sed page 17 - Dave's Blog

Search
My timeline on Mastodon

Schneier on Security: Reverse-Engineering Exploits from Patches

2008 Apr 23, 4:35Something I've had to take into consideration in the past: "Attackers can simply wait for a patch to be released, use these techniques, and with reasonable chance, produce a working exploit within seconds."PermalinkCommentssecurity paper reverse-engineer

Howstuffworks "How Cell-phone Jammers Work"

2008 Apr 22, 4:21FTA: 'In the United States, cell-phone jamming is covered under the Communications Act of 1934, which prohibits people from "willfully or maliciously interfering with the radio communications of any station licensed or authorized" to operate. In fact, thePermalinkCommentslegal cellphone cellphone-jammer

URI Fragment Info Roundup

2008 Apr 21, 11:53

['Neverending story' by Alexandre Duret-Lutz. A framed photo of books with the droste effect applied. Licensed under creative commons.]Information about URI Fragments, the portion of URIs that follow the '#' at the end and that are used to navigate within a document, is scattered throughout various documents which I usually have to hunt down. Instead I'll link to them all here.

Definitions. Fragments are defined in the URI RFC which states that they're used to identify a secondary resource that is related to the primary resource identified by the URI as a subset of the primary, a view of the primary, or some other resource described by the primary. The interpretation of a fragment is based on the mime type of the primary resource. Tim Berners-Lee notes that determining fragment meaning from mime type is a problem because a single URI may contain a single fragment, however over HTTP a single URI can result in the same logical resource represented in different mime types. So there's one fragment but multiple mime types and so multiple interpretations of the one fragment. The URI RFC says that if an author has a single resource available in multiple mime types then the author must ensure that the various representations of a single resource must all resolve fragments to the same logical secondary resource. Depending on which mime types you're dealing with this is either not easy or not possible.

HTTP. In HTTP when URIs are used, the fragment is not included. The General Syntax section of the HTTP standard says it uses the definitions of 'URI-reference' (which includes the fragment), 'absoluteURI', and 'relativeURI' (which don't include the fragment) from the URI RFC. However, the 'URI-reference' term doesn't actually appear in the BNF for the protocol. Accordingly the headers like 'Request-URI', 'Content-Location', 'Location', and 'Referer' which include URIs are defined with 'absoluteURI' or 'relativeURI' and don't include the fragment. This is in keeping with the original fragment definition which says that the fragment is used as a view of the original resource and consequently only needed for resolution on the client. Additionally, the URI RFC explicitly notes that not including the fragment is a privacy feature such that page authors won't be able to stop clients from viewing whatever fragments the client chooses. This seems like an odd claim given that if the author wanted to selectively restrict access to portions of documents there are other options for them like breaking out the parts of a single resource to which the author wishes to restrict access into separate resources.

HTML. In HTML, the HTML mime type RFC defines HTML's fragment use which consists of fragments referring to elements with a corresponding 'id' attribute or one of a particular set of elements with a corresponding 'name' attribute. The HTML spec discusses fragment use additionally noting that the names and ids must be unique in the document and that they must consist of only US-ASCII characters. The ID and NAME attributes are further restricted in section 6 to only consist of alphanumerics, the hyphen, period, colon, and underscore. This is a subset of the characters allowed in the URI fragment so no encoding is discussed since technically its not needed. However, practically speaking, browsers like FireFox and Internet Explorer allow for names and ids containing characters outside of the defined set including characters that must be percent-encoded to appear in a URI fragment. The interpretation of percent-encoded characters in fragments for HTML documents is not consistent across browsers (or in some cases within the same browser) especially for the percent-encoded percent.

Text. Text/plain recently got a fragment definition that allows fragments to refer to particular lines or characters within a text document. The scheme no longer includes regular expressions, which disappointed me at first, but in retrospect is probably good idea for increasing the adoption of this fragment scheme and for avoiding the potential for ubiquitous DoS via regex. One of the authors also notes this on his blog. I look forward to the day when this scheme is widely implemented.

XML. XML has the XPointer framework to define its fragment structure as noted by the XML mime type definition. XPointer consists of a general scheme that contains subschemes that identify a subset of an XML document. Its too bad such a thing wasn't adopted for URI fragments in general to solve the problem of a single resource with multiple mime type representations. I wrote more about XPointer when I worked on hacking XPointer into IE.

SVG and MPEG. Through the Media Fragments Working Group I found a couple more fragment scheme definitions. SVG's fragment scheme is defined in the SVG documentation and looks similar to XML's. MPEG has one defined but I could only find it as an ISO document "Text of ISO/IEC FCD 21000-17 MPEG-12 FID" and not as an RFC which is a little disturbing.

AJAX. AJAX websites have used fragments as an escape hatch for two issues that I've seen. The first is getting a unique URL for versions of a page that are produced on the client by script. The fragment may be changed by script without forcing the page to reload. This goes outside the rules of the standards by using HTML fragments in a fashion not called out by the HTML spec. but it does seem to be inline with the spirit of the fragment in that it is a subview of the original resource and interpretted client side. The other hack-ier use of the fragment in AJAX is for cross domain communication. The basic idea is that different frames or windows may not communicate in normal fashions if they have different domains but they can view each other's URLs and accordingly can change their own fragments in order to send a message out to those who know where to look. IMO this is not inline with the spirit of the fragment but is rather a cool hack.

PermalinkCommentsxml text ajax technical url boring uri fragment rfc

Milliways: Infocom's Unreleased Sequel to Hitchhiker's Guide to the Galaxy - Waxy.org

2008 Apr 18, 12:58"I found myself in possession of the "Infocom Drive" - a complete backup of Infocom's shared network drive from 1989." He posts emails from that backup w/o consulting those involved who show up for luke warm debate in the comments.PermalinkCommentsif interactive-fiction infocom hhgttg history scifi videogame article

RFC 5147 - URI Fragment Identifiers for the text/plain Media Type

2008 Apr 16, 6:42The URI fragment for text/plain is finally a Proposed Standard!PermalinkCommentsuri fragment mime web rfc standards

A List Apart: Articles: Accessible Data Visualization with Web Standards

2008 Apr 9, 8:26"I'm going to cover three basic techniques for incorporating some simple data visualization into standards-based navigation patterns."PermalinkCommentscss web visualization chart html via:swannman

Solving the Enigma - History of the Cryptanalytic Bombe

2008 Apr 9, 2:36History of Enigma in WW2: "One particular German code clerk continually used his girlfriend's name, Cillie, for his messages, and so these easy-to-guess indicators became known as "Cillies.""PermalinkCommentshistory encryption cryptography article security nsa enigma

Zeno's Progress Bar - Stolen Thoughts

2008 Apr 7, 10:09

Text-less progress bar dialog. Licensed under Creative Commons by Ian HamptonMore of my thoughts have been stolen: In my previous job the customer wanted a progress bar displayed while information was copied off of proprietary hardware, during which the software didn't get any indication of progress until the copy was finished. I joked (mostly) that we could display a progress bar that continuously slows down and never quite reaches the end until we know we're done getting info from the hardware. The amount of progress would be a function of time where as time approaches infinity, progress approaches a value of at most 100 percent.

This is similar to Zeno's Paradox which says you can't cross a room because to do so first you must cross half the room, then you must cross half the remaining distance, then half the remaining again, and so on which means you must take an infinite number of steps. There's also an old joke inspired by Zeno's Paradox. The joke is the prototypical engineering vs sciences joke and is moderately humorous, but I think the fact that Wolfram has an interactive applet demonstrating the joke is funnier than the joke itself.

I recently found Lou Franco's blog post "Using Zeno's Paradox For Progress Bars" which covers the same concept as Zeno's Progress Bar but with real code. Apparently Lou wasn't making a joke and actually used this progress bar in an application. A progress bar that doesn't accurately represent progress seems dishonest. In cases like the Vista Defrag where the software can't make a reasonable guess about how long a process will take the software shouldn't display a progress bar.

Similarly a paper by Chris Harrison "Rethinking the Progress Bar" suggests that if a progress bar speeds up towards the end the user will perceive the operation as taking less time. The paper is interesting, but as in the previous case, I'd rather have progress accurately represented even if it means the user doesn't perceive the operation as being as fast.

Update: I should be clearer about Lou's post. He was actually making a practical and implementable suggestion as to how to handle the case of displaying progress when you have some idea of how long it will take but no indications of progress, whereas my suggestion is impractical and more of a joke concerning displaying progress with no indication of progress nor a general idea of how long it will take.

PermalinkCommentszenos paradox technical stolen-thoughts boring progress zeno software math

Search and Archive of Dave's Things

2008 Apr 7, 10:31

Photo of crates in a warehouse. Licensed under creative commons by Don Jones.I now have search and an archive available for my site. I previously tried to setup crappy search by cheating using Yahoo Pipes and now instead I have a slightly less crappy search that works over all of the content that I've produced on my blog, uploaded to flickr or youtube, or added to delicious.

You can now read my first LiveJournal blog post or, for probably much more entertainment value, view all the photos and videos of Cadbury by searching for 'bunny'.

The search is only slightly less lame because although it searches over all my content, I still implemented it myself rather than getting a professional package. Also, the feed supports the same search and archive as my homepage so you can subscribe to a feed of Cadbury if you're so inclined and just skip all this other boring stuff. My homepage and feed implement the OpenSearch response elements and I've got an OpenSearch search provider (source) as well.

PermalinkCommentstechnical search archive opensearch homepage

Gmail integration with Internet Explorer 8

2008 Apr 3, 9:00

Internet Explorer LogoGmail Logo licensed under CC by Victor de la FuenteWith the new features of IE8 there's several easy ways to integrate Gmail, Google's web mail service, for mail composition, searching, and monitoring that I enjoy using.

Composition
I made a Send via Gmail activity that allows you to select some text, a document, or link and via the activity menu open a new tab to compose a new message with the selection. Go to my activity page and click "Send via Gmail" (source) to install it. I found info on the gmail composition URL in the comments of this gmail howto article and used that in the activity. I talked about activities previously.
Search
I've made a search provider that searches your gmail account. See my search provider page and select 'Gmail' (source) to install the Gmail search provider. Search providers aren't new to IE8 but this fits in with Gmail integration in IE. Again in the comments of another howto I found information on a Gmail search URL.
Monitor
New to IE8 is authenticated feed support and favorites bar monitoring which combined with the Gmail inbox feed means you can see when you get new mail in your favorites bar in IE. To do this, navigate to the feed https://mail.google.com/mail/feed/atom, click 'Subscribe to this feed', then click on the Add button in the upper left (the star with plus icon) and select 'Monitor on Favorites Bar' to add this as a monitored item in the favorites bar. Next, right click on the new item in your favorites bar, open the properties dialog, and enter your Gmail username and password into the new username and password fields. Now when you get new mail the Gmail feed item will shine and bold and you'll be able to get to new messages in the dropdown. I described monitored feed items previously.
PermalinkCommentsactivity gmail search howto google ie feed rss opensearch

Set Gmail as Default Mail Client in Ubuntu :: the How-To Geek

2008 Apr 3, 6:48The comments have info on URI template for gmail message composition: "https://mail.google.com/mail?view=cm&tf=0&to=`echo $1 | sed 's/mailto://'`"PermalinkCommentsgmail mail uri howto reference google

Digging in : NTFS Time Stamps --file created in 1601, modified in 1801 and accessed in 2008!!

2008 Mar 31, 1:11Guy messes with various file timestamps on NTFS on Windows.PermalinkCommentstime timestamp ntfs windows blog article

Dinner with Goodwins at Icon Grill

2008 Mar 27, 9:33

The Goodwin family, except for Michelle who is taking a class trip to Washington DC and New York, was in Seattle this week. Sarah and I met up with them for dinner last night at the Icon Grill. I enjoy the Icon Grill in general and last night was no exception especially having dinner with the Goodwins which was a lot of fun. It was particularly cold and at one point snowed. The Goodwin's are seeing all the classic tourist attractions in Seattle some of which are depicted in the following 1962 Seattle's Worlds Fair postcard. The postcard is featured on Paleo-Future and unsurprisingly the 1962 Worlds Fair favored Seattle's Space Needle and monorail.

[Icon Grill front. Licensed under under Creative Commons. By Troy B Thompson][Seattle's Worlds Fair Postcard]

PermalinkCommentsicon grill life washington goodwins sarah seattle nontechnical

Tetris Theme Trademark - Latest Status Info

2008 Mar 24, 11:22Tetris Holding LLC trademarked "an instrumental tune in the style of a Russian folk song in 2/2 time or cut time having at least two 8-bar phrases" used in video games. "Trademark Document Retrieval" links to mp3s of examples from GB Tetris.PermalinkCommentstetris copyright game music korobeiniki russia

ThinkGeek Bluetooth Retro Handset Review

2008 Mar 23, 1:25

I ordered a ThinkGeek Bluetooth Retro Handset to use at home. When I come home I plug my phone in to charge in my room, but then I can't hear it ring elsewhere in the hosue. The idea was to take this handset which wirelessly connects to cellphones via bluetooth and place it in another part of the house so that I can tell I'm getting an incoming call. The only issue I have with that setup is that it ringing isn't any louder than conversations held over the phone, that is, the ringing is a little quiet.

The handset pairs with cellphones in the same manner as any other handset over bluetooth. It has an internal rechargeable battery which is charged via a standard USB port built into the base of the handset and it comes with a USB cable. Next to the USB port is the only button on the phone which is pressed to answer a call, hang up a call, or begin voice dial, held down to turn the handset on and off, and held down longer to begin pairing with a cellphone. There's a blue LED in one of the holes in the microphone portion of the phone which blinks to indicate if its on or trying to pair. Transitioning between on, off, and pairing produces a cute sound and a change to the LED.

Overal I'm pleased with its simplicity and use of common parts although I wish there was a way to adjust the volume of the ring.

PermalinkCommentsthinkgeek bluetooth cellphone phone product handset

Abyss & Apex : Fourth Quarter 2007: Wikihistory

2008 Mar 19, 2:25A short story expressed as a forum for time travelers: "At 18:06:59, BigChill wrote: Take it easy on the kid, SilverFox316; everybody kills Hitler on their first trip. I did. It always gets fixed within a few minutes, what's the harm?"PermalinkCommentshumor fiction wiki timetravel forum via:boingboing

Bad Movie Physics: A Report Card

2008 Mar 14, 2:39FTA: "We rated 18 movies based on how many laws of physics they mangled, and here's our report card."PermalinkCommentsscience physics tv movie fiction scifi humor

HTTP headers and non-asci characters (Content-Disposition, filename, attachment) Article

2008 Mar 8, 11:43"I was not able to find universal settings to do this task, but it looks like Mozilla based browsers accepts utf-8 encoded headers and headers Encoded Word Extensions from RFC 2231. Internet explorer accepts utf-8 filenames only when 1. the data are URL ePermalinkCommentshttp http-header charset ascii utf8 mozilla ie browser content-disposition

The music of Lee Maddeford - Creative Commons

2008 Mar 5, 2:30Creative Commons website talks about Lee Maddeford who released his music under CC Attribution-NonCommercial license. "There's a huge variety of quality music (well over 10 hours of recordings) to enjoy, crossing several genres and many projects led byPermalinkCommentslee-maddeford music cc copyright

Internet Explorer 8 Beta 1 Released with Activities

2008 Mar 5, 11:36

Internet Explorer 8 Beta 1 is available now. I can finally talk about some of the stuff I've been working on for the past year or so: activities. Activities let you select a document, some text on a document, or a link to a document and run that selection through a web service. For example, you could select a word on a webpage and look it up in Wikipedia, select an address and map it on Yahoo Maps, select a webpage and translate it into English with Windows Live Translator, or select a link and add it to Digg.

IE8 comes installed with some activities based on Microsoft web services but there's a page you can go to to install other activities. However, that page is missing some of my favorites that I use all the time, like del.icio.us. Accordingly, I've put together a page of the activities I use. MSDN has all the info on creating Activities.

Activities are very similar to other existing features in other browsers including the ability to add context menu items to IE. There's two important differences which make activities better. Activities have a preview window that pops out when you hover over an activity, which is useful to get in place information easily provided by developers. The other is that the interface is explicit and takes after HTML FORMs and OpenSearch descriptions. Because the interface is explicitly described in XML (unlike the context menu additions described above which run arbitrary script) we have the ability to use activities in places other than on a webpage in the future. And because activity definitions are similar to HTML FORMs, if your webservice has an HTML FORM describing it you can easily create an activity.

PermalinkCommentsmicrosoft technical activity openservice ie8 ie activities msdn
Older EntriesNewer Entries Creative Commons License Some rights reserved.