If anybody’s interested, I’m lugging around a sackload of Diaspora Alpha invitations. If you’re the kind of person who’s
likely to want one, then you’re probably the kind of person who already knows what
Diaspora is, so I shan’t go in to any further detail here.
Leave a comment if you want one, being sure to fill in the “Email” field of the comment form with the email address you’d like your invitation sent to. See you on the flipside.
If you see me in person, you’ll know that this is something I rant about from time to time. But that’s only because people consistently put themselves and their friends at risk,
needlessly, and sometimes those friends include me. So let me be abundantly clear:
If you’re reading this, there is at least a 95% chance that your passwords aren’t good enough. You should fix them.
Today.
Let’s talk about what what we mean by “good enough”. A good password needs to be:
Long. Some of you are still using passwords that are shorter than 8 characters. The length of a password is important because it reduces the risk of a robot “brute
forcing” it. Suppose a robot can guess 1000 passwords a second, and your password uses only single-case letters and numbers. If you have a 4-character password, it’ll be lucky to last
quarter of an hour. A 6-character password might last a week and a half. At 8-characters, it might last a few decades. Probably less, if your password makes one of the other mistakes,
below. And the robots used by crackers are getting faster and faster, so the longer, the better. My shortest password is around 12 characters long, these days.
Complex. Remember how long an 8-character password lasts against a “brute force” attack? If you’re only using single-case letters, you’re reducing that by almost a
third. Mix it up a bit! Use upper and lower case letters, and numbers, as standard. Consider using punctuation, too. There’s no legitimate reason for a website to demand
that you don’t have a long and complex password, so if one does seem to have unreasonable requirements: write to the owners and threaten to take your business elsewhere if they don’t
get with the times.
Random. If your password is, is based on, or contains a dictionary word (in any language), a name or brand name, a date, a number plate or (heaven forbid) a national
insurance number, it’s not good enough. “Brute force” attacks like those described above are usually the second line of attack against properly-stored passwords: first, a robot will
try every word, name or date that it can think of, with and without capitalisation and with numbers before and afterwards. Many will also try common phrases like “iloveyou” and
“letmein”. WikiHow has a great suggestion about how to make
“random” passwords that are easy to remember.
Unique. Here’s the one that people keep getting wrong, time and time again. You should never, never, use the same password for multiple different
services (and you should be very wary of using the same password for different accounts on the same service). This is because if a malicious hacker manages to get your
password for one site, they can now start breaking into your accounts on other sites. Some people try to get around this by keeping two or three “levels” of passwords, for low-,
medium-, and high-security uses. But even if a hacker gets access to all of your “low” security sites, that is (these days, frequently) still a huge amount of data they have
with which to commit an identity theft.The other big reason to make sure your passwords are unique is that it makes it safer to share them, if the need arises. Suppose that for some
reason you need to share a password with somebody else: it’s far safer for everybody involved if the password you share with them works only for the
service you wanted to give them access to. Every person you trust is one more person who might (accidentally) expose it to a hacker by writing it down.Even if you have to memorise a
complex “master” password and keep in your wallet a list of random “suffixes” that you append to this master password, different for each site, that’s a huge step
forwards. It’s also a very basic level of two-factor
authentication: to log in to your Twitter account, for example, you need your master password (which is in your head), plus the Twitter suffix to the password (which is
written down in your wallet).
There’s been a wave of attacks recently against users of social networking websites: an attacker will break into an insecure web forum to get people’s email addresses and password, and
then will try to log in to their webmail accounts and into social networking sites (Facebook, Twitter, etc.) using those same credentials. When they get a “hit”, they’ll explore the
identity of the victim, learning about their language patterns, who their friends are, and so on. Then they’ll send messages or start chats with their victim’s friends, claiming to be
their victim, and claim some kind of crisis. They’ll often ask to borrow money that needs to be wired to them promptly. And then they’ll disappear.
In this interconnected world, it’s important that your passwords are good not only for your benefit, but for your friends too. So if you’re guilty of any of the “password
crimes” above – if you have passwords that are short (under 8 characters), simple (don’t use a mixture of cases and include
numbers), predictable (using dictionary words, names, dates, etc.: even if they include a number), or re-used (used in more than one place or
for more than one site) – change your passwords today.
SuperGenPass – a very good way to use a strong, unique password for every website without having to remember multiple
passwords. Free.
KeePass – a great way to use a strong, unique password for every site and service without having to remember multiple passwords.
Free.
LastPass – another great way to use a strong, unique password for every site and service without having to remember multiple
passwords. Free (or cheap, for the premium version).
Microsoft recently tweeted: “It’s not
often that we encourage you to stop using one of our products, but for IE6, we’ll make an exception”. This coincides with the launch of The Internet Explorer 6 Countdown, a website that tries to encourage people to drop this hideously old and awful browser in favour of better, modern,
standards-compliant ones, thereby saving web developers heaps of work.
That’s not strictly true; they’re encouraging people to upgrade to Internet Explorer 8 and 9, presumably, which are still a little lacking in support for some modern web standards. But
they’re a huge step forward, and everybody who’d like to stick with Internet Explorer should be encouraged to upgrade. There’s no excuse for still using IE6.
They’re even providing a tool to let you put a “Upgrade now, damnit!” banner on your website,
visible only to IE6 users. It’s similar to the IE6Update tool, really, but has the benefit of actually
being supported by the browser manufacturer. That has to count for something.
Will it make a difference? I don’t know. I’m frankly appalled that there are modern, high-tech countries that still have significant numbers of IE6 users: Japan counts over
10%, for example! We’re talking here about a ten year old web browser: a web browser that’s older than MySpace, older than Facebook, older than GMail, older than YouTube.
Internet Explorer 6 was released into a world where Lord of the Rings that would take you a long time to read, rather than taking you a long time to watch. A world where in-car
CD players still weren’t universal, and MP3 players were a rarity. Do you remember MiniDisc players? Internet Explorer 6 does. The World Trade Center? Those towers were still standing
when Internet Explorer was released to the world. And if that’s making you think that 10 years is a long time, remember that in the fast-changing world of technology, it’s always even
longer.
Just remember what Microsoft (now, at long last) says: Friends don’t let friends use Internet Explorer 6.
This week, I discovered Breakup Notifier, a whole new way to be creepy on Facebook. I mention it
because I just know that there are some of you out there who were waiting for this tool to be invented (and we’ll know who you are because you’ll be the ones to try to keep a
low profile by not commenting to say “ugh; that’s creepy”).
The idea is, as it says on the site, that you can tell Breakup Notifier which of your friends you’d be interested in, if only it weren’t for the fact that they’re in a (presumably
closed) relationship. If their relationship status changes, you get an email to let you know, so you can be the first to take advantage of the new situation. Like Ted
in The
Window, an episode of How I Met Your Mother: which if you’ve not seen yet, you should try.
I think that the developers of this site are missing an opportunity, though, to make a little cash on the side. All you have to do is to be able to buy “priority access” on the people
you’re interested in. If you’ve paid, then you get notice of a breakup in advance of other people who are interested in the same person but who haven’t paid. The amount of
advance notice is based on the difference in your bids: so if I’m stalking watching Alice, and so are Bob and Charlie, but I paid £10
and Bob paid £2, then maybe I’ll get a notification 8 hours before Bob, who get a notification 2 hours before Charlie. It’s all relative, so if I’m also interested in Eddie, who’s also
being followed by Frankie and Graeme, but we’re all on the free package, then we all get notified together.
As far as marketing’s concerned, that’s easy: just tell users how many others are watching the people they’re interested in! I suspect that more money would be made if
you don’t tell them how much the others have paid, but the whole thing’s as sociologically-complicated as it is skin-crawling. What happened to the good old days, when
you’d just keep pressing refresh on your crush’s MySpace page until they hinted that things might be rocky with their significant other?
I talk a lot. If you don’t want to listen to me ramble, and you’re just looking for the free deed poll generator, click here.
After Claire and I changed our names back in 2007, I actually took the time to do a little research into deeds poll (or, more-specifically in this case, deeds of change of name). It turns out that we did it the wrong way. We paid a company to do all of the paperwork for
us, and – while it wasn’t terribly expensive – but it wasn’t free, and “free” is exactly how much it ought to cost.
In the intervening years I’ve helped several friends to change their names via deeds poll (yes, “deeds poll” is the correct plural), and I’ve learned more and more about why the whole
process should be simpler and cheaper than many people would have you believe.
A deed poll, by definition, is nothing more than a promise signed by one person (it’s not even a contract – it’s got little more weight than a New Year’s resolution), on paper which
has straight edges. That’s what the word “poll” actually means: that the paper has straight edges. Why? Because back then, a contract would typically be cut into two on an irregular line, so that when the
two halves came together it would be clear that they were originally part of the same document – an anti-forgery measure. A deed poll, because it’s signed only by one person, doesn’t
need to be separated like this, and so it has straight edges.
That means that’s it’s perfectly legitimate for you to write, on the back of a napkin, “I have given up my name [former name] and have adopted for all purposes the name [new name].
Signed as a deed on [date] as [former name] and [new name]. Witnessed by [witnesses signature(s)].”
The problem comes when you send that napkin off to the Inland Revenue, or the DVLA, or the Passport Office, and they send it back and laugh. You see, it helps a hell of a lot if your
deed poll looks sort-of official. You ought to put some work into making it look nice, because that makes a world of difference when you ask people to believe it. That’s
not to say that they won’t laugh at you anyway – the Passport Office certainly laughed at me – but at least they’ll accept your name change if it has an air of authority
and is covered with all of the most-relevant legalese.
Behind the dozens of scam artists who’ll charge you £10, £20, £30, or even more to produce you an “official” deed poll (tip: there’s no such thing), there are one or two “free”
services, too. But even the best of these has problems: the site is riddled with advertisements, the document isn’t produced instantly, you’re limited in how many deed polls you can
generate, and – perhaps worst of all – you have to give them your email address in order to get the password to open the documents they give you. What gives?
So I’ve made my own. It’s completely free to use and it’s available at freedeedpoll.org.uk: so what are you waiting for – go and change your name! Oh, and it’s also open-source, so if you want to see how it works (or even make your own version), you
can.
Why? Well: I don’t like feeling like I’ve been scammed out of money, so if I can help just one person change their name for free who might otherwise have been conned into paying for
something that they didn’t need: well, then I’ve won. So change your name or help your friends and family to, on me, or just download my code and learn a little bit about Ruby, Sinatra,
and Prawn (the technologies that power the site). What’re you waiting for?
Oh yeah: I changed the look-and-feel of scatmania.org the other week, in case you hadn’t noticed. It’s become a
sort-of-traditional January activity for me, these years, to redesign the theme of my blog at this point in the year.
This year’s colours are black, white, greys, and red, and you’ll note also that serifed fonts are centre-stage again, appearing pretty-much-universally throughout the site for the first
time since 2004. Yes, I know that it’s heavier and darker than previous versions of the site: but it’s been getting fluffier and lighter year on year for ages, now, and I thought it was
time to take a turn. You know: like the economy did.
Aside from other cosmetic changes, it’s also now written using several of the new technologies of HTML5 (I may put the shiny new logo on it, at some point). So apologies to those of you running archaic and non-standards-compliant browsers (I’m looking at you, Internet
Explorer 6 users) if it doesn’t look quite right, but really: when your browser is more than half as old as the web itself, it’s time to upgrade.
I’ve also got my site running over IPv6 – the next generation Internet protocol – for those of you who care about those sorts of things. If you don’t know why IPv6 is important and “a
big thing”, then here’s a simple explanation.
Right now you’re probably viewing the IPv4 version: but if you’re using an IPv6-capable Internet connection, you might be viewing the IPv6 version. You’re not missing out, either way:
the site looks identical: but this is just my tiny contribution towards building the Internet of tomorrow.
(if you really want to, you can go to ipv6.scatmania.org to see the IPv6 version – but it’ll only work if your Internet Service Provider is on the ball and has set you up with an IPv6
address!)
I’ve been playing about with the beta of Firefox 4 for a little while now, and I wanted to tell you about a
feature that I thought was absolutely amazing, until it turned out that it was a bug and they “fixed” it. This feature is made possible by a handful of other new tools that are coming
into Firefox in this new version:
App tabs. You’re now able to turn tabs into small tabs which sit at the left-hand side.
Tab groups. You can “group” your tabs and display only a subset of them at once.
I run with a lot of tabs open most of the time. Not so many as Ruth, but a good number. These can
be divided into three major categories: those related to my work with SmartData, those related to my work with
Three Rings, and those related to my freelance work and my personal websurfing. Since an early beta of Firefox 4, I
discovered that I could do this:
Group all of my SmartData/Three Rings/personal tabs into tab groups, accordingly.
This includes the webmail tab for each of them, which is kept as an App Tab – so my SmartData webmail is an app tab which is in the SmartData tab group, for example.
Then – and here’s the awesome bit – a can switch between my tab groups just be clicking on the relevant app tab!
Time to do some SmartData work? I just click the SmartData webmail app tab and there’s my e-mail, and the rest of the non-app tabs transform magically into my work-related tabs:
development versions of the sites I’m working on, relevant APIs, and so on. Time to clock off for lunch? I click on the personal webmail tab, look at my e-mail, and magically all of the
other tabs are my personal ones – my RSS feeds, the forum threads I’m following, and so on. Doing some Three Rings work in the evening? I can click the Three Rings webmail tab and check
my mail, and simultaneously the browser presents me with the Three Rings related tabs I was working on last, too. It was fabulous.
The other day, Firefox 4 beta 7 was released, and this functionality didn’t work any more. Now app tabs aren’t associated with particular tab groups any longer: they’re associated with
all tab groups. This means:
I can’t use the app tabs to switch tab group, because they don’t belong to tab groups any more, and
I can’t fix this by making them into regular tabs, because then they won’t all be shown.
I’m painfully familiar about what happens when people treat a bug as a feature. Some years ago, a University Nightline were using a bug in Three Rings as a feature, and were
outraged when we “fixed” it. Eventually, we had to provide a workaround so that they could continue to use the buggy behaviour that they’d come to depend upon.
So please, Mozilla – help me out here and at least make an about:config option that I can switch on to make app tabs belong to specific tab groups again (but still be always visible).
It was such an awesome feature, and it saddens me that you made it by mistake.
When ancient Roman typesetters or web designers were showcasing a design, and didn’t want the content of the (dummy) text on their mock-ups to distract the client… what did they use for
their lorem ipsum text?
These are the kinds of things that bother me most when I’m doing typographic layout. That, and Internet Explorer’s consistently fucked-up interpretation of CSS.
On this day in 2006 I’d just come to the end of a long weekend of coding
and socialising. The code project was, of course, Three Rings, and Bryn and Gareth were helping out with the big push to make the
initial release Three Rings 2 a success.
Three Rings is, of course, a project to streamline the administration of helpline services (like Samaritans) by making it easier for them to manage their rota and volunteer resources. I kicked the project off back in 2002 (based on an idea that
Kit and I had discussed as early as 2000), initially only for Aberystwyth Nightline – with whom I was then a volunteer – but it quickly
spread and within a few years had become the de facto system for Nightlines everywhere. Later, my work with expanding and enhancing Three Rings comprised a part of my University dissertation.
Among the problems with that early version of Three Rings, though, was that it had never been designed to scale, and so eventually the time came to throw it out and develop a new one,
from scratch, in the then up-and-coming Ruby on Rails framework. Gareth was a huge help in the early
development, and Bryn got burdened with the task of coming up with a means to convert the data between the old system and the new system, migrating our users across: a horrendous task,
because the two systems used completely incompatible data storage mechanisms, and the old system was riddled with quirks and workarounds. This weekend, back in 2006, was the cumulation
of that work: Bryn hacking away on his Project: Rosetta system, a stack of Perl programs to translate the data… while Gareth and I made progress on redeveloping features
for the new system.
It wasn’t all work, though: we also all took a trip up to nearby Ynyslas, a little way North of Aberystwyth, for a barbeque on the sweeping sand dunes there. As my blog post for that
weekend reveals, this involved a fantastic prank in which Claire and I “hid” Jimmy by burying him under the sand, covering his face with an upturned cardboard box, and then frightening the shit out of Gareth when he –
having been told that Jimmy hadn’t come – lifted the box to find Jimmy’s disembodied head staring back at him.
Looking Forward
Since that day, Three Rings has continued to grow and expand – it’s now used by a number of charities nationwide, and exists as a company in it’s own right. Gareth and Bryn are no
longer directly involved with the project, but parts of their code live on in the system, ticking away in the background.
Ruth now plays a major part in the development of the system, and it actually formed part of her
dissertation, too, meaning that my dissertation (which Bryn still has, after he borrowed it to help him write Rosetta) was actually cited as a reference in another
document: something which pleased me inordinately.
Claire and Jimmy got together a year and a bit ago, and they’re now living together, still in Aberystwyth (not that you’d know from reading either of their blogs, slackers that they
are).
And we haven’t had a barbeque yet since moving to Earth, but weather-permitting, the
plan is to do so this week!
This blog post is part of the On This Day series, in which Dan periodically looks back on
years gone by.
I’ve recently undergone an ordeal with Easily, with whom a number of my domain names are registered, that involved a process so
painful and convoluted that I couldn’t help but share it with you. All I wanted to do was to change the WHOIS data on some of my domains, because they were horribly out of date. Here’s
the process that seems to be standard at Easily:
I log in to the Easily web site to change my WHOIS information. If this were any of the other domain name registrars I deal with, this would be the only step in the process, but
Easily don’t seem to think that their customers want this functionality, and so they don’t provide it.
I use the contact form to send requests that they change the WHOIS information, providing all of the information necessary to facilitate the change.
Easily e-mail me, informing me that requests have to be made by fax or postal mail. Muttering under my breath about this being a little like the dark ages, I send them a letter
spelling out my request. The letter also includes three characters from my password, which apparently is all it takes to impress upon them that I am who I claim to be.
Easily e-mail me, thanking me for my fax (it was a letter), and informing me that a change of ownership of a domain requires that a £15 fee is paid. I reply to point out that no
change of ownership has occurred; although my name and my address have changed, and I can supply proof of both if required.
Proof of these things isn’t required: my word as a gentleman is good enough, it seems. Easily change the WHOIS information, but mis-spell the name of my street.
I e-mail Easily to inform them of their mistake. Several days later, they e-mail me back to say that they’ve corrected the typo, along with a terse apology.
It turns out that they’ve corrected the typo, but somehow managed to introduce an even more significant one: now the house number is incorrect. I double-check my letter and all of
my e-mails so far to ensure that this mistake couldn’t possibly be my fault, and it’s not. I e-mail Easily back and request that they have another go at typing my address correctly).
A week passes. With no response, I wonder if I shall have to write another letter. Don’t forget that this is an Internet-based company selling Internet services. I send another
e-mail, asking whether the previous e-mail is going to be handled any time soon.
Easily reply, with no apology this time, stating that the typo has been corrected. I check the WHOIS records: it turns out that they’ve only corrected their (second) typo on one of
my domain names, and not on all of them. I write back to ask when they’re planning to correct the others, and list them.
We’re coming up on one month since this ordeal started. For reference, when I used GoDaddy to do the same operation, I had it done
within five minutes, and I could do it all online.
Easily have really, really gone down in my estimation.
In the unlikely event that I’m not the only person who uses SuperGenPass to manage my passwords and MicroB on Maemo on
my Nokia N900, here’s a few tips that I thought I’d share (they’re also valid on the N800 and N810
and “hacker edition” N770s, too, I expect):
You don’t have a Bookmarks Toolbar (where would you put it on a 3½ inch screen?), so once you’ve customised your SuperGenPass bookmarklet, you’ll need to click-and-hold on the
generated link, and then select “Add bookmark” to save it to your bookmarks).
Use it as normal: either fill your master password into the form and click your Bookmarks menu and select the bookmarklet, or select the bookmarklet and give it your master
password. Don’t forget when using complex forms or changing passwords that Maemo provides a full clipboard so you can copy/paste passwords around where the need arises (thankfully quite
rarely).
If you’re irritated by the “You have requested an encrypted page that contains some unencrypted information” warnings that you see when logging into SSL-secured websites (and the
fact that unlike desktop Firefox, you can’t turn it off from the settings), here’s how you disable it:
Agree to the warning page, if you’re presented with one
Type “security.warn_viewing_mixed” into the search box, or browse the properties list for that option
Select it by clicking on it, and tap the Enter key to toggle it from true to false.
I don’t yet know the reason for the fleeting “Maximum number of characters reached” message, but it doesn’t seem to impact on functionality of SuperGenPass. Does anybody else know
what it’s about or how it can be suppressed?
Today is a good day for the web. Internet Explorer
8, which actually has reasonably good standards support, is now more widely-used than Internet Explorer 6, which is horrific to code for (Internet Explorer 7 isn’t much better).
It’s always been hard to write good quality web sites that work in Internet Explorer 7 and below: generally, I’ve always taken the approach of writing sites to comply with the standards
and then to put in hacks specifically to address the problems introduced by IE6 and IE7. The sooner that we can disregard these browsers, the better.
Despite the stupid
marketing campaigns Microsoft’s been pursuing to try to increase adoption of IE8, I’m at least a little thankful that they’re apparently working. I’ll be so glad the next time I can
launch a site and not even have to think about using <!–[if IE 6]> conditional comments.
Have you seen the latest stupidity that the Windows Internet Explorer team have come up with? Ten Grand Is Buried Here.
The idea is that they encourage you to give up whatever browser you’re using (assuming it’s not Internet Explorer 8), calling it names (like “old Firefox” if you’re using Firefox,
“boring Safari” if you’re using Safari, “tarnished Chrome” if you’re using Chrome, and… “that browser” if you’re using Opera) and upgrade to Internet Explorer 8, and they’ll be giving
out clues on their Twitter feed about some secret website that’ll only work in IE8 at which you can register and win $10,000AUS (yes, this is an Australian competition).
After looking at the site in Firefox, Safari, Chrome, and Opera, I thought I’d give it a go in Internet Explorer 8. But it didn’t work – it mis-detected my installation of IE8 as being
IE7 (no, I didn’t have Compatability Mode on).
In the end, though, I just used User Agent Switcher to make my copy of Firefox
pretend to be Internet Explorer 8. Then it worked. So basically, all that I’ve learned is that Firefox does a better job of everything that Internet Explorer does,
including viewing websites designed to only work in Internet Explorer. Good work, Microsoft. Have a slow clap.
Downloaded your copy of Mozilla Firefox 3 yet to help them make the world record? I’ve been using Firefox 3 since the early betas and I’ve got no qualms about recommending it wholeheartedly. The
awsomebar is simply that: awesome, the speed and memory usage have become far better than the previous version, and the care and attention that have gone into the little things – like
the fact that it now asks you if you want to save passwords after you’ve seen if they were correct, not before – really do make this the best web browser I’ve ever used.
I’ve been impressed, again, by Dreamhost, who provide hosting for this and many of my other websites. During a fit of stupidity, I
accidentally rm -rf *‘d Abnib Gallery. For those of a less techy nature, I deleted it: pictures and site and all. Whoopsie.
So I thought: perhaps they have a tape backup or something. I filled in their support form, which asks lots of useful questions like “How much do you know about this?”, with options
ranging from “I don’t know anything, hold me by the hand,” to “TBH, I probably know more about
this than you do!” and a nice scale of rating the urgency, as well as indicating how many calls they’re dealing with right now and a link to an outstanding issues page.
Within half an hour I’d been e-mailed back by a tech support person, who explained in exactly the appropriate level of detail that hourly and daily backups (with grandfather-father-son
fallbacks) of everybody’s home directory are made into their hidden .snapshot directory. I took a peep, and lo and behold there was my backup. Very impressed.
Now, if only they’d improve the reliability and speed of their Rails hosting, I’d offer them a round of oral sex.