about ISPs limiting P2P traffic."

Of course the ISPs have to manage their own bandwidth.

I think the thing people are mostly complaining about is that ISPs are discriminating on protocol, not usage. I can quite happily download some big Linux distro over HTTP, FTP or P2P, so why should the P2P option be discriminated against when I am putting the same load on the network for each?

(Tux 'cos I mentioned Linux.)

Detecting adblockers

"how does Hula know that an ad blocker is being used"

The ad blockers typically alter the page so that the ads are never fetched from the server - they remove the HTML tags. Thus, if you are controlling a particular page, and have the appropriate server-side intelligence enabled, you can refuse to serve the actual content until the browser has downloaded the ad.

You are right, however, that an ad blocker which actually *did* download the ad would be much harder to block. And with Flash ads, they can tell when they are being displayed, not just downloaded, since they are executable content.

What you need to do to end-run around all of this is to effectively have a virtualized browser that does everything a normal browser page would do, but only actually displays those bits that are wanted by the user.

Ever wondered why online ads seem to be so dumb?

Could it be because the ad companies are only gathering data from people who are dumb enough to install things like this?

However, that may just be a demographically interesting target market. It doesn't take a genius like Barry Scott to market things to these people.

Look! Shiny things! Plates with kittens on them! Princess Diana muffin-o-matic! Genuine bakelite remnants of the True Cross! Shiny! Shiny! Buy now!

Ubuntu...

Hey, anonymous. I'm an Ubuntu (actually Kubuntu) user, fan, and evangelist, and even I'm not that naive. I'm currently preparing to upgrade all my home systems to 8.04.

Basically, I have backed up everything I can, burned a copy of System Rescue CD, and metaphorically put on a world-war-two home-guard-style tin hat ready for the time when I finally screw up my courage and hit the "upgrade" button.

(Cue scottish accent and choruses of "We're doomed!" from the wife.)

On the other hand, I suspect it's still rather easier than an 'upgrade' to Vista.

How much water?

370 million tonnes.

@Antoinette

'Why would $USER install "almost-Windows" on real Windows ?'

To try it out? Because they are fed up paying for virus and malware software? Because their Windows system gradually accumulates cruft, it's time for a reinstall, and what's all this buzz about Linux? To see if it would work for Gran who only uses email and a few websites? To evaluate it for work? Because they like the idea of 'free'?

To learn and understand something new?

So the Ubuntu guys have made it very, very easy to just "give it a try". Brilliant, I say. If you don't like it, just uninstall it, no harm done.

'The "Open Source" argument is irrelevant - Almost nobody pays for Windows,'

Speak for yourself, matey. Not all of us are ripping off software, even if it is a big corportation and therefore OK*.

I switched from Windows to Linux for 2 reasons. First. malware. I was fed up with spending most of my time (and processor cycles) defending against malware or trying to figure out which thing was making it run so slow this week.

Second, my MSDN subscription was up, and I didn't want to run unlicensed software. I have always felt very uncomfortable about this, and had done a self-audit some time before to ensure that I wasn't using anything I didn't have a license to. Now I run Linux, and I *do* have a license, to all the software on my machine.

Since then, for the most part it's given me less hassle than my Windows machine at work. (I mean - I update some random third party app, and I have to restart the *whole computer*? Sheesh. Welcome to 1977.)

* IANAL - may not be legally accurate.

And they only fixed it when...

...it was shown that the employees' data was similarly compromised.

So, as long as it's *your* data, who cares? But as soon as it's *my* data, it's top priority.

Note the weasel-wording.

"participating in copyright-infringing peer to peer networks"

NOT

"participating in illegal copyright infringement"

So... if you happen to use DodgyBobsIllegalP2P.com to get your perfectly legal Linux distros, the wording as reported *still* counts that as one of your three strikes.

@Steven Hewitt: What's wrong with it?

Here's a partial list:

- Features in the spec which are not documented.

- Features in the spec which cannot reasonably be implemented by anoyone except MS.

- Standard features in the spec implemented in non-standard ways (drawings, country codes, etc.) or ways that are intentionally broken (dates).

- 6000 pages of spec in a "fast track" process.

- Thousands of unresolved technical questions about the spec.

- MS's "Open Specification Promise" worded narrowly enough to exclude all meaningful competition.

- Egregious abuse of the voting process (Norway: 5 for, 19 against. Result - "Yes" vote). At least 5 national ISO bodies under investigation for irregularities.

Plus, of course, as you say, ODF was there first. ISO rules mandate that there should be one standard in a particular application area, and that new ideas should be added to that standard rather than spawning a new one.

Who do I need to write to at ISO to get this process stopped until a full investigation has been conducted?

Mythtv + ad detection

The advert detection scriptps in MythTV are bloody marvellous. Now I can watch the Space:1999 reruns on ITV4 without Barry Scott interrupting Barry Morse.

The more ads there are, the more people will find it worthwhile to invest in ad-skipping technology.

Thomas Jefferson said it...

"Ridicule is the only weapon that can be used against unintelligible propositions. Ideas must be distinct before reason can act upon them."

(Thanks to Mark Crislip of Quackcast for bringing this wonderful quote to my attention.)

Obligatory Feynman Quote

Richard Feynman attended a philosophy-of-science conference in the 1950's. The full story is in "Surely You're Joking, Mr Feynman." (What do you mean, you don't have it? Open another pane in your browser and get to Amazon *right now*. We'll wait.), Here's a relevant short excerpt:

...

There was a sociologist who had written a paper for us all to read -- something he had written ahead of time. I started to read the damn thing, and my eyes were coming out: I couldn't make head nor tail of it! I figured it was because I hadn't read any of the books on that list. I had this uneasy feeling of "I'm not adequate," until finally I said to myself, "I'm gonna stop, and read one sentence slowly, so I can figure out what the hell it means."

So I stopped -- at random -- and read the next sentence very carefully. I can't remember it precisely, but it was very close to this: "The individual member of the social community often receives his information via visual, symbolic channels." I went back and forth over it, and translated. You know what it means?

"People read."

Then I went over the next sentence, and I realized that I could translate that one also. Then it became a kind of empty business: "Sometimes people read; sometimes people listen to the radio," and so on, but written in such a fancy way that I couldn't understand it at first, and when I finally deciphered it, there was nothing to it.

...

I suspect the same thing here, as evidenced by Dave's distillation.

Dumb move

As others have said, dumb move. First, DDoS attacks are illegal, no matter who the victim is. Second, you are just handing the clams an enormous stick to beat you with.

Scientology loves publicity, it loves to play the persecution card, it loves to have someone to attack, and more than anything it loves to have someone to sue (search for the name "Keith Henson" if you think I'm not serious).

Instead, fight back by urging people to take a look at www.xenu.net.

@Mark

"... why the heck should we be accurate and reasonable?"

Because then we* can claim the moral high ground, present reasoned and supportable arguments to legislators, and point out the egregious fudging of figures from the MPAA et. al. without them having a pot-kettle-black retort.

* - define "we".

Virtualization may buy some new converts, but...

"People hate change… And that’s because people hate change… I want to be sure that you get my point. People really hate change. They really, really do.”

(Steve McMenamin Atlantic Systems Guild)

Unless you can offer something real, tangible and worth having after a change, then people won't change. Judging from the press reaction, many people don't see Vista as worth the pain. This is why it is easier to sell Vista bundled on PC's - for a new user, there is nothing to change from.

Now, if people want virtualization, and they can't do that with XP, then they will get a reward for the change to Vista. So I think that this will be a useful step for Microsoft.

Counterproductive

One of the things that the RIAA is trying to claim is that the Internet is a lawless series of tubes, where piracy and hijacking reign supreme, and that therefore any transfer of music should be tracked, chipped, licensed, tagged and accompanied by security guards with big dogs and CS gas.

This just gives them more ammo. They can point to their website and say: "See! See! Look there! This is what happens if you are a protection^H^H^H^H^H^H^H^H legitimate business trying to extort^H^H^H^H^H^H make an honest buck amongst the lefty-commie-pinko-libertarian-lawless-punks on the interweb. Vote for our laws requiring online transfers be tracked, chipped, yada yada, or the same will happen to you!"

Groklaw shows how to do it. Massive, in-your-face, legally unimpeachable spotlight-shining.

Refutation of this report

...can be found at Ars Technica.

http://arstechnica.com/news.ars/post/20080114-analyst-group-slams-odf-downplays-microsoft-iso-abuses.html

The article points out some flaws in the logic of the report, and also highlights the *very* selective reporting of the politics surrounding the different formats.

Of course...

...the best thing to do is to buy the time machine itself from eBay, using a coupon in 1970, then when you're done with it, take it back to 1970 and list it on eBay so that it can be used as something to buy with the coupon. Otherwise there won't be anything to buy.

P.S DON'T forget to take it back. I mean, really, don't.

Remember, YOUR work is copyrighted too

If you have a web page, if you upload your bedroom synthesizer noodlings, if you take a few snapshots and put them on Flickr, all of this is automatically your copyright.

Is AT+T ready to filter everything, by everyone?

It is time for a mass campaign of civil disobedience - anyone, everyone with a personal website should contact AT+T and ask them to filter this content as it goes onto their network. Impose bizarre and unworkable conditions. (... And *this* page is licensed only for IP addresses where the four values are solutions of this Diophantine equation...)

How will they deal with this? How can they argue that your copyright is somehow unimportant, when the pre-eminence of copyright is their whole argument?

Default Deny

I use a "default deny" stance. Nothing gets run from any site I don't explicitly trust. Ads are blocked, scripts, flash, anything. Adblock plus, with NoScript and CookieSafe just about take care of this for me.

http://www.ranum.com/security/computer_security/editorials/dumb/ was the article that influenced my security stance the most, and is well worth a read.

Radiation protector spam, above.

Randomly CAPITALIZED words? Check.

Unfounded assertions? ..directly from ear canal to the brain... Check.

Weasel wording? ...up to 99%... Check.

Contradictory claims? ...absorbs radiation... improves reception... Check.

Semi-attached facts? ...components were tested... Check.

Nonspecific claims? ...excellent results... Check.

B****cks? Oh yes, that's a big fat CHECK.

Heat, mercury

In the UK, where it is cold most of the time, we would need to turn up our heating a little to offset the lower heat output of the CFL bulbs. Of course, if you use gas for heating, this is more efficient and cheaper than using electricity, so you save.

In many states of the US, where it is hot a lot of the year, switching to CFL reduces the load on the air conditioning, so you save coming and going. You don't use power to generate the heat, and you don't use more power pumping it out of the building.

As for mercury, the mercury content of coal is sufficient that mercury emissions from the coal burned to power the incandescent bulb are larger than the amount of mercury in the CFL bulb, so you win. And the mercury is nicely encapsulated for recycling at the end of life.

In any case, inorganic mercury is nowhere near as toxic as most of the anti-mercury lobby would have you believe. Even organic mercury compounds differ markedly in toxicity, largely due to their different retention in the body (compare ethy mercury and methyl mercury toxicity data to see what I mean).

On the gripping hand, LEDs should overtake CFLs pretty quickly. I already use LEDs for some of my home lighting (replacing GU10 mains halogens), but they are currently rather dim.

Well, it made me look closely at Adobe Reader

Specifically, replacing it with something like Sumatra as soon as possible.

"Password Protected"

I'm not too worried about the physical layer - electronic or physical, it's all just a bunch'o'bits at the end of the day. They can go astray on the interweb as easily as in the post.

I am much more worried about the bland assurance of "password protected". What does this mean?

Is the data just on a CD with an autorun.inf that asks for a password? Or is it a pass phrase for a 1024-bit RSA-encrypted compressed database snapshot?

And even if it is the latter, is the password a nice, secure 64-character random string or the word "p455w0rd"?

We should be told.

Re: "I wouldn't even consider a dedicated reader"

Indeed. Even Steve Gibson on Security Now (interesting podcast, btw) admits that it's not great having to have a separate device. And he's a big fan of e-books.

Now, imagine if you will, a world where I already had something in my pocket with a large memory and a superb screen, which I had to carry around anyway (say, to make phone calls). E-book software on that *would* be attractive.

Steve Jobs: are you listening?

Xenu.net

Any mention of Scientology requires an obligatory link to Operation Clambake, at http://www.xenu.net.

I installed it yesterday

...thinking it was an update to Windows Search, for which I very deliberately have indexing turned off.

Here is what I understand about it after a little playing about:

- You can disable the new search, but if you do, you can't search at all.

- You cannot turn off indexing, merely pause it for a while.

- There is no "pause until I turn it back on", only "pause for X amount of time". max(X) = 1 day.

- It appears that the search requires the index - I have found no fallback to a brute-force search.

- The indexing status display is unreliable. About 20 minutes after installation, the status was about 4000 indexed, 1000 to go. After 4 hours, it was 17000 indexed, 21000 to go. On the positive side, after the initial day or so of disk grinding, it does seem to have calmed down.

- For certain (but not all) Powerpoint files, the preview pane takes ages to render the preview, during which time, the UI is entirely unresponsive.

- Even though Firefox is my default browser, IE is used to preview HTML and other content (e.g. powerpoint files). Luckily, it does at least respect my disabling of ActiveX controls. I know because of the errors it displays.

- Microsoft's definition of "music files" does not include ogg vorbis, although they do show up if you select "everything".

No chance

There is no way that google could stop AdBlock. If they did that, then they would instantly start playing whack-a-mole as hundreds of new variants would pop up. After all, it's an open platform. And if they closed the platform, a new "Combustion-Badger" browser would pop up looking surprisingly similar to the original open Firefox.

I think that google are savvy enough to avoid this trap.

Write off the adblockers - they weren't going to click anyway - concentrate on getting the money from the people who want to see the ads.

Kerberos?

Kerberos would fit the bill nicely, I'd have thought. Nice, open authentication standard, cross-platform, all that jazz. No need to collaborate on anything - it's all published, and Windows already supports it.

Oh, but wait. Microsoft broke it deliberately to limit interoperability.

Pareidolia

Pure and simple.