Anton Cohen

DoJ proves SOPA and PIPA not needed, seizes Megaupload

2012-01-19T23:37:00.001-08:00

Yesterday I wrote "If SOPA or PIPA passes Megaupload would be kicked off the internet." Today the United States Department of Justice kicked Megaupload off the internet [DoJ][WSJ][TF]. Yes that's right, without SOPA or PIPA the US government was able to shutdown a foreign "rogue" site. How foreign? Datacenters in the US, Canada, and the Netherlands were raided. Charges were brought against 7 people who are citizens of Germany, the Netherlands, Slovakia, Estonia, Turkey, Hong Kong, and New Zealand -- none of them US citizens. Four of them were arrested in New Zealand.

How did this happen without without SOPA or PIPA? The same way all federal cases happen, a grand jury issued an indictment. In 2010, over the Thanksgiving weekend the US Immigration and Customs Enforcement seized 82 domains, and a year later admitted some were a mistake. And Thanksgiving weekend of 2011 they seized 150 domains.

So the DoJ has done a great job in proving that SOPA and PIPA are not needed. Not only can they seizes domains, property, and arrest those involved with foreign "rogue" sites, they can do it all without due process. Killing a business and then having a trial (or not even having a trial in the case of Dajaz1) is like executing a suspect and then holding a trial to convict them. Even if Megaupload is found not guilty, they will likely never recover from having $50 million in assets seized, the company has been killed but not convicted.

This kind of skirt around due process makes sense in some cases. If you suspect someone is a terrorist and has a bomb in their backpack it makes sense to arrest them and blow up their backpack, then hold a trial. Hundreds of lives are at risk if a bomb goes off, destroying a $30 backpack does little harm, it's fair.

The DoJ have been so brainwashed by the RIAA and MPAA that they think pirated entertainment is as dangerous as terrorism. In 2010 Universal Music Group made $5.7672 billion in revenue. Maybe Megaupload cost them $100,000 in revenue, so without Megaupload UMG would have made $5.7673 billion. No one is dying because of Megaupload. Of course the DoJ doesn't say it cost them $100 thousand, they say Megaupload cost the industry over $500 million. They use funny math for that, like when Arista Records requested damages of $150,000 per infringing file. Or that every download of a movie costs the industry the $45 retail price of a Blu-ray disc. Realistically the amount that piracy actually costs the entertainment industry is tiny, and probably less than the amount they spend on the MPAA and RIAA.

Seriously, SOPA and PIPA are not needed. Laws and legal processes already exist to protect intellectual property. What we really need is a law to protect due process, like the Due Process Guarantee Act that Dianne Feinstein introduced. That act protects due process for terrorist suspects. Yet Dianne Feinstein is sponsoring PIPA. Apparently she thinks terrorist deserve more rights than web site owners. Guess who I'm not voting for next Senate election.

SOPA, PIPA, and Due Process

2012-01-18T15:39:00.000-08:00

By now hopefully everyone in the US has heard about SOPA and PIPA. But why are these laws bad? Isn't it good to eliminate rogue sites dealing in illegal goods? Of course it is, but that's why we have courts and due process.

Procedural Due Process protects individual against laws by allowing them a fair opportunity to affect the result of a judgement, in other words people have the right to their day in court. The DMCA eliminated due process by allowing content owners to have content removed from sites without going to court. The copyright holder issues a DMCA Takedown notice and the websites are obliged to remove the content.

That may seem fair, except the media companies (i.e., the backers of SOPA and PIPA) have been abusing the DMCA to take down content the do not own, for example YouTube videos they disagree with. SOPA and PIPA extend this ability to remove content by allowing the copyright owners to remove entire sites from the internet.

The backers of SOPA and PIPA will tell you they only target foreign rogue sites. But who is to say what is rogue? DailyMotion is foreign (French), and they probably have rogue content uploaded by users. Should the whole of DailyMotion, a French site, be eliminated from the internet because a US media company doesn't like them? No. Megaupload is foreign (Hong Kong), US media companies clearly think Megaupload is rogue, even if they are a legitimate business that responds to DMCA Takedown notices. If SOPA or PIPA passes Megaupload would be kicked off the internet. That's censorship. We already have copyright laws and courts to enforce them, we don't need to eliminate due process.

So what if media company wrongly kicks DailyMotion or YouTube off the internet, DailyMotion or YouTube could sue the media company or service providers that helped them, right? I mean we're talking about millions or billions in revenue. Nope. The laws are written so the media companies and service providers cannot be held liable.

The Khan Academy has an excellent video explaining SOPA and PIPA, I highly recommend watching it:
What SOPA and PIPA are at face value and what they could end up enabling

If you don't believe me that media companies abuse the DMCA, read these news articles:
Viacom uploads videos from Kinko's, then sues YouTube over them

Universal Music removes Megaupload Song from YouTube, claiming they own the copyright, even though they don't

Warner Brothers issues takedown notices to Hotfile for content they don't own

Contact Congress to voice your opposition.

Linux Mint 12 with MATE

2011-12-19T23:20:00.000-08:00

MATÉ

If you are a fan of GNOME 2 you probably think GNOME 3 is unusable garbage. Linus does. Well MATE is here to save the day. MATE is a fork of GNOME 2 that can be installed on the same system as GNOME 3. Linux Mint 12 comes with MATE and GNOME 3 + MGSE.

MGSE (Mint Gnome Shell Extensions) are a set of extensions that make GNOME 3 less sucky, important things like an applications menu, a task bar, and task switching (Alt+Tab) that actually switches tasks not applications.

Even with MGSE I found GNOME 3 unbearable. There's no application launcher (Quick Launch) on the panel. You can add an extension which will put "favorites" on panel, but you can't customize or rearrange the favorites list. There are annoying "hot corners". If you are in a full screen video and you move the cursor to the bottom-right to click the button to exit full screen, an annoying notifications overlay pops up, blocking the button you are trying to click. If you accidentally move the cursor to the top-left you're in for a treat! An activities overlay will cover your whole screen, what fun! You'll probably try to desperately click in empty areas, the desktop, or menu bars trying to get rid of it, but the overlay won't leave unless you hit Esc.

MATE saves the day. Mint with MATE is awesome. It's slick looking, fast, and productive.

One issue I had with MATE was that the fonts were HUGE. For some reason the MATE font DPI was set to something like 370dpi. To fix that go to the Mint [Start] Menu -> System -> Preferences -> Appearance, select the Fonts tab, click Details in the bottom-right, change the dots per inch to something sane like 96.

Real transparency in gnome-terminal
If you have tried to use a transparent background in Terminal under GNOME 2 you have probably noticed it's not really transparent, all you can see behind it is the desktop background. In GNOME 3 the terminal can be truly transparent, like the Mac OS X Terminal. With GNOME 3 being unusable, I'm using MATE, which defaults to the old fake transparency (technically it's mate-terminal in MATE).

But you can fix it! Go to the Mint [Start] Menu -> System -> Peferences -> Desktop Settings. Select Windows. Check 'Use Gnome compositing' -- boom, real transparency. Apparently window compositing has existed since 2008 with the release of GNOME 2.22, I just never noticed it before.

Volume level
For some reason the system would not remember the sound volume level I set, instead resetting it to 100% after every reboot. That was especially annoying in GNOME 3 because it blasted some login sound, at least MATE doesn't play annoying sounds by default.

I decided to set the sound lower on every log-in, here's how:

Find the PulseAudio sink index number associated with your sound card.

Run 'pactl list short sinks'.
The index number in first column, it's probably 0.

Test it with pactl, e.g., 'pactl set-sink-volume 0 25%'.
Go to Mint Menu -> System -> Preferences -> Startup Applications.
Click Add, give the new startup program a name like "Lower Volume"
In Command enter 'pactl set-sink-volume 0 25%', or whatever index and volume you want.
Click Add and Close.

mint4win

min4win.exe is a Windows installer for Linux Mint, basically the same as wubi.exe for Ubuntu. It comes on the Linux Mint 12 CD, but not on the DVD. I thought these installers were useless, I thought they were just a splash screen the told you to restart you computer with the CD in the drive. Boy was I wrong!

The Windows installer is amazing. It actually installs Linux from within Windows, it even adds Linux to Add or Remove Programs so it can be uninstalled in a familiar way. The best part is that it doesn't re-partition your hard drive or replace the boot loader.

The installer works by creating a large file on your hard drive (C:\linuxmint\disks\root.disk), the file is loop mounted as the root file system. A smaller swap file is also created and loop mounted. The installer modifies boot.ini to add C:\wubildr.mbr = "Linux Mint" which loads GRUB, and GRUB boots Linux with the loop devices. When you turn on the computer the Windows boot loader will give you a choice of Windows or Linux.

Your C:\ drive is mounted as /host, with full read-write access. So the Linux root file system can be small, and you can continue to store large files in your Windows My Documents folder.

I installed Linux Mint 12 on a desktop and Linux Mint 10 LXDE on a netbook using mint4win.exe. The Mint 12 installer is super easy, all the defaults are sane. The Mint 10 LXDE installer is a little quirky. The first part of the install from within Windows is good, there aren't really any options other than hard disk size. Once the Windows install completes you reboot and choose Linux Mint at the prompt. This is where things get odd. It boots Linux, but it's not really the installed Linux you would expect, instead it is basically a LiveCD with an installer. You then have to install Linux Mint for real by clicking the icon the the desktop. But don't accept the defaults!

By default the LiveCD installer wants to install the boot loader (GRUB) in the MBR of /dev/sda. You don't want to do that, it will overwrite the Windows boot loader. Instead tell it to install the boot loader on /dev/loop0, which is your Linux root disk. That way the Windows boot loader is unmolested and you can uninstall Linux Mint if you want to.

Linux Mint 12 is great. Every geek running Windows should go install it right now, with mint4win you have nothing to lose. It can do everything Windows can do, except stream Netflix. And it's so much nicer to use.

Don't be cheap, be frugal

2011-11-30T21:32:00.001-08:00

Number 8 in Paul Graham's essay Startups in 13 Sentences is "Spend Little. I can't emphasize enough how important it is for a startup to be cheap." It's a good essay, and even more interesting to watch as he writes and corrects it. But he is wrong on about #8. Cheapness is always bad, frugality is good. It may seem like minor semantics, but from someone as influential as Paul Graham it makes a difference.

To be cheap is to be stingy or miserly [1]. A cheap person is unwilling to spend money to their own detriment [2]. They are incapable of making smart financial decision because of an irrational fear of spending money. Being cheap is being penny-wise, pound-foolish. It's short-term profit leading to long-term losses. Cheapness is what destroyed the American automotive industry.

Frugality is "prudent or economical in the use of consumable resources such as food, time or money, and avoiding waste, lavishness or extravagance. In behavioral science, frugality has been defined as the tendency to acquire goods and services in a restrained manner, and resourceful use of already owned economic goods and services, to achieve a longer term goal." [3]

Numbers 5 and 6, "Better to make a few users love you than a lot ambivalent" and "Offer surprisingly good customer service," are not possible for a cheap person, those things cost time and money. A frugal person will understand that the extra money is required to achieve the long-term goal.

As an example let us consider what it takes to host a startup's web service. A cheap person will insist that the site can be hosted on GoDaddy for $6/month. Any rational person knows that's not possible, the site will go down with the first PR push. A person capable of making rational financial decisions will know that the company cannot survive on shared hosting, so they will suggest spending $60/month on load-balanced cloud servers or VPSs. That's 10x more money, no way a cheap person is going to spend that. Sure it's a trivial amount of money that could saved by not going to Starbucks everyday, but that kind of rational thought doesn't occur in cheap people. A frugal person will take the rational thought a step further to realize the engineering cost of operating their own cloud servers isn't worth it at a small scale. The fugal person will suggest spending $120/month on Heroku so they can better use their engineering resources on their core business. That kind of intelligent spending is incomprehensible to a cheap person, even though they could save that much money by bringing lunch from home and not buying $10 salads every day.

The issue compounds itself over time. Eventually the cheap person will cave to reality and peer pressure. But they are not accustomed to making wise financial decisions, so they overreact. To replace the failing GoDaddy hosting they might buy physical servers, maybe even rent space in a data center. Once the shock of spending that money hits them the fear will kick-in. They will then be too cheap to pay for the Operations staff required to manage the physical servers in the data center. The new servers will fail and the cycle of being cheap followed by wasting money will continue.

Cheapness is akin to a metal disorder symptom like hoarding. If you have someone who demonstrates an ingrained cheapness, they need to be removed from the process of making financial decisions. If you are a normal, rational person trying to achieve Ramen Profitability, don't strive to be cheap, be frugal instead.

[1] http://www.thefreedictionary.com/cheap
[2] http://en.wikipedia.org/wiki/Miser
[3] http://en.wikipedia.org/wiki/Fruga lity

Pictures and video of South Beach, Fleet Week, and motorcycles.

2011-10-20T02:20:00.000-07:00

Here a bunch of pictures I took around South Beach Harbor, AT&T Park, Fleet Week, and some videos of awesome motorcycle riding at Pier 30/32.

South Beach Harbor is located near AT&T Park. The pier behind the ballpark has lovely views of San Francisco and the Bay Bridge. Day, night, and sunrise.

On the backside of AT&T Park there is a free viewing area, open during Giants games. It has great field level views. No seats or food stands in there, but it's fun to watch a couple innings. Check it out next time you're in the area during a Giants game.

Fleet Week is a great week in San Francisco. The Blue Angels are awesome, and there are cool ships to tour. I tried to watch the Blue Angels on Sunday this year, sadly they cancelled their show early due to fog. This is about all I saw.

The USS Bonhomme Richard (LHD-6) is usually at Pier 30/32 during Fleet Week. LHD-6 is an Amphibious Assault Ship ship. It's main mission is to carry over 1,000 Marines, along with amphibious vehicles, hover craft, and helicopters. This is a great ship to tour, you get to talk to Marines, go inside helicopters and armored vehicles, and hold big guns.

Sikorsky CH-53E Super Stallion. This thing is huge, it make the tandem rotor CH-46 Sea Knight look small:

Milkor MGL grenade launcher:

Benelli M1014 combat shotgun, 6+1 semi-auto:

M39 Enhanced Marksman Rifle, this is the new Designated Marksman Rifle for the Marine Corps, semi-auto 7.62mm NATO:

Ahh, the next generation of recruits:

The weekend after Fleet Week some motorcycles showed up at Pier 30/32 and put on a great show, until the police showed up.

Airsoft and laser tag at Escape Sonoma County

2011-10-19T19:51:00.000-07:00

Airsoft

This past weekend I went to Escape in Rohnert Park to play airsoft. For those that don't know, airsoft is played like paintball, but the guns shoot plastic BBs instead of paint. The guns are generally realistic replicas of military firearms, as opposed to the funky looking paintball guns. A lot of the guns are such accurate replicas that accessories designed for the real guns fit the airsoft guns.

At Escape airsoft is only played on Sundays, and they use the same arena as QZAR laser tag. The arena is a close quarters battle (CQB) field, it consists of a bunch of little rooms with windows and doors, and random barrels everywhere (just like in video games!). In first-person shooter (FPS) terms the gametype in Team Deathmatch (TDM) without respawn. The rounds end up being pretty short, probably because the area is quite small (5000 sq ft). Overall it's a lot of fun, the people are friendly, and it's well worth the money.

If you bring your own equipment you can play pretty much constantly, if you are renting equipment you have to take turns sharing the equipment. It's much cheaper to play self-equipped, so if you like airsoft it is worth buying your own stuff. They impose a 350 feet-per-second max with 20g BBs.

There is a new airsoft and paintball arena opening in Santa Rosa called Playland. It's not open yet, but it is going to be huge, probably the largest indoor airsoft arena in the western US.

Laser Tag

Last month I played QZAR laser tag at Escape. The laser tag was really fun, and faster paced than airsoft. But the gameplay and scoring are, well, stupid. The gametype is a lot like Capture The Flag (CTF), there is an objective in each base that the opponents are supposed to shoot. But the scoring is more like TDM. You "respawn" about 10 seconds after dying. For the those 10 seconds you can't shoot, but for part of that time you can be shot... yeah.

The scoring goes like this, you get one (1) point for shooting someone, you lose one (1) point for being shot, you get ten (10) points for shooting the objective. The team score is the sum of the player scores. The reason I say the scoring is stupid is because 10 points isn't enough. In most objective gametypes the team wins or loses based on the objective, e.g., one point every time your team captures the flag, kills don't count for team points. As a player you attack or defend the objective at all costs to yourself. At only 10 points the objective is worthless, you will die 10 times in your attempt you get the objective. This is compounded by the fact that you are double penalized (you lose a point AND the other team gets a point), and that period of respawn where you can be shot but can't defend yourself guarantees you will die a lot.

What ends up happening is that the players that would normally score the highest, the ones that aggressively attack the enemy base, actually end up scoring the lowest because the die the most, and the objective can't make up for that. Ultimately if you want to score high you camp on defense. But that's not fun. It works in airsoft because airsoft takes more skill and tactics. You can't even accurately aim the laser tag guns because they don't have sights.

It's a lot of fun to play, but for a competitive person the scoring kind of spoils it. So fix the friggin' scoring, it's either CTF or TDM, not both, and remove the double penalty for dying.

What the... Cherry.com washed my car for free!

2011-10-03T00:38:00.000-07:00

A few days ago I was walking down the street and I saw two guys with bright red shirts, they looked kind of like Facebook employee shirts, except they said Cherry on them. And they were putting business cards on cars, including my car. I took the card off my car, it said:

"The Carwash that comes to you
Park anywhere, check in online and we'll wash you car right where you left it, in real time.
Get your free carwash at cherry.com"

What a brilliant idea! I live in an area of San Francisco without driveways and hose hookups. Getting a car wash means I have to drive somewhere, and lose my valuable parking space. The business card has been sitting on my desk for a few days, and tonight I decided to sign up. Registration was easy and they have a good website (once you login). I browsed around the site, their HQ is a couple blocks away, and they are hiring a front-end dev. Normally car washes are $25, but I get a free one, I decided I'd use it later this week.

All this thinking about my car made me remember, it's street cleaning tonight, I have to move my car--right now. So I rush out the door. I find two more Cherry business cards on my car. Luckily I find a good parking spot on a different street. As I'm closing my car door I notice something, the door is smooth, like really smooth, like just waxed smooth. What the...!? I haven't washed my car in over a month, it's too much of a pain. I only drive once every few weeks. My car should be filthy... but it's clean... really clean.

Yes, Cherry washed my car for free, and I didn't even ask them to. I don't know whether they were supposed to wash another car and washed mine by accident, or if this is just brilliant marketing. But I'm happy! I tried to think, is there a time I wouldn't want my car washed for free? I try to avoid drive-through car washes, but I'm always in favor of a good hand wash. If I had I classic car or a show car, I wouldn't want it washed by a random person. Then again, if I had a show car I wouldn't park it on the street covered in two months of dust. Cherry probably thought through the same thing. Most people are going to be happy, just don't wash any '65 Mustangs or Lamborghini Murcielagos without being asked.

Cherry's website says they are "building an online/offline technology to connect consumers with services they use every day." I have a feeling they are planning to do more than wash cars. It's a closed beta, if you want a free car wash click here. Cherry is on Twitter @Cherry.

Python libraries should not be licensed under the GPL

2011-09-28T12:50:00.000-07:00

GNU General Public License (GPL) is great. It has helped the computing world in huge ways. I don't think Linux would be where it is today if it weren't for the GPL requirement that people who distribute modified versions of Linux also release their modifications. The GPL is what is called a copyleft license, it means modified versions of GPL'd software must be released under the GPL or a GPL-compatible license. In this way the GPL is infectious, like a virus. If you release software that includes any GPL'd code, your software in now under the GPL, or your software is illegal. Your software cannot be licensed under a permissive open source license like the BSD or MIT licenses.

The viral nature of the GPL poses a problem for code libraries, because anything released that uses the library will have to be GPL licensed. Mercurial has a good explanation of how the GPL works. It's really easy to write a little web application to display info about your local Mercurial repositories, all you have to do is import hg and write 50 lines of code. But if you do import hg, and you release your code, it must be released under the GPL. This is fine for a major stand-alone application like Mercurial, but not for libraries that don't function on their own. I have been disappointed by how many Python libraries are licensed under the GPL, for example all the DHCP-related libraries I have found are GPL.

The LGPL

The GNU Lesser General Public License (LGPL) is specifically designed to be used by libraries, it allows a license-incompatible application to link to a LGPL'd library. I personally find the LGPL to be extremely confusing for non-C applications. The terms it uses like "linking" and "header files" don't make sense for most interpreted laguages like Python and Ruby. The confusion has led to the creation of the Lisp LGPL. The Free Software Foundation has tried to clarify this confusion for Java, but even their clarification is confusing.

"Applications use Java's “import” functionality to access classes from these libraries. When the application is compiled, function signatures are checked against the library, creating a link."

So in Java it works correctly because Java compiles and links? What about Python which compiles at runtime? Or combined/minified JavaScript? Twisted was originally licensed under the LGPL, then it was changed to the MIT License. In regards to choosing the LGPL, Glyph Lefkowitz the creator of Twisted, said:

"In that, the confusing wording of the LGPL as it regardsPython code was an asset. It would be a halfway accurate statement thatI selected the LGPL exactly because it doesn't make any sense."

I'm not a lawyer, but I agree, the LGPL doesn't make sense, if for no other reason than it has created all this confusion.

Real World Example

For a real world example lets look at MySQL. The MySQL database and libraries are licensed under the GPL, with a key exception, it allows linking from OSI-compliant open source software. That linking exception allows MySQLdb, the Python interface to MySQL to be dual-licensed under the GPL and the old Python License. The Python License is a liberal BSD-like license. As a result of the permissive licensing of MySQLdb, the extremely popular Django framework, licensed under a BSD License is able to use MySQLdb. And a cool project like Review Board, licensed under the MIT License is able to use Django. If MySQL didn't have the linking exception, MySQLdb, Django, and Review Board would all have to be GPL licensed.

More realistically if the MySQLdb team had decided to only license it under the GPL, Django and all other frameworks would not use it. Instead they would use a BSD-licensed alternative, and the MySQLdb project would die. The same is true in the Ruby world, Ruby on Rails is MIT licensed. If you are writing some really cool Ruby library, and you hope it's going to become uber popular and included in Rails, you better not license it under the GPL.

Your Choice

The developers of software have the right to choose what license they use, and I don't mean to sound like I'm telling them what to do. I understand many people strongly believe in the GPL, and they choose it knowing the full implications of it. But I think, or at least I hope that most open source developers writing libraries want their libraries to be as widely used and useful as possible. If that's the case, I strongly believe that BSD-like licenses, like the BSD 2-Clause License, MIT License, or ISC License are the way to go.

My Memories of 9/11

2011-09-11T21:15:00.000-07:00

My alarm went off at 5:55am PDT. I used my Aiwa stereo as an alarm, tuned to KGO Newstalk 810. There was some breaking news about an airplane hitting one of the Twin Towers in New York. Some eye witness said it was an airliner, like a Boeing 737. I thought yeah right, airliners don't crash into buildings, it was probably a little Cessna. I went downstairs and turned on the TV. I watch replays of the plane hitting, it was an airliner. At 6:03am PDT I watched live as a plane hit the second tower. The TV anchor didn't notice it was a second plane, he said it was a replay, but I noticed. One tower had smoke coming from it, and a plane hit the other tower. The TV said Live. It was shocking.

It was time to get ready for school. I had a Linux Administration class that morning, the official title of the class was probably something silly like "Introduction to UNIX", but it used Red Hat Linux. I brought a radio into the bathroom and listened to KGO as I got ready. After getting ready for school I went back to watching TV. I saw the people jumping out of the buildings. Then one of the towers collapsed. A wave of dust rushing down the streets. Then another tower collapses. It still brings tears to my eyes to think about it. It was horrific. I went to school.

Some people in class hadn't heard about the attack. It was hard to form the words to explain it. The towers were just gone. It was a very quiet and somber day in my Linux Administration class that morning.

99 Bottles of Beer in CoffeeScript

2011-09-05T19:58:00.000-07:00

99 Bottles of Beer is a really fun (for a geek) website that has a huge collection of programs written in different programming languages, that all print the lyrics to "99 Bottles of Beer." It is a great way to show off the basic elements of a language, such as conditionals, loops, variables, string printing, etc.

There are examples of language simplicity, such as this Python version. Or the complete absurdity of a language, like the Perl example the looks like ASCII art of bottles of beer, but is actually executable Perl. Then there are the crazy funny languages like lolcode and COW.

CoffeeScript is a language the compiles to JavaScript, but it is simple and elegant like Python. While I was learning about CoffeeScript I noticed there were no CoffeeScript versions of 99 Bottles of Beer. So I wrote one! It's not fancy, it's the most straight forward way I could think to do it. I submitted it to 99-bottles-of-beer.net, hopefully they will accept it.

If you are using Mac OS X you can use Homebrew to install CoffeeScript and Node.js (required for command-line CoffeeScript).

A sad day: 428 days of uptime lost

2011-06-21T22:41:00.000-07:00

My Linux workstation had been up for 428 days without a reboot. No cheating, I don't think I even logged out of my X session in that time. But today is a sad day, I had to move my workstation to a new room.

I considered getting a UPS and trying George's Frogger move from Seinfeld. But it probably wouldn't have worked.

The upside is the reboot restarted all the memory leaks, so I'm not using 1GB of swap anymore!

You should stop using WordPress

2011-05-30T16:33:00.000-07:00

It's not just WordPress, it's all Content Management Systems. A self-hosted CMS is a bad choice for a personal site or a small business. There are better choices than taking on the risks that come with using WordPress, Drupal, Joomla, and other CMSs.

What's Wrong With CMSs
Security. According the Secunia Advisories Mailing List, in the past 2 months there have been 18 vulnerabilities related to WordPress, 10 for Joomla, and 9 for Drupal. A lot of them are with plug-ins or modules, but some are in the core product. If you host the CMS you will have to update it constantly.

You are probably thinking that's easy, there is this nice little button in the admin interface that allows me to upgrade with one click. That's bad, very bad! What that means is that your web site can update itself. Your web server has permission to write scripts in your document root. If there is a security vulnerability it can be used to upload a whole new site! In technical terms, the user running your web server, usually www-data or apache, should not have write permissions or own files/directories that are used to serve pages. There are obvious exceptions, like a directory for image uploads, but those directories should have the script handlers for .php, .py, etc. turned off.

Even if you only allow write access during the upgrade, or upgrade from a tar file, how do you know it will work? Have you tested the upgrade? Do you have a test environment with that custom module or theme? Most small businesses don't have the test infrastructure to test web site upgrades.

Why Would Anyone Hack My Little Site
You're not the CIA, no one wants your data. What they want is a place to advertise male enhancement drugs and push malware on to your users. They don't target you, no one is sitting there hacking your site. There are automated bots the crawl the web looking for vulnerable sites, and using file upload or SQL injection exploits to post their illegal content on your site.

Some companies do have valuable data, even if it is not stored on the web server, your data may be at risk. If someone does hack your site, how hard would it be for them to change the log-in page to email your password to them? The likelihood of someone in your company using the same password for the web site and their email is high. With access to an employee's email they can reset their password to your source code version control, then they steal the source code for that top secret project your company is working on. It sounds like paranoia, but that is how hacks really happen.

Why Are People Using WordPress
I think all the people running to WordPress and Drupal is a reaction to large monolithic Flash sites and other sites where the business owner can't update content without paying the web developer to do it. I also think CMSs have become the new Dreamweaver, an easy way for people new to web design to get into it. Flash sites have always been bad thing, I have to say I'd much rather have WordPress than Flash. But there are other options.

Are You Going To Create The Site In Custom PHP

STOP! Don't do it! It seems like a valid reaction to automatic exploits of open source content management systems, but it isn't, at least not for the average person. I recently looked into a developer that was using a custom PHP CMS. I went to the web developer's site, and checked out a few reference customers. And guess what, every form of user input allowed for SQL injections; the URL bar, the search box, the log-in page -- they all allowed me to type in SQL and have the database run it! If you don't know what an SQL injection is you should not be writing PHP or any other web language for that matter. That includes WordPress plug-ins and Drupal modules.

Pick a Hosted Platform
There are good reasons to have a site that is easy to update, like this blog. But you should not be responsible for keeping the blog software up-to-date. Blogger will host your site, at a domain you own, for free! WordPress.com (not the WordPress open source software) will host your site for a minimal fee. Tumblr and Posterous are free. I consider WordPress.com a much safer option that hosing your own WordPress install. The people at WordPress.com make WordPress, it will always be up-to-date. They only allow a limited number of supported Plug-ins, and lets face it, plug-ins written by Joe Blow are the biggest security problem.

Or Don't
Do you actually need a dynamically generated site? If you are like most small businesses you only need to update your site once or twice a year. If you are a little technical, and you have a good web designer, maybe they will do your site in something like Jekyll. It could be even be hosted on Amazon S3.

What Else Is Out There
Is there a good hosted web site platform targeted at small businesses? There are Squarespace and Weebly for SMBs, and Behance ProSite targeted creative professionals. Squarespace looks pretty awesome, and at $11-$13/month they seem way better then having to host your own site for $5+/month. Does anyone know of other good hosted platforms for business web sites?

I wish there were more CMSs that would publish to static HTML, while keeping all the dynamic scripts behind your firewall. MovableType can publish to static. It would be great if they had a little button that would commit a static site to a version control system like Git, which you could then push out to a public web server.

My New Car

2006-04-24T00:34:00.000-07:00

I bought a 1999 Miata a few months ago, it's black with a hardtop.

Sky Tower Pictures

2006-03-26T02:28:00.000-08:00

I recently went to New Zealand, one of the coolest things I did while there was go up the Sky Tower in Auckland. At first I thought it was going to be pretty lame, it's just another tall building, but the view up there is amazing. They have glass floors you can walk on, it took a lot of nerve, but eventually I was totally comfortable walking on them, check out the picture below. I took a lot of pictures up there, including nine I stitched into a panorama.

Panorama @ 100% (4.6MB 15010x2160)*

* To view the whole panorama at 100% you will need six 30" monitors.

My trip pictures

2005-08-15T21:16:00.000-07:00

I finally finished putting all the pictures from my trip to Prague, Berlin, Amsterdam, and New York into web galleries. There are over a thousand pictures, unless you are extremely bored your best bet is to just look at My Favorites, if that is interesting enough check out the Top 200. I didn't delete any pictures, that means if I accidentally hit the shutter button and took a picture of the sidewalk, that picture is somewhere in the galleries. All of the pictures were taken with a Canon S70 at 3072x2304, mostly Raw, if for some reason you would like a high res version of a picture please let me know.
Image Galleries

Photoshop CS thumbnails are back!

2005-03-10T02:48:00.000-08:00

If you installed Photoshop CS from scratch, not the case with an upgrade, you probably noticed something very disturbing. PSD's don't have thumbnail previews in Windows, not even in Photoshop's Open dialog! It turns out Adobe left out a DLL called psicon.dll do to crashes on some peoples systems. Well I for one find it extremely annoying not to have thumbnails in Windows, fortunately the solution is simple. Download psicon.dll and place it in C:/Program Files/Common Files/Adobe/Shell. That's it, they are instantly back.
Thanks to notestips.com and dlldump.com.
Want thumbnails of Canon Raw files? Head here.

I'm in New York City

2005-02-26T12:59:00.000-08:00

Here's a picture of a subway station at rush hour:

Here are pictures of the Gates in Central Park:

European Vacation

2005-02-14T17:59:00.000-08:00

I recently got back from about a month in Europe, I hit Prague, Berlin and Amsterdam. I took over 700 pictures, and I plan on posting some, along with a little trip writeup. So look for it in the future...

Deathmatch coming to HL2 UPDATED

2004-12-01T03:10:00.000-08:00

A post by Valve's Adrian Finol, on the steampowered.com forums, indicates Valve will be adding DM to HL2 soon.

Update: Half Life 2: Deathmatch in now available through Steam :)

Ahhhh, Half Life 2

2004-11-26T03:02:00.000-08:00

I bought HL2 the day it came out, over a week ago, and I haven't even tried to play it yet. I did try Counter Strike: Source today, and it was pretty fun. The graphics were nice, but the game still seemed behind the times. No scope or iron sights on most of the weapons, just the cheesy zoom. No lean or prone. Not enough menu options, Valve could learn from Epic how to do menu options right. And I'm not a fan of buy systems for weapons, but CS:S is the most balanced buy system I've tried. CS:S is supposed to be the MP component of HL2, but HL2 does have its own MP code. You would normally have to use console commands to access it, but justbi0 combined some mods from other people into a nice package giving you menu options and a server browser. There are no servers listed, and the maps suck, but it's worth a shot. Find other HL2 mods at halflife2.filefront.com.

Half Life 2 is GOLD!

2004-10-19T05:14:00.000-07:00

No, really! Vivendi has even announced a release date, or as they call it, "a planned retail street date of November 16th, 2004." In other HL2 news, ClanBase has closed down their CS:S ladders do to built-in cheats and unfair gameplay, with no way to stop it. I really hope Valve uses Punkbuster, Valve's in-house cheat detection just isn't good enough. November 16th is also the release date of Eminem's new album, now I know how to spend those two Best Buy Bucks I got from McDonald's.

DOOM 3 SDK is out

2004-10-16T23:57:00.000-07:00

So now you can make things... and stuff. From filefront.com. It's only 10MB.

Men of Valor MP Demo

2004-10-06T03:45:00.000-07:00

The MoV MP demo is out, it's really nothing special. If your CPU is below 1.3GHz it won't even load them game, which is complete BS. My 1.2GHz (Dual) Athlon MP can certainly hold its own against a 1.4GHz P4 any day. To get around that arbitrary rule, add -CPUSPEED=1400 to the end for the Target field of the shortcut properties. I was able to play at 1280x1024 at the highest detail the demo allowed, without even a jitter.

Updates and demos

2004-09-30T03:11:00.000-07:00

The DOOM 3 1.1 patch is out, you can grab it at FileFront. It's pretty much the same as 1.05 beta. The SDK is not included. If you don't have DOOM 3 yet, try the demo.

There are lots of new UT2004 files, including new demos for PC, Mac and Linux. And an Editor's Choice Bonus Pack from Epic, it has 4 new maps, 3 new vehicles, and 6 new characters. You'll need the 3323 patch to use it.

An MP Demo for Tribes: Vengeance has been release. It's not my cup of tea, but many people are big Tribes fans. It's only 472MB :)

The latest in Futuremark's bi-annual series of "I need a new computer" benchmarks is out. You can get 3DMark05 from FileFront.

You may be wondering why I link to FileFront. Well, even with the short wait they sometimes have, I still find it the fastest place to get game files. They can always max out my 3Mb connection.

DOOM 3 1.05 Beta Patch is out

2004-09-08T20:17:00.000-07:00

An unsupported beta of the DOOM 3 1.05 patch has been released by id. It includes improved widescreen support, and a bunch of tweaks/fixes, mostly multiplayer. According to Robert Duffy's .plan the final version of 1.05 will include the SDK(Software Developers Kit), and a future version will include PunkBuster anti-cheat software. He also mentions the DOOM 3 demo is coming soon... who doesn't have DOOM 3 yet?
The beta patch is only 17.3MB, you can grab it from: