Why You Should Never Use MongoDB

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

Disclaimer: I do not build database engines. I build web applications. I run 4-6 different projects every year, so I build a lot of web applications. I see apps with different requirements and different data storage needs. I’ve deployed most of the data stores you’ve heard about, and a few that you probably haven’t. I’ve picked the wrong…

The story of how the Diaspora social network adopted the hip new database technology without for a moment thinking about whether it was the right database technology.

Pocket Searching

Pocket dialling was bad enough. I once received a phone call from a friend whose phone called me – as the last number he’d dialled – just as he was putting on a harness in anticipation of doing a bungee jump. So all I got to hear was rustling, and shuffling… and then a blood-curdling scream. Nice one.

A cat on a mobile phone.
Hello? Yes, this is cat. Just thought I’d press some buttons and see who I got.

But in this age of smartphones, the pocket search has become a new threat. Thanks to the combination of touchscreens, anticipatory keyboards (I use SwiftKey, and I’m beginning to think that it knows me better than I do myself), and always-online devices, we’re able to perform quite complex queries quite accidentally. I’ve got a particular pair of trousers which seems to be especially good at unlocking my phone, popping up a search engine, typing a query (thanks to the anticipatory keyboard, usually in full words), and then taking a screenshot and saving it for me, so that I can’t later deny having searched for… whatever it was.

This morning, while cycling to work, I searched for the following (which I’ve reformatted by inserting line breaks, in order to transform it into the sort-of poem you might expect from sombebody both insane and on hallucinogens):

thanks again
and it all goes on
and I will Also
Also A bit LIKE THAT
THE ANSWER is
That you are looking at your Local Ryanair
and a ripening
and a ripening
I can assure are a BIT
and see the new template by clicking here
for
for YOU GUYS
GUYS HAVE YOU ANY COMMENTS
ON MY WAY BACK FROM YOU
And the other side and I will have the same
as a friend or relative
relative humidity
humidity
to you
you are here car
car
and
and embarrassing
embarrassing
the best thing is the first three years and over
over?

Maybe my phone is gradually becoming sentient and is trying to communicate with me. I for one welcome our new robot overlords.

×

TIL that microcomputer pioneer and inventor Clive Sinclair avoids the Internet because it “blurs the mind”

This link was originally posted to /r/todayilearned. See more things from Dan's Reddit account.

The original link was: http://news.bbc.co.uk/1/hi/technology/7481940.stm

Personal flying machines will be a reality, home computer and electric car pioneer Sir Clive Sinclair has said.

He told BBC Radio 4’s iPM programme that soon it would be “economically and technically possible” to create flying cars for individuals.

Sir Clive is best-known for the Spectrum computer and his failed electric car effort, the C5.

“I’m sure it will happen and I am sure it will change the world dramatically,” he predicted.

Despite his pioneering work in the field of computers, Sir Clive told BBC Radio 4 he was not an internet user.

“I don’t use it myself directly,” he said, explaining that as an inventor he tried to avoid “mechanical and technical things around me so they don’t blur the mind”.

BBC News

Phone Security == Computer Security

The explosion of smartphone ownership over the last decade has put powerful multi-function computers into the pockets of almost half of us. But despite the fact that the average smartphone contains at least as much personally-identifiable information as its owner keeps on their home computer (or in dead-tree form) at their house – and is significantly more-prone to opportunistic theft – many users put significantly less effort into protecting their mobile’s data than they do the data they keep at home.

Nokia E7, showing lock screen.
Too late, little Nokia E7: I’ve got physical access to you now.

I have friends who religiously protect their laptops and pendrives with TrueCrypt, axCrypt, or similar, but still carry around an unencrypted mobile phone. What we’re talking about here is a device that contains all of the contact details for you and everybody you know, as well as potentially copies of all of your emails and text messages, call histories, magic cookies for social networks and other services, saved passwords, your browsing history (some people would say that’s the most-incriminating thing on their phone!), authentication apps, photos, videos… more than enough information for an attacker to pursue a highly-targeted identity theft or phishing attack.

Pattern lock configuration on an Android mobile phone.
Android pattern lock: no encryption, significantly less-random than an equivalent-length PIN, and easily broken by a determined attacker.

“Pattern lock” is popular because it’s fast and convenient. It might be good enough to stop your kids from using your phone without your permission (unless they’re smart enough to do some reverse smudge engineering: looking for the smear-marks made by your fingers as you unlock the device; and let’s face it, they probably are), but it doesn’t stand up to much more than that. Furthermore, gesture unlock solutions dramatically reduce the number of permutations, because you can’t repeat a digit: so much so, that you can easily perform a rainbow table attack on the SHA1 hash to reverse-engineer somebody’s gesture. Even if Android applied a per-device psuedorandom salt to the gesture pattern (they don’t, so you can download a prefab table), it doesn’t take long to generate an SHA1 lookup of just 895,824 codes (maybe Android should have listened to Coda Hale’s advice and used BCrypt, or else something better still).

iPhone showing the PIN lock screen.
An encrypted iPhone can be configured to resist brute-force attacks by wiping the phone after repeated failures, which replaces one security fault (brute-force weakness) with another (a denial of service attack that’s so easy that your friends can do it by accident).

These attacks, though (and the iPhone isn’t bulletproof, either), are all rather academic, because they are trumped by the universal rule that once an attacker has physical access to your device, it is compromised. This is fundamentally the way in which mobile security should be considered to be equivalent to computer security. All of the characteristics distinct to mobile devices (portability, ubiquity, processing power, etc.) are weaknesses, and that’s why smartphones deserve at least as much protection as desktop computers protecting the same data. Mobile-specific features like “remote wipe” are worth having, but can’t be relied upon alone – a wily attacker could easily keep your phone in a lead box or otherwise disable its connectivity features until it’s cracked.

A finger swipes-to-unlock a Samsung mobile phone.
The bottom line: if the attacker gets hold of your phone, you’re only as safe as your encryption.

The only answer is to encrypt your device (with a good password). Having to tap in a PIN or password may be less-convenient than just “swipe to unlock”, but it gives you a system that will resist even the most-thorough efforts to break it, given physical access (last year’s iPhone 4 vulnerability notwithstanding).

It’s still not perfect – especially here in the UK, where the RIPA can be used (and has been used) to force key surrender. What we really need is meaningful, usable “whole system” mobile encryption with plausible deniability. But so long as you’re only afraid of identity thieves and phishing scammers, and not being forced to give up your password by law or under duress, then it’s “good enough”.

Of course, it’s only any use if it’s enabled before your phone gets stolen! Like backups, security is one of those things that everybody should make a habit of thinking about. Go encrypt your smartphone; it’s remarkably easy –

Living In The Future

Eurovision Night 2012.
Eurovision Night 2012. In a moment of surreal awesomeness, Matt R holds a mirror up to the webcam in order to show Gareth the collection of whisky that’s just outside of his field of vision.

Sometimes it’s really like we’re living in the future. Exciting new technologies keep appearing, and people just keep… using them as if they’d always been there. If tomorrow we perfected the jetpack, the flying car, and the silver jumpsuit, I’ll bet that nobody would think twice about it.

Recently, I’ve had two occasions to use Google+ Hangouts, and I’ve been incredibly impressed.

The first was at Eurovision Night 2012, which was quite a while ago now. Adam did a particularly spectacular job of putting together some wonderful pre-Eurovision entertainments, which were synched-up between our two houses. Meanwhile, he and I (and Rory and Gareth and occasionally other people) linked up our webcams and spare screens via a Google+ hangout, and… it worked.

It just worked. Now I know that the technology behind this isn’t new: back in 2004, I upgraded the Troma Night set-up in Aberystwyth to add a second webcam to the Troma Night live feed. But that was one-way, and we didn’t do sound (for lack of bandwidth and concerns about accidental piracy of the soundtracks to the movies we were watching, of all things, rather than for any particularly good reason). But it really did “just work”, and we were able to wave at each other and chat to each other and – mostly – just “share in the moment” of enjoying the Eurovision Song Contest together, just like we would have in person when we lived in the same town.

At the weekend, I was originally supposed to be in Lancashire, hanging out with my family, but owing to a series of unfortunate disasters (by the way; I’m walking with a stick right now – but that’s not interesting enough to be worth blogging about), I was stuck in Oxford. Despite torrential rain where I was, Preston was quite sunny, and my family decided to have a barbeque.

A Google+ Hangout with my family and I.
I join a Google+ hangout at my (late) father’s house, where the rest of my family are having a barbeque.

I was invited… via Google+. They didn’t have Internet access, so they used a mobile dongle plugged into a laptop. I connected in from my desktop computer and then – later – from my mobile phone. So yes, this was at times a genuine mobile-to-mobile multi-party video conference, and it was simple enough that my mother was able to set it up by herself.

Like I said: living in the future.

× ×

Domain Name Hacks of 2013

Now that the list of new top-level domain applications for 2013 has been revealed, geeks around the world can start planning for the domain hacks of the future. Please.do.not.disturb.me was fun, and all, but the if many or all of these new registries are willing to sell their domains to anybody, there’s a lot of potential for new and unusual domain names.

please.do.not.disturb.me
http://please.do.not.disturb.me/ – a website based on a simple domain name hack

I suspect we’ll soon be typing in addresses like:

  • jack.and/jill – the .and TLD is clearly supposed to be for the Andalusian community in Spain, but I doubt that’s going to stop people from coming up with imaginative uses for domain names where you can just “put your own suffix” after the .and/, like we used to do before .isgay.com before it got taken over by domain squatters. (note that .gay will soon be a TLD, so there’s probably going to be a whole raft of these new sites soon…)
  • crow.bar – or as we’ll say at the time, “.bar – it’s not just for bars any more!”
  • I quite like the idea of sugar.beats, but I think a far more popular use will be “put your own suffix” sites, again, like rock.beats/scissors.
  • ro.bot-  .bot is one of the many TLDs that Amazon is going for, and it seems likely to me that they’re going to try to resell domains underneath it. I’m just not sure whether sex.bot or ro.bot will be first to be snatched up.
  • not.just.broke.but.broker – perhaps you have to be in my head to find this amusing.
  • fizz.buzz. This web site would have the best hit counter ever on it (why?).
  • s.cares.carss.expert, s.tab, and dozens of other domain names that are only a letter away from meaning something completely different – and that letter is often “s”.
  • mon.daysun.daydooms.daybirth.day – etc. etc. I’d buy birth.day if the price was right, and then run a basic site spanning happy.birth.dayfirst.birth.day, and the like, with automatically-generated content on each. It’d be fun.
  • yo.dog – a complete abuse of the .dog  TLD, no matter what its purpose is supposed to be. Better still, I’d put a page at  http://yo.dog.yo.dog/yo.dog, containing the message “I heard you like domain names in your domain names, so I put a domain name in a domain name.” (why?)
  • electric.fan – the website that Koreans will set as one another’s home page, as a cruel prank against the superstitious.
  • jelly.fish would be an awesome domain name! Who wouldn’t want to have the email address throw.stones@jelly.fish?
  • mtee.ggee- the future domain name of Hungry Horse pubs? (get it? “empty gee-gee”?)
  • a.boy.named.goo, after the Goo Goo Dolls album. But then, I don’t object to domain names with possibly-excessive numbers of dots in them, as the Summer Party On Earth website probably gives away. Hell: I could possibly be using a.home.called.earth as the domain name for our house, in 2013.
  • fag.got – I’ll bet that homosexual sex blogger Dan Savage, who’s been trying to reclaim the word “faggot”, would love to have the email address hey@fag.got!
  • bl.ink – I’ve got an idea for a webcam-based site, like ChatRoulette, but with facial recognition software that watches your eye movements. You get paired up with a random stranger and the pair of you have a staring contest, right over the Internet. If you win, you get a point. It’ll be awesome.
  • commun.istrac.ist, anarch.ist, etc. – I’m sure that Istanbul, for whom the .ist TLD is intended, won’t mind if we borrow their new domain name for a few amusing addresses. Like the email address shoot@the.rac.ist, for example.
  • bob.lob.law/law/blog – with apologies to those who don’t follow Arrested Development.
  • bi.ngo – sure,.bingo is likely to exist anyway, but this way’s more fun.
  • fuck.off – I have no idea what anybody else expected the.off TLD to be used for, if not this.
  • child.ren – I quite like this, because it makes not only a full word, but the first part is a word, too.
  • im.off.ski – faux Russian is never going to go out of style.
  • tube.tube.tube – if I can, I’m totally setting this site up in 2013. All that there’ll be is the picture, below, which makes me smile every time I see it.
Polar bear: got my tube, tube tube tube, tuuuuuuube!
Tube tube tube. Soon to appear at http://tube.tube.tube/, if I get my way.

Honestly, though: it feels like all of these new top-level domain name opportunities take a lot of the fun out of domain hacks. The more TLDs we have, the easier it is to put together words and phrases with the opportunities given.

Scrabble wouldn’t be so enjoyable if each player had a rack of, say, 30 tiles, rather than just 7. The restriction (and working around them) is what makes domain-name-based jokes so funny, in my mind. What are we supposed to do in a world where anybody with a spare $185,000 USD can have anything he wants?

When I realise that the era of funny domain hacks is coming to an end, it makes me a little sad. But then I look at that picture of a polar bear and everything’s okay again. Tuuuuuuube!

×

Cardless Cashpoints

My mobile banking app, showing me a special six digit code.
The mobile app presents you with a special six-digit code that is used to withdraw the cash.

RBS Group this week rolled out a service to all of its customers, allowing them to withdraw cash from an ATM without using their bank card. The service is based upon the same technologies that’s used to provide emergency access to cash by people who’ve had their cards stolen, but integrates directly into the mobile banking apps of the group’s constituent banks. I decided to give it a go.

The first step is to use the mobile app to request a withdrawal. There’s an icon for this, but it’s a bit of a mystery that it’s there unless you already know what you’re looking for. You can’t make a request from online banking without using the mobile app, which seems to be an oversight (in case you can’t think of a reason that you’d want to do this, read on: there’s one at the end). I opted to withdraw £50.

Next, it’s off to find a cash machine. I struck out, without my wallet, to try to find the nearest Royal Bank of Scotland, NatWest, or Tesco cashpoint. The mobile app features a GPS tool to help you find these, although it didn’t seem to think that my local Tesco cashpoint existed, walking me on to a branch of NatWest.

Cash machine: "Do you wish to carry out a Get Cash or Emergency Cash transaction? [No] [Yes]"
The readout of the cash machine demonstrates that the roots of the “Get Cash” system lie in the older “Emergency Cash” feature: the two are functionally the same thing.
As instructed by the app, I pressed the Enter key on the keypad of the cash machine. This bypasses the usual “Insert card” prompt and asks, “Do you wish to carry out a Get Cash or Emergency Cash transaction?” I pressed Yes.
Entering a 6-digit code from a mobile phone into a cash machine.
The number displayed upon the screen is entered into the cash machine.

The ATM asked for the PIN I’d been given by the mobile app: a 6-digit code. Each code is only valid for a window of 3 hours and can only be used once.

A cashpoint asking for the PIN a second time, and then asking for the amount of money to withdraw.
The cash machine asks for the PIN a second time, and then asks for the sum of money to be withdrawn.

I’m not sure why, but the ATM asks that the PIN is confirmed by being entered a second time. This doesn’t make a lot of sense to me – if it was mistyped, it’d surely fail anyway (unless I happened to guess another valid code, within its window), and I’d simply be able to try again. And if I were an attacker, trying to guess numbers, then there’s no difficulty in typing the same number twice.

It’s possible that this is an attempt at human-tarpitting, but that wouldn’t be the best way to do it. If the aim is to stop a hacker from attempting many codes in quick succession, simply imposing a delay would be far more effective (this is commonplace with cash machines anyway: ever notice that you can’t put a card in right after the last transaction has finished?). Strange.

Finally, the ATM asks what value of cash was agreed to be withdrawn. I haven’t tried putting in an incorrect value, but I assume that it would refuse to dispense any cash if the wrong number was entered – this is presumably a final check that you really are who you claim to be.

Cash machine: "Please take your cash and your receipt."
It feels strange taking money and a receipt from a cashpoint without first having to retrieve my card. I spent a few minutes after the experience with a feeling that I’d forgotten something.

It worked. I got my money. The mobile app quickly updated to reflect the change to my balance and invalidated the code: the system was a success.

The banks claim that this will be useful for times that you’ve not got your card with you. Personally, I don’t think I ever take my phone outdoors without also taking my wallet with me, so the chance of that it pretty slim. If my card were stolen, I’d be phoning the bank to cancel the card anyway, so it wouldn’t save me a call, either, if I needed emergency cash. But there are a couple of situations in which I’d consider using this neat little feature:

  • If I was suspicious of a possible card-skimming device on a cash machine, but I needed to withdraw money and there wasn’t an un-tampered ATM in the vicinity. It’d be nice to know that you can avoid having your card scanned by some kid with a skimmer just by using your phone to do the authentication rather than a valuable piece of plastic.
  • To send money to somebody else. Using this tool is cheaper than a money order and faster than a bank transfer: it’s an instantaneous way to get small sums of cash directly into the hands of a distant friend. “Sure, I’ll lend you £50: just go to a cash machine and type in this code.” I’m not sure whether or not this is a legitimate use of the service, but I can almost guarantee that it’ll be the most-popular. It’ll probably be reassuring to parents of teenagers, for example, who know that they can help their offspring get a taxi home when they’ve got themselves stranded somewhere.

What do you think? If you’re with RBS, NatWest or Tesco, have you tried this new mobile banking feature? Do you think there’s mileage in it as an idea, or is it a solution in need of a problem?

× × × × ×

Eurovision Spectacular 2012

As I’m sure you’re aware, Saturday marks the final of the 2012 Eurovision Song Contest, the musical highlight of the year. You may also know that there’s been a long tradition among our group of friends to have a Eurovision Party to mark the ocassion, generally hosted by Adam. If you’ve somehow missed this event, then here’s some background reading that might help you understand how it came to be what it is: me, 2005; Liz, 2005; Paul, 2005Adam, 2006; Adam, 2007 (1); me, 2007; Adam, 2007 (2); Matt R, 2007; Adam on Paul’s blog, 2008Adam, 2008; Adam, 2010; Adam, 2011; me, 2011. Like I said… a long history.

For the last few years, though, the population of Aberystwyth has been dwindling, and Adam’s parties have turned from an immense hard-to-squeeze-everybody-in ordeal to a far more civilised affair. While simultaneously, groups of ex-Aberystwyth people (like those of us down in Oxford, and those who are up in the North) have been having their own splinter satellite parties.

And you know what? I miss doing Eurovision Night with you guys. So this year, we’re going to try to bring Eurovision Night back to its roots… with technology!

Google+ Hangouts
Google+ Hangouts. One of the technologies that will bring us closer this Eurovision Night.

Here’s where the parties are at, this year:

  • Adam’s house, in Aberystwyth – mission control
  • New Earth, in Oxford (hosted by Ruth, JTA, and I) – technical operations
  • …and… anybody else having one this year? One of you up in the North, perhaps?

If you’re one of the usual crew, or one of our newer friends, come on over and join the party! Or if you’re going to be watching from further North (Liz? Simon? Gareth? Penny? Matt? Matt? Kit? Fi?), let me know so that I can bring you in on my proposals for “sharing the experience”, drawing together our votes, and whatnot.

And regardless of whether you’ll be joining one of these parties in person, or not, I hope you’ll be joining The Party at Adam’s and The Party on New Earth digitally. If you’re among the 17 people who are actually on Google+, come and join us in our Hangout! Dust off that old webcam and point it at you or your little party, make sure you’re in Adam or I’s “circles”, and then log in on Eurovision Night and join us via the power of the Internet! You’ll have to provide your own crisps and beer, and (unless you’re at Adam’s) you’ll need to bake your own cupcakes with adorable European-flag icing, too, but at least you can be part of the moment with the rest of us.

See you online!

×

On This Day In 2004

Looking Back

On this day in 2004 I handed in my dissertation, contributing towards my BEng in Software Engineering. The topic of my dissertation was the Three Rings project, then in its first incarnation, a web application originally designed to help university Nightlines to run their services.

An early Three Rings Directory page. If you remember when Three Rings used to look like this, then you're very old.

I’d originally started developing the project early in the previous academic year, before I’d re-arranged how I was going to finish my course: Three Rings celebrates its tenth birthday this year. This might be considered to have given me a head start over my peers, but in actual fact it just meant that I had even more to write-up at the end. Alongside my work at SmartData a few days a week (and sometimes at weekends), that meant that I’d been pretty damn busy.

A page from my dissertation, covering browser detection and HTTPS support (then, amazingly, still not-quite-universal in contemporary browsers).

I’d celebrated hitting 10,000 words – half of the amount that I estimated that I’d need – but little did I know that my work would eventually weigh in at over 30,000 words, and well over the word limit! In the final days, I scrambled to cut back on text and shunt entire chapters into the appendices (A through J), where they’d be exempt, while a team of volunteers helped to proofread everything I’d done so far.

Go on then; have another screenshot of an ancient web application to gawk at.

Finally, I was done, and I could relax. Well: right up until I discovered that I was supposed to have printed and bound two copies, and I had to run around a busy and crowded campus to get another copy run off at short notice.

Looking Forward

Three Rings went from strength to strength, as I discussed in an earlier “on this day”. When Bryn came on board and offered to write programs to convert Three Rings 1 data into Three Rings 2 data, in 2006, he borrowed my dissertation as a reference. After he forgot that he still had it, he finally returned it last month.

The inside front cover of my dissertation, along with a note from Bryn.

Later still in 2009, Ruth expanded Three Rings as part of her Masters dissertation, in a monumental effort to add much-needed features at the same time as getting herself a degree. After handing it in and undergoing her defense (which went better than she expected), she got a first.

My dissertation (left) back on my bookshelf, where it belongs.

Today, Three Rings continues to eat a lot of my time, and now supports tens of thousands of volunteers at hundreds of different helplines and other charities, including virtually every Nightline and the majority of all Samaritans branches.

It’s grown even larger than I ever imagined, back in those early days. I often tell people that it started as a dissertation project, because it’s simpler than the truth: that it started a year or two before that, and provided a lot of benefit to a few Nightlines, and it was just convenient that I was able to use it as a part of my degree because otherwise I probably wouldn’t have had time to make it into what it became. Just like I’m fortunate now to have the input of such talented people as I have, over the last few years, because I couldn’t alone make it into the world-class service that it’s becoming.

This blog post is part of the On This Day series, in which Dan periodically looks back on years gone by.

× × × × ×

Visitor Tracking Without Cookies (or How To Abuse HTTP 301s)

Last week I was talking to Alexander Dutton about an idea that we had to implement cookie-like behaviour using browser caching. As I first mentioned last year, new laws are coming into force across Europe that will require websites to ask for your consent before they store cookies on your computer. Regardless of their necessity, these laws are badly-defined and ill thought-out, and there’s been a significant lack of information to support web managers in understanding and implementing the required changes.

British Telecom's implementation of the new cookie laws. Curiously, if you visit their site using the Opera web browser, it assumes that you've given consent, even if you click the button to not do so.
British Telecom’s implementation of the new cookie laws. Curiously, if you visit their site using the Opera web browser, it assumes that you’ve given consent, even if you click the button to not do so.

To illustrate one of the ambiguities in the law, I’ve implemented a tool which tracks site visitors almost as effectively as cookies (or similar technologies such as Flash Objects or Local Storage), but which must necessarily fall into one of the larger grey areas. My tool abuses the way that “permanent” (301) HTTP redirects are cached by web browsers.

[callout][button link=”http://c301.scatmania.org/” align=”right” size=”medium” color=”green”]See Demo Site[/button]You can try out my implementation for yourself. Click on the button to see the sample site, then close down all of your browser windows (or even restart your computer) and come back and try again: the site will recognise you and show you the same random number as it did the first time around, as well as identifying when your first visit was.[/callout]

Here’s how it works, in brief:

  1. A user visits the website.
  2. The website contains a <script> tag, pointing at a URL where the user’s browser will find some Javascript.
  3. The user’s browser requests the Javascript file.
  4. The server generates a random unique identifier for this user.
  5. The server uses a HTTP 301 response to tell the browser “this Javascript can be found at a different web address,” and provides an address that contains the new unique identifier.
  6. The user’s browser requests the new document (e.g. /javascripts/tracking/123456789.js, if the user’s unique ID was 123456789).
  7. The resulting Javascript is generated dynamically to automatically contain the ID in a variable, which can then be used for tracking purposes.
  8. Subsequent requests to the server, even after closing the browser, skip steps 3 through 5, because the user’s browser will cache the 301 and re-use the unique web address associated with that individual user.
How my "301-powered 'cookies'" work.
How my “301-powered ‘cookies'” work.

Compared to conventional cookie-based tracking (e.g. Google Analytics), this approach:

  • Is more-fragile (clearing the cache is a more-common user operation than clearing cookies, and a “force refresh” may, in some browsers, result in a new tracking ID being issued).
  • Is less-blockable using contemporary privacy tools, including the W3C’s proposed one: it won’t be spotted by any cookie-cleaners or privacy filters that I’m aware of: it won’t penetrate incognito mode or other browser “privacy modes”, though.

Moreover, this technique falls into a slight legal grey area. It would certainly be against the spirit of the law to use this technique for tracking purposes (although it would be trivial to implement even an advanced solution which “proxied” requests, using a database to associate conventional cookies with unique IDs, through to Google Analytics or a similar solution). However, it’s hard to legislate against the use of HTTP 301s, which are an even more-fundamental and required part of the web than cookies are. Also, and for the same reasons, it’s significantly harder to detect and block this technique than it is conventional tracking cookies. However, the technique is somewhat brittle and it would be necessary to put up with a reduced “cookie lifespan” if you used it for real.

[callout][button link=”http://c301.scatmania.org/” align=”right” size=”medium” color=”green”]See Demo Site[/button] [button link=”https://gist.github.com/avapoet/5318224″ align=”right” size=”medium” color=”orange”]Download Code[/button] Please try out the demo, or download the source code (Ruby/Sinatra) and see for yourself how this technique works.[/callout]

Note that I am not a lawyer, so I can’t make a statement about the legality (or not) of this approach to tracking. I would suspect that if you were somehow caught doing it without the consent of your users, you’d be just as guilty as if you used a conventional approach. However, it’s certainly a technically-interesting approach that might have applications in areas of legitimate tracking, too.

Update: The demo site is down, but I’ve update the download code link so that it still works.

×

8-Bit Google Maps

It’s like stepping back in time through videogaming history. And also sideways, into a parallel universe of knights and dragons.

8-bit Google Maps. At different view levels, you’ll see mountainous areas (Wales is worth looking at) and sprites for cities of different sizes.

It’s like Google Maps, but in the style of retro top-down, turn-based RPGs. It’s really quite impressive: it’s presumably being generated at least semi-dynamically (as it covers the whole world), but it’s more than a little impressive. It sometimes makes mistakes with rivers – perhaps where their visibility from the air is low – but nonetheless an interesting feat from a technical perspective.

There’s “8-bit Street View”, too.

Nice one, Google. Go take a look.

Searching For A Virgin

You just can’t rely on GMail’s “contacts” search any more. Look what it came up with:

Not a result I'd commonly associate with the word "virgin".

With apologies to those of you who won’t “get” this: the person who came up in the search results is a name that is far, far away, in my mind, from the word “virgin”.

In not-completely-unrelated news, I use a program called SwiftKey X on my phone, which uses Markov chains (as I’ve described before) to intelligently suggest word completion and entire words and phrases based on the language I naturally use. I had the software thoroughly parse my text messages, emails, and even this blog to help it learn my language patterns. And recently, while writing a text message to my housemate Paul, it suggested the following sentence as the content of my message:

I am a beautiful person.

I have no idea where it got the idea that that’s something I’m liable to say with any regularity. Except now that it’s appeared on my blog, it will. It’s all gone a little recursive.

×

Remembering December 2003

For the first time in over seven years, I’ve recovered a handful more of my “lost” blog posts: articles that were written prior to the great server fuck-up of July 2004.

scatmania.org in August 2003, showing off the simplistic look it had before it was deleted.

Since then, I’ve kept regular backups. A lot of the old stuff is sometimes cringeworthy (in a “did I really used to be such a dick?” way), and I’m sure that someday I’ll look back at my blog posts from today, too, and find them shockingly un-representative of me in the future. That’s the nature of getting older.

Nostalgia’s awesome, which I choose to represent with this photo of me and my parents on a hilltop somewhere. You have permission to “aww”.

But it’s still important to me to keep all of this stuff. My blog is an extension to my diary: the public-facing side of what’s going on in my life. I back-link furiously, especially in the nostalgia-ridden “On This Day” series of blog posts I throw out once in a while.

Castle of the Four Winds in early 1999.
If you remember my blog when it used to look like this, back in the late 1990s, then you’ve been following me than longer than most folks have been on the Web at all.

The blog posts I’ve newly recovered are:

Andy & Sian, the adorable couple who I declared “most surprising” of the new relationships to get underway late in 2003. The pair married in 2010.

So there you go: especially for you stalkers or those of you looking for a trip down memory lane – some links to what I was up to in December 2003.

For those of you who are really on a roll, here’s some further reading from the period: Kit, on the last Troma Night of the year; a religious argument that Alec kicked off (thanks, archive.org); Liz starting her first blog; Paul applies for a hardship loan;

× × × ×

HDMI Virus, or How I Became An Old Person

So I saw this HDMI cable online:

Apparently the plastic coating around this cable helps to prevent 'virus noises', whatever those are. Red scribbles added by me.

Somehow, this triggered a transformation in me. You know how when Eric eats a banana, an amazing transformation occurs? A similar thing happened to me: this horrendously-worded advertisement turned me into an old person. I wanted to write a letter to them.

My letter... er... email to Bluemouth Interactive.

There were so many unanswered questions in my mind: what is a “virus noise” (is it a bit like the sound of somebody sneezing?)? How a polyester coating protects against them? And what kind of viruses are transmitted down video cables, anyway?

It took them five days but, fair play to them, they – despite Reddit’s expectations – wrote back.

Bluemouth's response to me. Like the other pictures, you can click it to see it in full.

Their explanation? The ‘Virus’ was transcribed from French terminology for interference. It’s not a computer virus or anything like that.

The world is full of examples of cables being over-sold, especially HDMI cables and things like “gold-plated optical cables” (do photons care about the conductivity of gold, now?).

Does anybody have enough of a familiarity with the French language to let me know if their explanation is believable?

× × ×