RKWare.com
Just another WordPress weblog

Today, I had at least one email sent from my gmail account to 50 of my contacts. Below is the email that I’ve sent out to them. Perhaps it will help remind us how to react to these sorts of things. The short version… Check what has access to your account and change your password!

And now… the email that I sent (which amusingly, bounced to about 20 of those 50 contacts):

Earlier today at least one mass email went out from my gmail account to a random sampling of 50 of my gmail contacts, containing a link to readytoview.co.cc. My apologies… I’ve been at home sick today and was asleep at the time, and many have emailed me letting me know my account has been compromised.

The good news is, when I checked the link, the domain name is disabled now, but if you have clicked on it something may have been active that has compromised your gmail account. I’ve done some research on that url as well as some strange one’s I’ve seen in my email box lately. They are either dead, or redirect to dead URLs, and there’s little mention of them on in the internet…
At the bottom of gmail, there’s a link to view all activity on your gmail account. Here’s the last 5 entries for me:

Browser * United States (IL) (99.53.112.xx) 5:19 pm (0 minutes ago)
Mobile United States (IL) (99.53.112.xx) 5:04 pm (14 minutes ago)
Browser Poland (62.87.147.61) 1:50 pm (3 hours ago)
Mobile United States (IL) (99.53.112.xx) 10:27 am (6 hours ago)
Mobile United States (IL) (208.54.7.xx) 1:48 am (15 hours ago)

The 99 IP is my home and at 10:30 this morning I sent an email to work, and the 208 IP is my cell phone provider. Clearly, the Poland IP address was not me.

Also, that window will provide a method to allow you to sign out any other sessions that may be signed into your account if there are any active. Once you click that button, you’ll get:

Successfully signed out all other sessions.
Note: Users can log in again if they know your password or have it saved on their computer. If you are concerned about someone using your account without your permission, please change your password.

The above link will take you to your manage your Google account page, which not only lets you change your password, but also review what sites you have given access to your Google account. If you see strange activity on your account, it may be a good idea to review the applications that are allowed to access your Google account.

I’ve changed my password and apologize for the random email. On the upside, some of you I haven’t talked to in forever… and I don’t recognize some of the contacts… but its always good to reconnect!

I’d be more then happy to help with anything technical or security related, so if you ever have any questions about anything… don’t hesitate to contact me… presuming you still trust me having my gmail account compromised a bit! =)

Sorry again!

Ryan
Share

So, Comcast’s latest commercials are aimed directly at U-Verse customers… Perhaps they are only running them on U-Verse… but it seemed like a rip off of Verizon’s Droid Does campaign and was enough to get me interested to click on through to their website listed in the ad.

I’d love to get some of the data they used to make these claims because they really seem outrageous and some cursory searching around on Comcast’s site to “learn more about xfinity” didn’t even mention any of these points.

More HD

Xfinity has over 3,000 HD choices. U-verse has only 254

First off.. 254 HD channels on U-Verse seems very high. Checked my channel lineup (easily accessible, not so much for comcast’s), went to the largest package and Chrome tells me that there are 289 “HD”‘s on the page. And there’s generally an HD in the channel abbreviation and in the description so each channel gets counted twice. So rough guess is 145 HD channels are available. I have a hard time believing that comcast even can offer 3000 channels.. let alone all of them in High Definition. Something definately isn’t right there.

Better HD*

Xfinity has better HD picture quality than U-verse.

That sounds very subjective… but somehow it sounds fishy. Notice that “*” in the heading. Here’s the fine print from that page:

*HD picture quality rating based on September though December 2008 study of the top HD channels by Frank N. Magid Associates.

A quick google search turns up magid.com with a suspicious sounding mission statement:

Our Mission

Frank N. Magid Associates, Inc. helps our clients become more profitable by solving their business problems and helping them take advantage of opportunities.

And their page on what they can offer the Cable and Satellite Distribution Industry is also fluffy and reeks of astroturf. I’d love to review how they reviewed and analysed HD picture quality.

Much faster Internet**

Xfinity’s fastest Internet speeds are more than twice as fast as those of U-verse (50 Mbps vs. 24 Mbps).
And if you’re watching two HD shows at the same time and try to go online, U-verse’s fastest Internet speeds will not be reached.

Again with the asterisks… this refers to “Sand Cherry Associates” equally fluffy. Can’t argue with the 50Mbps to 24Mbps caps, but I wonder how often you actually get the full 50Mbps since you’re sharing your bandwidth with your neighbors. Also, the asterisks admit that the reduction in speed only applies to U-Verse speeds above 18Mbps, and that’s only when you need the bandwidth for HDTV or Phone. Personally, I’d rather see my internet slow down a bit then see my TV picture break up or phone calls interrupted.

More On Demand entertainment

Xfinity has 13,000 more On Demand choices than U-verse.

This one may not surprise me that much. AT&T’s On Demand offering always seems limited.. but I am not a big consumer of On Demand content… When I had Comcast, they had a better selection, but 13,000 more seems very outlandish to me.

The ability to stream multiple HD channels

With U-verse, only two HD channels can be streamed to one household at the same time.

Last I checked, two HD streams is multiple… as in.. more then one. But yeah, one DVR can record two HD shows at once, and two additional non-HD shows. Its never been an issue for me since I don’t record THAT much TV… and if I ever had to make a choice, chances are one of the shows is something like Seinfeld that I wouldn’t mind recording in Standard Definition because it wasn’t even recorded in HD!

The ability to pause any TV with a DVR box

With U-verse, only one TV showing live content can be paused at any time.

And finally… I only have one DVR box, but I find this limitation hard to believe. If I had 2 DVR boxes why can’t both pause live TV? I’ve never heard anyone complain of this.. is this really a problem for anyone?

In the 3-4 years I’ve had Comcast’s premiere offering.. I’ve never been impressed. Their systems are slow.. menus are cumbersome… and the service was unreliable. I’ve been a U-Verse customer for well over a year now and I’ve been happy with it!

Share

Tags: , ,

Yesterday, I launched my blog series on Twitter and Part 2 continues with the early days of Twitter.

Originally, Mobile access to the web was not as ubiquitous as it is today. Twitter existed as a website to be accessed from your computer, or you could link your cell phone number and use SMS to send text messages to Twitter. There were not many people on Twitter so you tended to follow your real life friends and would have device updates on. This feature is still available today, but with the exception of an important person that’s very low volume… most people will find the device update feature to be disruptive and find that mobile clients are far more effective at getting these notifications. There’s also an option to get your direct messages sent directly to your phone as well. I find that to be useful as I rarely get or send DMs and sometimes my phone won’t have data service but can receive SMS.

A snapshot of my Twitter Stream

My Main Twitter Stream

With the onset and widespread adoption of Android (and I suppose I can give some credit to the iPhone as well), the SMS interface to twitter has largely faded away and has been replaced with mobile applications and desktop clients but I’ll save that for a later discussion on the Twitter API. Twitter’s major defining characteristic is the 140 character limit since SMS was designed to be the main interface. SMS messages are limited to 160 characters… leaving 20 characters for Twitter to include the username in the Tweet. I wonder how many people are not aware that and perceive it as an artificial limit.

Originally, you saw every single tweet from the people you follow. Originally where twitter currently asks “What’s happening?” was “What are you doing now?” and tweets were supposed to answer that question. Most people are confused at what you’re supposed to tweet and the original question led people to initially share what they were eating, bodily functions, or other minutia of our daily lives. Eventually the novelty wears off or they realize that people just don’t care about the details of their lives, but twitter is most useful when you share interesting things in your tweets.

Twitter’s first big splash was at South By Southwest, a technology oriented conference in Austin, Texas, when people could keep in touch with their friends and find out where friends were meeting for food or drinks… or sharing key points from an interesting talk. And that’s when the lightbulb turned on for people and Twitter began to take off. You can’t really explain to people the magic of Twitter; they need to experience for themselves.

A mention on Twitter

Me being mentioned in a Tweet

As Twitter grew in popularity, the open ended nature of twitter allowed the community to innovate and establish standards. The first idea was a way to refer to another user on Twitter. Some clever person decided to use an “@” before a username to indicate that the following text was another user on Twitter. Soon after, it seemed natural to direct a tweet “at” someone by starting your message by mentioning their username (@username).

Eventually, the Twitter team realized this was a good convention and it became a de facto standard. They began linking these mentions to the users twitter page where you could read their tweets and decide to follow them. This was the primary way that people found interesting and influential people on twitter. And its also when people began using Twitter as an ubiquitous messaging platform. And was the first feature twitter implemented to allow you to control your twitter stream. At first, this was an optional feature you can change in the settings, but now… its on for everyone.

Since social circles never completely overlap, Twitter streams were becoming increasingly polluted with tweets that were directed at other users. You were offered three settings to limit tweets from entering your stream: View all tweets from your followers (original behavior), Filter out all tweets that are directed at another user (restrictive, but you won’t be distracted by conversations), or a balanced approach that filters out tweets directed at people you don’t follow (today’s behavior). This lead to a new way to use twitter as a communication platform. You could direct tweets at people without worrying about annoying people who aren’t already friends with that person, but still get the benefits of being able to see that a group of your friends are communicating.

Twitter Fail Whale

The Fail Whale as seen on Twitter

Oh, and the initial design of twitter and the computing power required to processing the growing load and increasing complexity lead to the birth of the Fail Whale. Of course, back then… twitter just stopped responding rather then providing the well known image of failure. Twitter wasn’t designed to grow as quickly. Twitter’s in much better shape now, but there’s still hashtags, search and retweets to cover, but those will wait until the next installation of this blog series.

Share

Tags: , , ,

I plan to be writing a bit more here about my thoughts on Social Networking, so I thought I’d start by getting some of the basics down. And of course, when I saw Social Networks, I mean the only one that means anything at all to me… Twitter. I’ve often said “If you’re not on Twitter, you are dead to me”… and while it sounds funny, its very true. I’ll elaborate on that further in a future post, but I’d be remiss if I didn’t mention that Facebook is worthless to me and I’ve considered many times deleting it.

First off, I’ve been around Twitter for a while. Since 1/25/2007, to be exact. To put that in context, Twitter opened to the public on 6/15/2006 and the first big wave of attention was at South by Southwest around 3/12/2007. I don’t think of myself as elitist (my 320ish followers will attest to that), but I’ve been around long enough to see some major changes in Twitter. Also, Klout seems to think I know what I’m talking about. Sadly, I’m not aware of a good Guide to Twitter that explains how some things work and share some annoying habits I often see on Twitter. Hopefully, I’ll be able to collect enough of my thoughts here in one place in a coherent way that is actually interesting to some people

I’m hopeful that some people will find some of these posts useful and that it may help them to become more interesting Twitter Users and maybe avoid inadvertently annoying your followers and perhaps some real life friends. If any of my complaining describes what you do on Twitter… take it as constructive criticism, rather then an insult.

A snapshot of my Twitter Stream

My Main Twitter Stream

With all that said, it may shock to know that I read every single tweet that shows up in my main timeline. That’s right, every single tweet. This means that on the rare occasion that I’m away from my phone for more then 8 hours or so… I actually spend upwards of 30 minutes reading and looking at pictures or links that may appear to interest me.

As a result of this, I try to choose carefully whom I follow. I started with people I knew and have actually met in person. Then I included people who ran projects I used or wrote code I used. Once hashtags were adopted and Twitter Search evolved, I befriended other Twitter users who shared a similar interest. At some point, the decision to follow someone had to be weighed against the cost (in terms of my time) to read every message.  This meant that once my Follower count approached 100 people, I became selective when deciding whom to follow and much more likely to unfollow someone who’s tweets were getting on my nerves.

I’ve explored many twitter clients, but they really don’t offer me anything I really need. So, if I’m at a computer, I use twitter.com… and on my phone I use the official Twitter for Android app. I have a wishlist of features I’d like to see either implemented natively in twitter or what my ideal client would offer. I may even give in and just start writing my own… if that happens, expect more details here.

Next up, I’ll be talking about what the early days were like on Twitter… Hopefully, I’ve managed to whet your appetite that you’ll want to read that. (You do use Google Reader to keep track of interesting blogs and websites… right? leave a comment or ping me on Twitter if you’d want to hear me ramble on about that!)

Share

Tags: ,

Since the announcement of ChromeOS 4 days ago, the Internet is buzzing with reactions. For example, TechCrunch has two recent articles, one positive and one negative.

The negative story hammers Chrome for not supporting Android apps. This isn’t surprising given the rumblings that Google prefers web apps over android apps. its hard to say where things will be in 3-5 years, but if WebKit does evolve to the point where it performs as well as native Android apps, then it makes sense to abandon Android apps, especially if Android doesn’t become the dominant platform. Assuming a split between the iPhone and Android (and perhaps WebOS or Windows Mobile, HA!) and a web app performs well on both (and supports all the native phone features), why bother writing apps for just one platform? If web apps can’t easily do what native apps can, Android functionality can always be added to Chrome OS at a later date, even by someone outside of Google, thanks to the wonders of Open Source. I can’t imagine it would be that hard to launch a Java Virtual Machine, with the Android Activity rendered to a panel in Chrome OS, I’m just not sure that it fits in with the goal of Chrome OS. And really, when are people going to stop freaking out about the stability or reliability of an Open Source project, just because anyone can change it or make their own derivative or find flaws in the program. (All of those are good things, btw.. given that proper controls are in place). Open Source is an advantage, not a liability.

Also, a big limitation of mobile phones is its lack of any real processing power. Up until when I finally rooted my G1 a few months ago, I was under the impression that the web browsing was slow on my device due to latency or bandwidth on T-Mobile’s 3G network. That is until I tethered my laptop and was able to get 600KB/s download speeds and web pages rendered with images almost immediately, while 10-15 second page load times are common. I have to presume it’s WebKit rendering the HTML that is slow with limited processor and memory. So, there’s a fundamental difference between mobile devices and actual computers. Perhaps they will converge over time, but there will need to be some breakthroughs in power consumption of more powerful processors.

What’s interesting in the positive story is all of the negative comments by people who just don’t get it. For even more fun, check out a negative post’s comments from July. Chrome OS is about FAR more then just a web browser. First, Chrome OS moves everything to the Cloud, for better or worse. Assuming we trust Google to not lose or snoop our data, I don’t have a problem with this as it’s benefits are far outweighed. Imagine losing your laptop and being able to sign in to another ChromeOS device (replacement, friend’s laptop, coffee shop, etc.) and instantly have access to all of your data. Of course, this assumes that Google is going to provide potentially hundreds of GBs of storage for your videos, photos and music. Perhaps their strategy is going to be to leverage YouTube and Picasa Web Albums.

Also, people are panicked over Chrome OS being “just” a browser. First off, they are acknowledging that this isn’t going to be targeted at Power Users (ie, most of TechCrunch’s audience) but rather at the vast majority of “regular users”. Google stated that they have a LONG list of use cases that they want to implement. Many of those cases are already satisfied by existing web apps for things like emails or calendars. Its not hard to conceive Chrome OS recognizing USB devices and accessing photos or videos on a camera or phone, and music on a MP3 Player or phone… and syncing those with the laptop and conversely up into the cloud to the appropriate services.

I think many people would be amazed at what some web apps are capable of now. Photoshop is often pointed to as a necessary app that people need on their computers. Really? If you are a graphic designer, then sure… but Chrome OS isn’t directed towards you, at least not for advanced graphic work. I really doubt that many people use Photoshop for more then cropping, rotating, watermarking, or minor corrections like red eye or color levels. A quick web search turned up several web apps that are up to those tasks, and a year from now they may have even more functionality.

And, for all the concerns about requiring an active Internet connection, remember that HTML5 includes offline storage and even without HTML5, projects like Gears (among others) provide for offline access. Gmail has had offline access for about a year now. Chrome OS devices will have plenty of storage to mirror your data that is in the cloud. There’s no reason that these web apps can’t be accessible as offline applications, syncing your data up to the cloud automatically when you next get an internet connection.

And finally, the biggest reason why I think Chrome OS is a big ball of awesome… It’s Linux. Yes, people railed on Google about it not really creating anything new. Its Chrome on Linux with some other glue. Saying that isn’t an OS is like saying that Ubuntu isn’t an OS since its based heavily on Debian. And, Chrome on Linux IS a new thing. Chrome started as a Windows App. That makes sense as there are MANY Windows users, so it is a brilliant move as it exposes those windows users to a superior browser and allows Google to work out its issues and add features. Its a great way for Google to get their foot in the metaphorical door. Some choices were made to make it easier to port to other platforms, like using Skia rather then GDI. Clearly google planned on Chrome running on more then windows.

So, yeah.. the Chromium project has been making great progress and Chrome has been usable on Linux for some time now. Yes, it makes me a little bit happy to see this as an opportunity for someone to hand Microsoft some stiff competition (since Apple priced themselves out of that role). But, the REAL thing to be excited about it the fact that if Chrome OS is even mildly successful, it means that there may finally be a critical mass of Linux users. So, finally there will be a real reason for hardware manufacturers to provide Linux support. Support has been pretty good from the likes of Intel, Nvidia and ATI/AMD for graphics drivers. But things that are clearly lacking are low level things like power management, suspend/resume, some wifi-drivers, etc. Having Google working with hardware manufacturers means that the rest of the Linux community will benefit greatly. Hopefully, the days of buying a laptop and hoping that all your hardware will be well supported will soon be gone for good!

It will definitely be an interesting year or so! I, for one, will be eagerly awaiting to see how this all plays out.

Share

Tags: , , , ,

I recently came across an interesting book,
The Future of the Internet–And How to Stop It. (Yes, you can buy the book from Amazon, but the entire book is under a CC liscense and is available for download at the books website). It provides an interesting retrospective of how the Internet got to where it is, and what may happen to it in the future.

What’s really interesting is the point made in this really well written review:

In passing, I love the brutal critique by Gene Spaford of the $100 laptop. He likens its projected impact–exposing millions to the bright side while not fixing their poverty, water, and disease–to subsidizing pet rats for every household just prior to the Black Death plague. My friend Lee Felsenstein is an equally virulent opponent of the $100 laptop, for different reasons. Me personally, I think the cell phone (but not the iPhone) is the only way to educate 5 billion people fast and with day to day relevance to their needs.

Wow… I never really thought about it, but I think its completely accurate! The One Laptop Per Child initiative has a noble goal of providing inexpensive laptops to poor children around the world as well as ensuring internet connectivity. I can’t argue with the educational aspects of the projects and it certainly would provide much more opportunity to many that the world has ignored for far too long.

However, its always been presumed that those opportunities are strictly positive. They may be overwhelmingly positive, but I’ve never considered the negative effects, nor the things it will have little to no effect on.

The Internet is NOT a safe place. This is obvious but most people forget this. Also, when most people think of the dangers of the internet, they think of either an Internet stalker or identity theft, typically an unrealistic fear of intercepted e-commerce transactions. However, there are far more dangers that are often ignored both by those that are new to the internet (who typically aren’t aware of the dangers and are overly trusting) as well as by those that are quite experienced and are aware of at least some of the dangers (ie, they know what a Trojan is, and why they shouldn’t blindly run untrusted programs).

Whatever platform gets widely deployed will quickly endure a trial-by-fire in which it’s security is tested, for if there are any security holes which allow the laptop to be exploited to send spam or access their personal information, which is a time bomb waiting to happen. As much as I support open software, I’ll be the first to admit that it isn’t perfect and can be exploited. Microsoft certainly has a large target (and with saner software it might not be so easier to exploit), as will any other widely adopted software. As Zittrain says, “People rob banks because that’s where the money is”.

Does this mean that these projects should grind to a halt? Certainly not! However, I hope someone over there has thought long and hard about the security and privacy side of things. It isn’t listed in the Criticism section in OLPC’s Wikipedia page, but that either means it has been addressed sufficiently or it hasn’t yet occured to anyone to make any noise about it yet.

The other completly ignored aspect is how providing internet access won’t do a thing to help with other more important things. Sure, there’s a wealth of information available on the internet, and the education is valuable, but without clean water, medical supplies and political freedom to act on their new information, there really isn’t much one can do, other then realize just how bad they have it in comparison to the rest of the world.

Certainly some thing to think about.

Share

Tags: , ,

Wow… I wasted many hours today due to Microsoft and general stupidity…

Here’s the situation.. we have a legacy Classic ASP site that we are moving to more scalable and stable environment… Since we want to have multiple web servers handling the load during peak hours (it runs just fine on one right now) and be able to perform new releases along with testing during off peak times while the website continues to run on one server. This also means that we can easily throw more webservers into the mix should that be necessary later.

The easy (and open-source and free) solution is to use Apache as a reverse proxy.  This also allows for some other neat tricks (mod_security, mod_deflate) without having to deal with Windows and IIS configuration.. or make any code changes for that matter.

The problem comes in with how Classic ASP deals with cookies. Deep in the bowels of ASP, Microsoft was benevolent enough to add in HTML encoding of your cookie’s name and value. This actually isn’t a horrible thing as it prevents some poorly written code from creating an exploitable bug (HTTP Header injection), but its a bit overzealous and there’s no way to alter its behavior. You’re simply stuck with it.

Of course, if you’re happily writing ASP code, it gets encoded and decoded for you so you never even know its going on.

ASP Code to set a cookie:

Response.Cookies(“SERVERID”) = “balancer.www2″

ASP Code to display that cookie:

Response.Write “Cookie: ” & Request.Cookies(“SERVERID”)

Outputs:

SERVERID: balancer.www2

The problem lies in what is actually being sent by IIS:

Set-Cookie: SERVERID=balancer%2Ewww2; path=/

%2E is simply an HTML Encoded period. I’ve never known a period within a string to cause a security issue… but it gets encoded anyway. Apache’s mod_proxy_balancer looks at that cookie and expects to find a period within it, using the part after the period to determine which server that person should get sent back to.

I spent a large part of the day thinking the issue was an Apache configuration issue, as even with debug logging on, it wasn’t outputing anything. Once I looked through the code for mod_proxy_balancer, i saw that it ignores the cookie unless there’s a period in the string, and clearly there wasn’t one in my string.

After spending about 5 minutes trying to find a way to disable or change that behavior within ASP (there isn’t any as far as I can tell), I quickly found a solution within Apache!

Since Apache 2.2.4, the mod_headers module provides a method to edit a header using a regular expression. I was already using mod_headers to pass along some values through Apache (like the external IP address, or if the request was over HTTPS), so simply adding one line to the Apache configuration file fixed the issue:

Header edit Set-Cookie balancer%2Ewww balancer.www

Now, apache watches the response headers for when we are setting a cookie,  and if it contains “balancer%2Ewww” it gets rewritten as “balancer.www” and sure enough both Apache and IIS are perfectly happy with the cookie and everything is working well.

If I didn’t have access to the source code, it would have taken me weeks of trial and error to determine what the issue was or it would have been given up on for simply being incompatible. If apache wasn’t as flexible as it is, i would have been stuck writing a patch to mod_proxy_balancer and recompiling my own apache rather then relying on the distro’s packages for updates.

This is exactly where the closed source commercial software (Microsoft) and, to a much lessor-extent, the walled-garden open-source approach (like Django) run into issues. As long as you are only using that vendor’s software in the way that the vendor envisioned you would be using it, you’re just fine. Its also why standards are a good thing.

Yet another example of why Mark Ramm was right when he wrote and talked about WSGI being the right way to write tools that properly interact with one another. I’m really convinced now that the TurboGears/Pylons approach is the proper way to build web applications.

Share

Tags: , ,

Powered by Wordpress
Theme © 2005 - 2009 FrederikM.de
BlueMod is a modification of the blueblog_DE Theme by Oliver Wunder