taint.org: Justin Mason’s Weblog

Security: Given the current prevalence of phishing attacks and spyware infestations, designing a good user interface that protects naive users against malware is now more urgent than ever.

Firefox is, of course, widely touted as more secure than MSIE. This is by and large true, due partly to MS’ emphasis in their UIs on one-step ‘easy’ installation and confirmation-dialog reduction (in my opinion) — but also due to the fact that spyware companies don’t yet see Firefox as a target to the same extent.

This changed recently — spyware ‘toolbars’ started to appear for Firefox as well. It was quite a surprise to see a dialog pop up when accessing an otherwise normal-looking (though advertising-heavy) page, using my Linux desktop, prompting me to install some ‘toolbar’ .xpi file!

Firefox 1.0PR now includes code to deal with this. Here’s how it works.

If a site I’m viewing attempts to install an XPI file, I get this prompt:

Note that it’s NOT a dialog. This is pretty handy, because it means that I won’t get annoying dialogs all the time if I do accidentally go to a unscrupulous site; it just appears like the part of the page. In the clueless user case, they may not even notice that they’ve been protected, which reduces the risk that they’ll install the extension anyway.

(However, I would have extended it by using an icon or look-and-feel that indicated that this was a ‘trustworthy’ part of the UI, rather than possibly part of the page.)

If I hit the ‘Edit Options…’ button, I get this:

A simple-enough dialog containing the list of sites permitted to install extensions. update.mozilla.org is in there by default, and I’ve added texturizer.net so I can install from their more extensive list of older extensions. The address of the current site has been dropped in automatically.

To permit the site, I have to hit ‘Allow’, then ‘OK’. So I do that, and hit the ‘install’ link on the webpage again:

And there’s the Software Installation dialog. Note the red Unsigned warning, the proportion of text that is a warning about installing bad stuff (fully half!), and — this is interesting — a greyed-out ‘Install’ button.

The button is on a timer — it becomes clickable after 2 seconds. This, presumably, is to ensure that people read the dialog! Reportedly, users no longer read dialogs, instead hitting OK on every dialog that appears. In my opinion, this is arguably due to ‘the boy who cried wolf’ syndrome: by default, MSIE and older Mozilla versions will ask all sorts of stupid questions about ‘are you sure you want to send stuff on the intarweb?‘ whenever you use Google. If anything is guaranteed to induce dialog fatigue, it’s that feature.

(Update: actually, that’s not the reason. Reportedly, it’s a workaround for a couple of social-engineering attacks, whereby an attacker could persuade the user to type a word ending in ‘Y’, and time the dialog to appear just before ‘Y’ is typed — causing the keyboard shortcut for ‘Yes’ to take effect; or persuade the user to double-click in the right spot, and similarly time the dialog to appear in the right place, in time for the second click. Still, I maintain the measure is useful to deal with the ‘dialog fatigue’ issue too. ;) Thanks to Smyler and Rod for pointing this out.)

I would have gone further:

• the ‘a software install was blocked’ page element should have an indication that it’s ‘trustworthy content’
• both dialogs should default to ‘Cancel’, to avoid users deliberately pressing ‘OK’
• I would possibly require a ‘yes, I read this’ tickbox to be ticked before the software is installed.

Interesting though. This is the way internet-facing UIs are going to have to develop, in my opinion.

Tags: dialog, file, firefox, installation, page, part, security, site, spyware, user, xpi

Tech: This is the second entry talking about ‘Life Hacks’. Possibly the best tip I came away from the talk with, is this one:

All geeks have a todo.txt file. They use texteditors (Word, BBEdit, Emacs, Notepad) not Outlook or whathaveyou.

What we keep in our todo is the stuff we want to forget. Geeks say they remember details well, but they forget their spouses’ birthdays and the dry-cleaning. Because it’s not interesting.

It’s the 10-second rule: if you can’t file something in 10 seconds, you won’t do it. Todo.txt involves cut-and-paste, the simplest interface we can imagine.

It’s also the simplest way to find intercomation. EMACS, Moz and Panther have incremental search: when you type a “t” it goes to the first mention of “t”, add “to” and you jump to the first instance of “to”, etc.

Power-users don’t trust complicated apps. Every time power-geeks has had a crash, s/he moves away from it. You can’t trust software unless you’ve written it — and then you’re just more forgiving. Text files are portable (except for CRLF issues) between mac and win and *nix. Geeks will try the Brain, etc, but they want to stay in text.

I was already doing this, having learned the latter lesson ;), but I was making one mistake — I was trying to keep the TODO.txt file small by clearing out old stuff, done stuff, and cut-and-paste snippets of command lines, and by moving things into files in ’storage’ directories.

That doesn’t work. You think you’ll be able to grep for it later, but you’ll have forgotten what to grep for. You’ll even have forgotten what storage directory you used. The solution is to keep it all in one big file, and use i-search. That really does work.

In fairness, I actually have two files of this type. One is the “real” TODO.txt. But the other is a GPG-encrypted file containing usernames, URLs, passwords, nameservers, VPN settings, etc. I have a feeling this is another common Life Hack idiom, too…

Another great tip in the same vein, from JWZ — make an /etc/LOG:

Every machine I admin has a file called /etc/LOG where I keep a script of every system-level change I make (installing software, etc.) I rsync these LOG files around (keeping redundant copies of all of them in several places) so that if/when I need to re-build a server from scratch, it’s just a matter of following the script.

This has been working out great (when I remember to do it. Discipline! ;)

Tags: emacs, file, grep, storage, stuff, tech, text, tip, todo, txt, type

Web: http://ws/ . Nifty!

Tags: abi, analysis, company, control, display, file, genome, mail, nobel, software

Funny: Here’s the
Daily Show segment with Scott Richter (WMV, 9.8MB).

Just ignore the lame subtitles added by whoever encoded the file… the rest of it’s seriously funny! ‘Clitorious’, indeed.

Update! 2004-04-13: thanks to Lisa Rein, there’s now a 10MB Quicktime .mov version, sans unfunny subtitles. I’d strongly suggest downloading that instead.

Tags: clitorious, daily, file, funny, mov, quicktime, rest, segment, show, update, wmv

Patents: I’ve just come across Tim Oren’s page on the Unisys GIF patent furore of 1994-5. Tim used to be VP of ‘Future Technology’ at CompuServe.

The GIF furore, in case you missed it, was one of the most far-ranging software patent debacles to date. Here’s what happened…

Compuserve was one of the biggest online services at the time. In 1987 they’d created GIF, an efficient image file format, for public use, with a very liberal license. As a result, everyone and their dog wrote software to read and write GIF files (including myself ;).

GIF, like many other tools of the time, used the LZW (Lempel-Ziv-Welch) file compression scheme, which had been widely published without any indication that it was considered proprietary. LZW was pretty much the de-facto standard for file compression in the early 90s, in the same way that ‘gzip’ is nowadays.

However — 7 years later, in 1994, Unisys suddenly announced that they had filed for, and eventually received, a patent on the LZW algorithm. As Tim wrote at the time, this was a ’submarine’ patent. (Unisys had owned that patent since 1985, and pursued hardware licenses — but all and sundry believed that the patent didn’t cover software-only implementations.)

Unisys shook downbrought an infringement suit against Compuserve, who had published the GIF standard and implemented it widely in their software. Compuserve had ‘no recourse but to settle’.

(Interestingly, it appears that at the time, Unisys seemed to think that GIF decoders needed licenses as well — popular thinking nowadays is that only GIF encoders need licensing, but Unisys didn’t think so at that stage at least.)

There is a happy ending — thankfully, free software saved the day. ;)

As Tim writes, Thomas Boutell, Jean-loup Gailly and others came up with PNG; Jean-loup and Mark Adler wrote GZIP; and LZW was consigned to the dustbin of unusable technology for most new projects. Old projects, of course, had to go through some redesign pains to achieve the same goal.

BTW, it’s worth noting that, even though the Unisys patent has expired, it’s still not safe to dust off LZW. GNU (and others) believe that there’s another patent filed on the same algorithm independently by — guess who — IBM, which doesn’t expire until 11 August

1. The thoroughly-competent USPTO strikes again ;)

The lesson: be careful when implementing published standards. Nowadays, the IETF requires that contributors disclose ‘the existence of any proprietary or intellectual property rights in the contribution that are reasonably and personally known to the contributor’. But in this case, the patent was owned by another body, Unisys, and the contributor (CIS) didn’t know that, so that wouldn’t have helped.

So, the real lesson: Just Say No to software patents ;)

Tags: compuserve, file, furore, gif, lzw, patent, patents, software, technology, time, unisys

Web: Slurpie - (another) distributed peer-to-peer downloading protocol (via HtP).

This looks pretty interesting; no special server is required, Slurpie can be used to download files from a HTTP/FTP server in a ’swarming’ fashion similar to BitTorrent.

However, Slurpie does require a central server of its own, which it needs to ‘know about’ somehow in advance, and that server will then know who’s downloading what. Not sure how you’d do that effectively; in this case, a .torrent-type file format that contains the ‘main’ file URL and a URL for the Slurpie server, might be more effective.

Tags: download, fashion, file, ftp, htp, http, protocol, server, slurpie, url, web

Social: Next-Generation File Sharing with Social Networks. One thing — the central server is not actually required, as WASTE showed. Otherwise good stuff…

I have a feeling that whatever clients are built to implement social-network-based sharing will need a way to deal with a user being a member of multiple indepedent networks, where Network A has a policy that would not permit Network B’s users to connect, but User X is a member of both.

Tags: file, generation, member, network, networks, next, server, social, thing, user

Voting: I’ve pointed to this before, but I use taint.org partly as a searchable database of annotated bookmarks, so — for reference — here’s the Australian Capital Territory’s EVACS system, an entire, open-source e-voting system:

EVACS is the computer system that provides for electronic voting and electronic counting for ACT Legislative Assembly elections. It provides for counting according to the Hare-Clark electoral system rules set out in the Electoral Act 1992.

EVACS was written using Linux open source software to ensure appropriate transparency. A copy of the source code is available in a zip file (127 kb). The source code for the casual vacancy module is in a separate file (38 kb). For more information contact Software Improvements.

Still not perfect — it uses electronic ballot stations, instead of paper ballots — but it does support paper ballots. And it’s open source; note the keyword above — ‘appropriate transparency‘. They said it, not me ;)

Tags: act, code, evacs, file, paper, software, source, system, taint, transparency, voting

Tech: Sam Ruby on Foo Camp. Foo camp sounds cool; a little bit circle-jerky, but still interesting. But that’s not what I wanted to write about — the thing I wanted to mention was BitTorrent; it just struck me recently — one key thing about BT that makes it great is that it’s designed by the UNIX philosophy — make one tool that does one thing very well, and make it pluggable, so it can be used by other things easily.

It doesn’t have a GUI to search for torrents — the user does that in their web browser, mail, by swapping notes on napkins, whatever. It just does P2P file transfer very very well — and that’s file transfer of some file or another, hence legality issues around P2P are side-stepped. BT is cool.

Patents: Cluetrain on patents:

Well, Google is (jm: going after patents). And the VCs are paying for it. Hell, some of them insist on it. That’s what I gathered last night, while schmoozing at the opening evening at PC Forum. First, Larry Page, Google’s founder and CEO, told me he hates patents and would rather not deal with them as an issue at all. Then Google board member and lead VC John Doerr surprised a small gaggle of patent skeptics (including Page, Dave Winer and myself) that he loved patents. Patents are one of the things that make America great, he said, and went on to insist that they encourage innovation, cure cancer, raise the dead, and bring peace in our time. (Or something like that. Whatever, he likes patents a lot). So don’t expect Google to abandon their hunt for patent lawyers anytime soon.

Listening to John, I began to think one problem is that just caring about patents puts your mind inside the system, where it gets stuck to intellectual flypaper. Or worse, political flypaper.

Tags: bit, camp, file, flypaper, foo, google, patent, patents, sam, tech, thing

Boing Boing links to a paper on the design of the Google Filesystem, Google’s in-house redundant-array-of-inexpensive-PCs cluster filesystem.

It’s very, very nice — and full of interesting tidbits about Google’s architecture.

• ‘the system must efficiently implement well-defined semantics for
  • multiple clients that concurrently append to the same file. Our files are often used as producer- consumer queues or for many-way merging. Hundreds of producers, running one per machine, will concurrently append to a file. Atomicity with minimal synchronization overhead is essential. The file may be read later, or a consumer may be reading through the file simultaneously.’

• ‘The workloads also have many large, sequential writes that append data to files. Typical operation sizes are similar to those for reads. Once written, files are seldom modified again. Small writes at arbitrary positions in a file are supported but do not have to be effcient.’

A perfect example of traditional UNIX system design!

Tags: architecture, boing, cluster, consumer, design, file, filesystem, google, paper, system

So I had to edit a Word doc. Left it for a few minutes, the network connection died, so I tried to save it somewhere else.

Foolishly, I did this by hitting File->Exit, knowing (ha!) that I could save it on the way out. All well and good — until something in Word decided it required the old copy of the doc to save the new one — even though that was in memory, since I could scroll around it etc. (it wasn’t a very long doc).

So it refused to let me save until I restored the network connection. I couldn’t be bothered doing that, so I hit Cancel on that ‘please restore the net connection’ dialog, assuming it’d let me just cut and paste the text, which is all I wanted. Guess what it did? That’s right, it just exited, taking the unsaved doc with it. Argh.

I’ve learned my lesson. Next time, I’ll stick with trusty (and sane) Vim. At least it knows how to do an Edit File UI, even if it’s not quite as pretty (or featureful).

Tags: connection, doc, exit, file, foolishly, left, network, something, way, word

Good techie review of RH9, thanks Padraig. I find this horrifically kludgy, though:

Just a quick observation. The way text editors save files normally, is to create a new file with a temporary random name, and then move/rename the new file to name of the original. Using this technique, if the file being edited has ACLs, the ACLs will be lost. The Vim editor uses libacl to obtain the original ACLs, and then add them back after the save. It is important that other applications that save files in the same fashion are updated to use libacl.

Bad bad bad. Shouldn’t require application code updates like this. I think this is POSIX’ fault. Mind you, according to acl(5), it looks like umask(2) and a concept of parent-directory-affecting-child-nodes’-ACLs seems to apply; so that improves matters a little.

Still, I don’t like the idea of changing something as fundamental as the system calls used to copy and update files in a filesystem, which hasn’t changed in ~15 years on the UNIX platform. I am sure there’ll be nasty side-effects. Maybe that’s why the POSIX 1003.1e ACL standardization effort foundered ;)

Tags: acl, acls, file, kludgy, libacl, name, observation, posix, review, techie

My parents, sister, and her husband Luke, just rang to wish lá féile Padraig shona againn. Thanks guys!

But, as part of the deal, I had to promise to impart some google-juice to my Dad’s website; he’s an architectural photographer in Dublin, Ireland, who also does a nice sideline in stock photography, especially where his holiday snaps are involved. So he’s now on the sidebar ;)

Tags: againn, dad, deal, file, husband, part, photographer, sideline, sister, website

Joel on Software now features a great new article on what he calls “Leaky Abstractions”. Some snippets:

• Even though network libraries like NFS and SMB let you treat files on remote machines “as if” they were local, sometimes the connection becomes very slow or goes down, and the file stops acting like it was local, and as a programmer you have to write code to deal with this. The abstraction of “remote file is the same as local file” leaks. …

(jm: the ‘transparent does not always mean good’ problem)

• Something as simple as iterating over a large two-dimensional array can have radically different performance if you do it horizontally rather than vertically, depending on the “grain of the wood” — one direction may result in vastly more page faults than the other direction, and page faults are slow. Even assembly programmers are supposed to be allowed to pretend that they have a big flat address space, but virtual memory means it’s really just an abstraction, which leaks when there’s a page fault and certain memory fetches take way more many nanoseconds than other memory fetches.

(jm: the ‘why objects are not always the way to do it’ problem)

And finally, he ends with a killer:

Ten years ago, we might have imagined that new programming paradigms would have made programming easier by now. Indeed, the abstractions we’ve created over the years do allow us to deal with new orders of complexity in software development that we didn’t have to deal with ten or fifteen years ago, like GUI programming and network programming. And while these great tools, like modern OO forms-based languages, let us get a lot of work done incredibly quickly, suddenly one day we need to figure out a problem where the abstraction leaked, and it takes 2 weeks. And when you need to hire a programmer to do mostly VB programming, it’s not good enough to hire a VB programmer, because they will get completely stuck in tar every time the VB abstraction leaks.

Well said! Read the article!

Tags: abstraction, direction, file, memory, page, problem, programmer, programming, the, way

ThinkGeek sent me a voucher for 30 bucks. Thanks ThinkGeek (or Sourceforge, I’m not sure which)! So here’s what I got:

Mousetrap For Your Fridge Or File Cabinet!

When is the last time you played with your marbles? Welp, dust off your old marble collection (or use the included marbles) and set them on a journey they’ll never forget.

You design the marble’s treacherous path down the steep slope of your fridge or file cabinet (or any metal surface, as these things are magnetic). You have at your arsenal a combination of chutes, funnels, catapults, spinners and sheer drop offs to arrange according to your mood and tastes.

Give your marble the gift of extreme sports, all in the comfort of your own home or office. Because happy marbles breed happy times…

Too cool. Thanks ThinkGeek/Sourceforge!

(On the other hand, BTW, their chosen shipper for Europe happily charges an extra 6 euros for “import duty”. but hey, the toy was free.)

Tags: cabinet, file, fridge, marble, mousetrap, sourceforge, thinkgeek, time, voucher, welp