Orcmid's Lair |
|
Welcome to Orcmid's Lair, the playground for family connections, pastimes, and scholarly vocation -- the collected professional and recreational work of Dennis E. Hamilton
Archives
Atom Feed Associated Blogs Recent Items |
2004-09-03Simple Geek Pleasures
Microsoft Windows Media - Windows Media Player 10. I know there is all of this fuss about competing with Apple's on-line music service. I don't care about that. What I do care about is enjoying MSN Radio Plus over broadband. Except it has been intolerable to use because it operates in a browser window, colliding with my other browsing, including for blogging as well as research and study. Relief at last. Now I can pretty much have it all my way with Media Player 10 right where I want it. What a joy: fingertip audio while I work away with speakers cranked up, basking in the broad-band improvement of my favorite content. A new tune buffers up and I become squirmy/wriggly with this idiot grin and a soaring heart. Have a great weekend. It's back-to-school time. For me, it is time to get cracking on my M.Sc in IT dissertation project, so I guess I had better come up with a topic [;<).
Comments:
Post a Comment
2004-08-31Pictures from Home
FW: The Beauty of Earth. I float around in some very geeky conversation threads. Sometimes, something wonderfully poetic arrives from an unexpected direction to pull at my heart and inspire my soul.
Comments:
Post a Comment
2004-08-30Seeing Double
Well, we are going to be going through a period of double-vision here. You will notice that there are these nice titles on the articles where before there were none (if you happened to look around on the last day or two).
Comments:
Of course, since you changed it, I didn't see double titles until I selected the link for Orcmid's Lair (love the bright red color it changes to!) and scrolled down a bit. So, at first, I was confused. Which is turning out to be a fairly common state of mind these days and I think it's actually a good one.
Post a Comment
2004-08-29Candling Phish
I'm soberly leafing through an Umberto Eco essay when Spanner Wingnut comes panting up the stairway from the lab, dragging his portable with him. I say dragging because it is some kind of souped-up Osborne sewing-machine crate running XPSP2 and trailing an extension cord that would have shorted my grandmother's teakettle. "Well you twit, you've been spammed and phished," I say knowingly. "At least you don't have an account with that bank. How often have I had to tell you, Use Protection!" "No, no, look'cheer" as he elbows me working the trackball, and then ... well, would you look at that? "Dunderhead! You didn't know that? How do you think teen-agers sneak homework answers to their pals using their parents computers? Everybody knows about that," I bark, wondering at how the little newt manages to come up with one after the other of these little cuties. "And pick up that cord neatly. It looks like the rats have been chewing it." As Spanner slouches back to his subterranean warren, I wonder if there is a patent attorney available on a Sunday and where can I announce the remarkable von Clueless phish-detector. First, I need a dated entry in my lab notebook. Oh, and I bet I can get Orcmid to give me space in exchange for Spanner cleaning up his blog messes. That's the ticket ...
Comments:
Very interesting, professor ....
But I have some questions: 1. The first image shows the mouse over the link. Does it also do the link thing on other parts of the message image? 2. And does a user have the opportuniity to compare the actual link to the one in the message? Or is it really a good job with a spoofed link? 3. Do all mail readers display images inline? This is not a rhetorical question. In my experience with Mozilla Thunderbird (which I've set only to display "simple" HTML (whatever the heck that is)), images appear as attachments. So I don't know what this message would look like in my reader. And I don't have an answer to your teaser.
Hi Bill, interesting questions. Here's what I know about them:
Post a Comment
1. The clickable-link cursor (the pointing hand) is the same over the entire image. I was maybe too clever parking the cursor where I did before taking the screen shot. 2. There is a nest of spoofs. First, the image provides a picture of a link. Secondly, if your mail-viewer or browser shows you a link (say, down in the status line of Internet Explorer), it is likely to be the same https link that is in the image. Third, if you actually click on the image, yet-another-URL may be used, one you haven't been shown. This seems to take advantage of a glitch in how image maps work. Fourth, if you do end up going to the hidden phish-hook URL, the page that is ultimately presented will have the address bar and most other window-frame material suppressed, enhancing the deception that the pop-up has something to do with the legitimate page that is brought up by a clever redirection. Finally, all of this depends on the fact that browsers are very loosey-goosey about the HTML they accept, using malformed-but-accepted HTML to carry out their endeavors. There was a time when that may have made sense. It appears that time is now past. 3. The message in my example was a MIME 1.0 with Content-type multipart/related. This is how images, buttons, scripts, and other fragments are bundled together in one payload for your viewing pleasure. You also don't have to be on-line to view the message properly (I wasn't). Here's a simple experiment that you can make: (a) Using Internet Explorer, browse to a page that has images, logos, buttons and other goodies. (b) Use the File | Save As ... dialog to save the file as Web Archive single file (.mht). (c) View the saved file in IE (and your other browsers) while off-line. (d) Then open the file in Notepad or another text editor. Clever, huh? Multipart/related is specified in IETF Proposed Standard RFC 2387. I have materials for creating a complete working (and benign) demonstration of this particular twisty-little-maze of spoofs, but I wanted to quickly point out the simple counter-measure that Edit | Select All provides. - Prof. H.A.S.v.Clueless, etc. Pent up Blogophilia
It has been difficult to withhold myself from blogging while I do some important scaffolding around being able to recover from a variety of misadventures here. It helped that I was in an 8-week on-line course that also demanded my attention. But that was then, and now I don't have to get a typing fix by spewing comments onto Scobleizer so much.
I will stop now before I overwhelm myself. These will show up here or over in Professor von Clueless's place. Oh, yeah. I need to get that blog up and operating before I get too carried away. Later. Heh.
Comments:
Post a Comment
All-Clear #1
This confirms that the testing of incident-response preparations for the Orcmid's Lair blog are completed and the blog is no longer locked down. Although similar notices were placed in the site feed during testing, those manually-injected announcements are obliterated when the automated feed produced by Blogger.com is reinstituted. This message marks closure of testing and other preparations in the "permanent" feed. As part of the institution of consistent incident-response procedures for Orcmid's Lair and related blogs, the URL for the Orcmid's Lair blog has been simplified to <http://orcmid.com/blog/>. That's all you need. It will be faster to use this than be redirected from the previous URL, so please update any shortcuts you have to this blog.
Comments:
Post a Comment
2004-06-29Microsoft Scores for Respecting Its Customers
Microsoft Scores for Respecting Its CustomersComputerworld: Microsoft scores highest in customer-respect study. Linda Rosencrance's 2004-06-25 article describes a study by The Customer Respect Group. The study examines web sites for how they support successful customer experiences. Microsoft was found to lead the top 100 from that perspective.Although I have had unsuccessful experiences with the sites, especially when dealing with a security-related concern, I must confess that the experience is still better than any I have found on other sites. Today, there is announcement of a major transparency move (for Microsoft), putting its bug reports and feedback on line, so that there is visibility on the incidents that have been reported, the actions being taken, and any resolution. I would say that will raise the score considerably, at least in the developer community. You can't imagine (or maybe you can) all of the conversations that go on inside of a business about the importance of not doing that. It always feels risky, and I suspect that the lawyers are the most nervous about it. So that is a very good move in terms of willing to deal with any feeling of vulnerability out of respect for the customer and also out of recognition of what value that is to ones own business operations and customer relationships.
Comments:
Post a Comment
2004-06-27Difficulties of Wireless Mesh
Difficulties of Wireless MeshACM News Service: The Realities of Dealing with Wireless Mesh Networks.. The idea of wireless mesh networks appeals to me because of the possible utility for peer-to-peer bootstrapping and discovery. I am not so interested in the problems of wireless access that the techniques are designed to overcome, since I am happy to apply the same ideas to wired edge nodes, even wireless access points, that can form a mesh without heavy centralized support.This is a 3-by-5 card placeholder for me to return and dig deeper, supplementing what I discovered earlier about this case. The concern that this blurb raises for me is the item on the end that says coming out of sleep mode (that is, being detached or shut down for some period) "in a mesh network requires nodes to resynchronize with the network upon reactivation, a power- and time-consumptive process that involves considerable over-the-air network traffic." I don't like the sound of that and I need to check out the full article, in the June 2004 issue of Sensor online.
Comments:
Post a Comment
What Is RFID Technology?
What Is RFID Technology?Now that I have stuck my neck out on how passive RFIDs are, and how the work of correlating the presence information is done elsewhere, I thought I should get something closer to the real facts.The site RFID Talk: Discussion of RFID technology provides a discussion portal for matters RFIDian. There is an RFID Technology forum on the site. Many of the topics are about specific products. It is interesting that RFIDs are described as transponders. I am looking into some of the specific discussions. It appears that the typical RFID returns something like an EPC, an Electronic Product Code prefered by Walmart and the US DoD. The passive tags are cheaper, can be polled indefinitely, and are the ones likely to be ubiquitous in the near future. These, like the Hitachi u-chip, have small (e.g., 128 bit) ROMs and are not alterable after manufacture. They are physically miniscule and the power for their response is derived from the scanner's UHF signal. There are also active tags. The ones being used to monitor truck tires, with 8-kilobit memories and environmental sensors, can report temperature and pressure histories for the tires they are affixed to. Zebra Technologies offers RFID Printing Solutions. An RFID embedded in a product label is programmed with its identifier, such as an EPC, simultaneous with the printing of visible identification (even bar codes) on the label itself. The distinction between the soon-to-be-ubiquitous passive tags and active tags is explained in another Zebra Fact Page: "Information is sent to and read from RFID tags by a reader using radio waves. In passive systems, which are the most common, a Radio Frequency Identification reader transmits an energy field that 'wakes up' the tag and provides the power for the tag to operate. In active systems, a battery in the tag is used to boost the effective operating range of the tag and to offer additional features over passive tags, such as temperature sensing."In all near-term cases, the information carried by the tag is limited, whether or not alterable. Some connection to a datasystem is required to correlate the current scanning, and collateral information (e.g., a cash-register feed for purchases) to any kind of global record. The requirements for the data-communication and database end are considered to be immense.
Comments:
Post a Comment
Hark, Is That an Arphid That I Smell?
Hark, Is That an Arphid That I Smell?RG News: The Smell Of RFID Tags. I notice that there is an assumption, in the scarier accounts, that RFID tags can be updated to carry complex information. For example, it is speculated that purchasing history can be carried by an RFID built into a credit card. My sense of the current technology is that the association is done behind the scenes and accomplished in massive data aggregation activities, not on the RFID (or the credit card). The impact might be the same, but the methodology is quite different. What I see here is a seriously overblown assumption about what the technology is capable of, in any reasonably-near future, and this over-generalization discredits accounts such as this summary on Robin Good's Latest News. It is likely to be regarded by legislators and decision makers as idiot radicalism.I think the problem around this technology being intrusive is that it is near-invisible. While this article emphasizes this action: Consumers must insist that RFID tags be easily visible, removable and turned off at checkout.this injunction becomes meaningless if consumers are not equipped to verify it. I do have a few modest suggestions that might be more effective as social action. Whittier Daily News - Opinion. Robin Good's source is Lenore Skenazy's 2004-06-25 Whittier Daily News.com opinion piece. The article addresses RFID as a universal surveillance system. Here the description of an RFID as a "bar code on steroids" is more apt, although the leap into outrageous extrapolations almost qualifies this article as an urban e-mail hoax. Again, the example of what the RFID reports is exaggerated. The RFID just reports what it always reports, it doesn't carry the history of its voyage from manufacturer to a garmet you are wearing. It is in the uniqueness of that identification, and its availability, that provides the basis of surveillance. That is all it needs. In the cinema, when someone places a tracking beacon on a vehicle, the beacon doesn't do the work, the trackers do. This might be a better way to view the situation. Now, that does not alter the fact that a fine basis for surveillance is available, and that this is commercially valuable and potentially just as important to everyone's Department of Homeland Security and everyone who might be spying on them. So the scary scenarios don't work as described. The RFID needs to be scanned repeatedly at different places, and the scanning point needs to send its information somewhere that it can be aggregated with other information from other scannings of that same RFID. This is not a trivial act, and yes, people are working on it. It is more like my supermarket membership card. All it has to do is identify itself. The rest is handled by passing that identification, and my coincident purchasing information to a database system. The easy part for the supermarket is they issued the card. They are not just trying to scan anybody's any-kind-of-card, and connecting it to a data-collection and reporting system somewhere. With RFIDs, the problem is more complicated. What is more important is that the RFID is a kind of passive technology. It responds to scans from any suitable scanner. So, instead of worrying about who is scanning RFIDs in your possession, why not look at the opportunity we have in being able to scan the RFIDs in our environment? Questions to self: Is there any selectivity in the scanning and response? (Obviously, for intentional surveillance, different kinds of RFIDs and readers might be developed and used; but what about the current case). When the vet scans our cats and notices that they have been "chipped," what other objects respond to those same scanners? What other scanners would notice our cats, perhaps from a greater distance. How many flavors of this technology are there? If these are really equivalent to a homogenous system of very-long bar codes, I here point out that bar code scanners are now affordable enough to be consumer devices. For the kind of tracking that people speculate about, that means scanners will be at least that affordable. Probably more affordable than the video-recorder at the Rodney King beating. Heh.
Comments:
Post a Comment
Lady Bugs for RFIDs?
Lady Bugs for RFIDs?I'm chatting with Vicki over breakfast and I mention that I am gathering information on RFIDs (pronounced arphids). "I guess you're not talking about little green bugs that infest the rose bushes?" she responds.I'm dumbstruck. Of course, what we need are lady bugs for RFIDs. What a great symbol. Little lady-bug lapel pins that eat arphids. This could be the greatest thing since the pet rock and lead-lined underware. I am thinking that we need a tasteful nano-lady-bug design with nice fluorescent sparkles when it is being scanned. It could even have, you know, an RFID jammer or virus build into it. Or, we could say it does. The stick-pin is the antenna. [Or it is an arphid and scanner spotter, an even more promising option for the executive model -- see the updates below.] Stepping back into the aluminum-foil headgear department, I was wondering how RFIDs are discriminated. If they are all over the place, how does a sensor discriminate the responses? I need to see how they probe and deal with response collisions, but it makes me wonder if RFID congestion is a problem. That has me thinking about RFID safety garments. We could collect RFIDs, and keep them like butterfly collections, stitching them into our underwear or creating something like RFID merit-badge scarves (and headgear). People can proudly wear their collections and claim records of various kinds. You know, confirmed RFIDs from Indonesian child-labor sweatshops found in your last pair of running shoes. When you have a healthy pelt of these things, wear it shopping. At, say, Wal-Mart. It could happen. [added 2004-06-27-20:20Z]: Arphid Accessorizing! Wait, there's more. How about affinity arphids, little lady-bug pins that have designs that express community identity: "John Q. Public," "Jane Q. Public," "Silent Majority," "I Gave at the Office," "Swing Vote," "Republicrat," "Demican," "Apathetic," "Bipartisan," "Independent Voter," "Librarian," "Homeless Neoconservative," and that great geek cloak, "Anonymous Coward." And every arphid for a single affinity has the same identity. Be the first in your neighborhood to collect and wear the entire set. Have meet-ups where what you have in common is the same arphid identification. You Are Legion. Heh. This could be the greatest thing since cabbage-patch kids. I wonder who knows how to make these things . ... Do you think that, if I pull this off, I can be in the next Michael Moore movie? [added 2004-06-27-20:47Z]: Then there's "The Borg," "Jane Doe," "Kinky,"and "Cruisin'" when you're on the prowl. Teens will love arphid scanners built into their video-cellphones. Ear-jewelry can be incorporated into whatever that 3-holes in the left, 1-in the right ear is intended to signify. Kids, make your folks crazy at a whole new level. Think of it, treasure hunts for hidden arphids. Arphid Lotto! Not to mention that if business firms let their product-tracking arphids into the wild, they may find that their operations are just a wee bit more transparent than intended. After all, it is just gigantic data aggregation, a great exercise of peer-to-peer computational grids. We have the technology. "Big Brother, we are watching you." You gotta love it. Open-source arphid-defeating lady-bug grids. OK, I'm done. The comment section is open. Keep it anonymous. This is a watchbird watching Google. This is a watchbird watching you.
Comments:
Well, I don't want to update the article and have it cause duplicate syndication-file retrievals, so I'll be the first to comment (anonymously).
Post a Comment
A hot item should be a small passive radio receiver that thumps you or glows or anything else cute whenever you are within the range of a scanner. Think of it as the next generation radar detector. As a powered receiver, it should be able to detect scanning before you are in a range that would wake up any arphids among your personal possessions. The only problem is that, since you're not likely to set this thing off, even in Walmart (because the scanner ranges used are quite short for now), you'll need a way to test it and amaze your friends. Hence needing a "pinger" built into the thing. Get the set and let your kids play hide-and-seak with it. Sonar sound effects optional at extra cost. Batteries not included. Offer void where prohibited by law. 2004-06-25RFID for Commerce is Surveillance?
RFID for CommerceWe're discussing RFIDs in my Security Engineering class and I am clipping some resources about it.ACM News Service: Embedding Their Hopes in RFID. The economic realities of RFID employment, along with the privacy concerns, are featured in this blurb. The Seattle Public Library seems to be using RFIDs in their automated check-out systems (similar to the automated check-out systems in some stores, except you just lay the library books down on an opaque surface). Although there is a lot of attention on item-level tracking, most commercial use of RFID is for container, not item, tracking. The little RFIDs are still too expensive to put on everything, and reader/scanner range is limited. Those are all parameters that can only improve, though. Jonathan Krim's 2004-06-23 Washington Post article (registration required) seems scarier to me. His first example is on gaming chips in a gambling casino. Prescription drugs are another example. This main article is extensive, and there are some accompanying links. At home, our cats are tagged (the expression is "chipped"), and your dentist will chip your kids. In the article, there is an application to permit the subcutaneous tagging of people, initially as a kind of Med-Alert system. It is clear what the benefits of these applications are, and it is not for surveillance as much as for identification and a kind of protection. With RFIDs, one could plant chips on someone, and I think that is also how we are looking at the prospects for surveillance that the commercial use of RFIDs provides, in terms of the movement of products being tracked as we use them. Future Now: Couple RFID-related articles. This short blurb links to two articles: One in Technology Review that requires a subscription (or a minimum $4.95 US and then you have to cancel it to keep it from going month-to-month). The other is from Economist.com and is free for now. Impact of RFID and other monitoring has four entries that I gleaned on 2004-02-24. No Hiding Place. A January, 2003, Economist article, involving science-fiction writer David Brin, on living transparently in the internet society. I searched through this blog archive and I didn't find any other occurrences of RFID. I suspect that a search on "privacy" might be more successful.
Comments:
Post a Comment
Computer Pioneer Bob Bemer
Computer Pioneer Bob BemerI just learned of the death of Bob Bemer. I think he'd be pleased to know that he was slash-dotted. It is also odd the things people are remembered for, although Bob was tickled to make sure the ESC code was in ASCII, and other things. Only one person who knew Bob seems to have chimed up, and I added my footnote. I need to say it again in this quieter place.I worked in one of Bob's teams while he was Director of Software at Sperry Univac in the 60's. He was a lot of fun. He kept calling me "Bub." I ran into him at standards meetings a few times after he moved on to GE and Honeywell, but we did not stay in touch. I re-encountered him later on the web, just prior to Y2K ,as the result of an article reporting that he was suggesting a Y2K repair that would not require people to remap existing file records. He wanted to pack the numbers tighter and intercept date accesses in running programs, buying some time. I exchanged e-mail with him a few times in the last few years, and I had a chance to acknowledge the inspiration he was for me while he was still around. I don't know that he would hang out on slash-dot. When I last exchanged e-mail with him he was frustrated about what it took to maintain his web site. I guess he was a geek at heart. I had produced a fast decimal-to-binary assembly-language algorithm for a character-oriented machine that didn't have a built-in converter but addressed in binary and calculated in decimal (making subscripting hard). He was the only one of his entire organization that worked it over and took more cycles out of it, and then I took out more using his ideas. He thanked me for giving him a chance to play. Beside paying attention to those little details that can mean a lot, like character sets and extension techniques, he also worried about improving programming languages, training software developers, establishing software forensics, and making software engineering an activity that exploited reusable piece parts, anticipating components by a good 30 years. He funded Peter Landin and Bill Burge's work on Functional Programming in the US because he saw the possibility of applicative languages as the ultimate in piece-part composers. Bob's web site is loaded with reminiscences. Some of Bob's recollections are a little off. When I arrived at 315 Park Avenue South, Al Paster was already there, working for C.L. McCarthy. Bemer hadn't shown up yet. I don't remember what the lag was. I know Bob was there in 1962, because I remember him talking to my wife, Bobbi, at an employee party that he initiated to have all of us become better known to each other. But who was already there in 1961 when I moved from Seattle to Manhattan was Bill Lonergan, one of the architects of the Burroughs 5000. Univac was definitely looking to make a move. (It was Lonergan's connections that led to my getting to work with Don Knuth in the summer of 1962. Along with building a Fortran compiler for us, Don said he had some ideas for a definitive book about programming.) One thing I liked about Bob was he thought he hired me and he liked to tell people that. I was there ahead of him, but as far as he was concerned, I was his find. Another fascinating thing is that he recreated his years at Univac by going over his expense reports for the time. Dang, I wish I had thought to keep mine over all this time. What a clever way to associate and recall events. With regard to managing people, Bob didn't believe in burning out developers and he thought there was a lot of life to be had outside of the office. I'm pleased to learn that he was active to the end. I'll never forget him. The key to immortality is living a life worth remembering.
Comments:
Bob in Phoenix. I forgot that I also visited with Bob while in Phoenix for some sort of standards-related shindig. He was at GE/HIS at the time, and he invited some of us out to see his home on its little hilltop. I loved the view and the design of his home, but my greatest lust was for his bound volumes of Communications of the ACM. Bob was a solid ACM booster and had been the Standards Editor for a time. Every so often something would show up from him, including a Pracnique back when they featured those.
Post a Comment
I couldn't stand the space (nor the expense) of bound volumes, so I did the next best thing and acquired Comm.ACM, J.ACM, and Computing Reviews on microfiche, along with a lot of IEEE and Stanford reports that were available in fiche format. Fortunately, a good chunk of that material is now on-line for ACM Digital Library subscribers, so I'm covered where my fiche subscriptions dropped off around 1986. I no longer have a viewer and I thought that my hot-stuff HP Scanjet would provide an alternative. No such luck. The scanner's quantization is too course for good viewing of microfiche images. I figure there must be image processing that will do a good job of resampling the scans to good monochrome images, but I haven't found anything obvious. So much for reading an article in one display window while making research notes in another. I bet Bob would have known who to talk to, if I'd thought to mention my problem to him. Sounds like something to cover in nfoWare as an image-processing component demonstration. I'll have to find something to name "bemer," in Bob's honor and in a way that it isn't confused with German automobiles. Maybe I'll call it "Bub." |
You are navigating Orcmid's Lair. |
created 2002-10-28-07:25 -0800 (pst)
by orcmid |