Flippin’ Around

February 24th, 2010

You know how at the end of Star Wars – Episode II, Attack of the Clones Yoda is attacking the evil Count Dooku, and he’s like flipping all over the place with his lightsaber and jumping around like crazy? Shaun White is just like that, but with a snowboard instead of a lightsaber.

Mobile Phone Service Contracts

February 22nd, 2010

I don’t like this whole business about “sign a contract for two years and we’ll give you a subsidized phone” (I touched on this a few months ago). It means the wireless carrier recoups the cost of your phone through your monthly fee, which means your monthly fee is higher.

However, when your contract ends you continue to pay the same price. Which means that, as a consumer, if you don’t upgrade your phone as soon as your contract ends then you’re effectively paying for something you’re not getting.

I would much rather pay full price for a phone up front, and have a monthly fee that reflects only the cost of the service and not the cost of the phone. And then consumers can choose to upgrade their phone whenever they wish. Be it after 1 year or after 4.

I recently learned that T-Mobile actually does this. Their service plans are $10 less per month if you don’t have a contract/subsidized phone. If you’re looking at buying a new phone and wondering if you should sign a new 2 year contract, you can look at the price of the phone with and without the contract. If you would pay less than $240 more for a non-subsidized phone, then in the long run you’re probably better off not signing the contract.

And T-Mobile is already cheaper than AT&T and Verizon. While I pay $60 a month for 300 minutes+400 SMS+unlimited data, Emily pays $75 for 450 minutes+200 SMS+unlimited data. And if we both continue to use the same phone after our contracts expire, mine will go down by $10 and hers will stay the same.

Thank you, T-Mobile!

Checklist for Keeping User’s Passwords Safe

February 15th, 2010

I recently wrote a series of blog posts about how we handle users’ passwords at Meebo: post 1, post 2 and post 3. Here’s a collection of that same information, distilled into a set of do’s and dont’s written specifically for developers of websites.

  • When accepting a user’s password on a web page, DO use https to serve all files that make up the page where the user will enter his password.
  • When accepting a user’s password on a web page, DO use a POST request to an https destination.
  • When using a password to authenticate a user, DON’T store the password in persistent storage in plaintext or any reversable format.
  • When using a password to authenticate a user, DO store a cryptographically secure hash of the password. NIST publishes a recommended list of hashing algorithms, with the SHA-2 family of hash functions being recommended for all new applications and protocols.
  • When storing the hash of a password, DO add a salt to the password before hasing. This salt prevents a hacker from using a rainbow table to reverse password hashes. More information.
  • When comparing two passwords for equality, DO use a comparison function with a fixed runtime to avoid timing attacks.
  • When forced to store confidential user information (such as passwords for logging into another service), DO encrypt the passwords using information not stored in persistent storage if at all possible. For example, encrypt the confidential information using the user’s password as the key.

Open Source Shout Out to WordPress

February 6th, 2010

I moved my personal web log from LiveJournal to a self-hosted WordPress. I don’t have any major problems with LiveJournal, they have served me well over the years. My reasons for switching:

  • Could not have multiple saved drafts
  • Did not have an RSS feed of a tag or category
  • Appearance was not customizable enough
  • Wanted my stuff to be less scattered across the web
  • LiveJournal is for some reason associated with emo middle schoolers

Let me just say that WordPress is incredible. Everything works perfectly. I was able to import all my posts and comments from LiveJournal with just a few clicks of their importer–and it was even fast! Installing themes, plugins and updates is amazingly easy. Even setting up pretty permalinks is totally automatic.

Well done, WordPress developers and contributors!

I also decided to overhaul the rest of kingant.net while I was at it. Mostly I deleted stuff that was old and silly, including my self-written content management system.

Mobile Phone Early Contract Termination Fee

December 20th, 2009

This really is a perfect idea: “Wireless carriers should define the early termination fee as whatever the difference is between the no-contract price and the subsidized two-year contract price, and prorate that cost over the 24 months of the contract.” (from this article)

Google Summer of Code Mentor Summit 2009

October 29th, 2009

Last weekend Google hosted their 3rd annual mentor summit, following the end of their 4th annual summer of code. The mentor summit is when a few hundred mentors gather together and participate in an unconference style conference. I went for the Pidgin project, along with Gary Kramlich and Ethan Blanton.

The conference was super cool. I got to be humbled by talking to a whole bunch of really smart open source people. Here are my notes:

On One Laptop Per Child (“OLPC”)

I’ve been wondering for a while whether the OLPC program could actually make a difference. One session, led by Bryan Berry of Sugar Labs, makes me think that it can and already has. Bryan is the co-founder and CTO of OLE Nepal, an organization helping deploy OLPC in Nepal, and creator of Karma, a framework for creating interactive activities for the Sugar environment using javascript and html5.

Seeing demos of the exercises they’ve created and hearing his first hand stories was pretty incredible. At least some schools in Nepal teach by having the teacher recite something (e.g. “one plus two is three”), and all the students repeat it and memorize. But this often fails to teach the students why one plus two is three. In one example a student was asked “what is one plus two” and they replied with “three.” But the same student was not able to answer “what is two plus one.”

Children in third world countries generally want to learn–more so than children in the US. They realize that education can help them achieve something greater in life. And computers are interesting to them. Combine students, computers, and engaging lesson plans about math, geography, etc. and the students will have a more varied education and will learn better.

On Forking Open Source Projects

  • Forking helps keep people motivated. It increases competition, keeps developers on their toes.
  • A fork could be like a “research and development” branch. People work on crazy fun new features in the forked project, and the good stuff gets merged back into the original.
  • The smaller the project, the more willing the maintainer should be to give people access. There is a natural inclination to be protective of your project–it’s your code, your baby. But you must be willing to give up control for there to be forward progress. This reminds me of dictator governments like Cuba/Fidel Castro and North Korea/Kim Jong-Il. The dictator is afraid to relinquish control for fear of what might happen.
  • Benefits of a fork? Developers have more freedom to do what they want, which allows for innovation. The best project will survive–if developers want their project to survive then they must make decisions that benefit the community at large.
  • Downsides of a fork? Development effort is divided. Users might not know which project to use. Distributors may not know which package to distribute; distributing both means work work.

Miscellaneous

  • STUN – A protocol used to determine your public IP by asking a server on the “outside” Internet
  • TURN – A protocol used to proxy traffic through an intermediate server. Written with SIP in mind. Increases the likelihood of being able to establish a connection to another party, but it also introduces an additional hop, which leads to lagginess, which is bad for voice/video communication.
  • ICE – A protocol that describes a method for establishing a direct connection with another peer. Written with SIP in mind. It uses an exhaustive algorithm to try every possible IP address for yourself in the hopes that one will work. You construct a list of your host’s IP addresses plus your public IP address determined by using STUN. This information, along with a fallback TURN server, is sent to the other party, who begins attempting to connect.
  • OpenAFS is under active development, and is used by some very large organizations
  • I should change my alias for grep to enable the color option
  • I should read Zen and the Art of Motorcycle Maintenance

On Trolling (this session was half intended as a joke)

  • I should read the UNIX-HATERS Handbook
  • I should read the Sokal paper
  • “Linus==troll”
  • “Version con-trolling”
  • “We had this problem where people had to download our software and type ‘make’” –Marty Connor
  • Adding support for the old school Unix talk command to Pidgin could be a fun April Fools joke

“Lemma” is Fun Word

October 22nd, 2009

Mark’s Theorem 1: If you’re trying to do something and not making any progress, do something else.
Mark’s Theorem 2: If you’re trying to do something and making lots of progress, keep doing it.

Android 1.6 and Credential Storage

September 24th, 2009

The SDK for the next version of the Android operating system, 1.6 aka “Donut,” was released last week. The SDK is the set of packaged files that developers use to create applications for version 1.6. Wireless carriers generally push the updated version to devices within a month or two of the SDK release.

I was pretty blown away by a few of the additions:

  • Battery usage indicator that shows which applications are consuming your device’s battery, out of a percentage of 100
  • Support for four varieties of VPNs: L2TP/IPSEC pre-shared key, L2TP/IPsec certificate, L2TP only, and PPTP only (see screenshots of configuration)
  • Device-wide search. Applications can provide search results. So if you search for a friend’s name, the Meebo IM application could return that buddy as a search result, and clicking the buddy could open an IM conversation with them.
  • Built-in text-to-speech APIs for applications. For example, the Meebo IM application could speak your incoming IMs if your device’s screen is not active.
  • Support for CDMA
  • Gestures

I’ve also noticed what appears to be a system wide password safe/keychain/credential store. Here’s a screenshot of some new options from the bottom of Settings –> Security & Location:

Screenshot of Android settings for credential storage

This should theoretically allow applications to store sensitive information in a secure way. However, this wasn’t mentioned in the release notes and the API documentation is “hidden,” meaning developers aren’t intended to use the classes yet. The classes are android.security.CertTool android.security.KeyTool android.security.Reply and android.security.ServiceCommand. These classes seem to only used by the Settings application for storing Wifi and VPN credentials.

I tested out the password store with the VPN and it seems to work well–I tried to import a .p12 file and it prompted me to enter the password to unlock my credential storage. I’m not sure if the authorization eventually times out.

I think Android needs a system-wide password storage facility pretty badly, and I really hope they publicize this API in the future. There exists an open source password safe called OI Safe which works well, but this really needs to be a part of the operating system so that applications can depend on it.

National Water and Power Login Information

August 27th, 2009

In this web log entry I complained about National Water and Power, but then I realized I have already complained about them.

As an addendum, if you forget your password they email it to you. Emailing someone their password is not secure, please never do it ever. This means they store everyone’s password on their servers effectively in plain text. What is it about utility companies that makes them suck so bad?

Edit: Here, check this out (click for full-size version). I’m supposed to read their Terms of Use freaking 8 words at a time. Thanks guys. All that extra space on the page and you couldn’t have made this box any bigger?

Screenshot of a tiny box displaying the National Water and Power website's terms of use

Comcast Hijacking DNS

August 13th, 2009

Comcast has started doing that thing where opening a totally bogus URL in a web browser will send you to a crappy search results page. More information here.

I hate this. Partially because it has the potential to break stuff and I’m the kind of guy who feels that standards exist for a reason. But also because it’s slow. I would rather see either an immediate error page or a Google Search, both of which are faster.

Yahoo’s IM formatting

August 5th, 2009

I’ve been working on instant messaging software for seven years, so I’ve been exposed to a lot of IM protocols. The “protocol” is the structure of bytes that gets sent back and forth between your computer and the IM service.

The major IM protocols (AIM, MSN, Yahoo, etc) are fairly well thought out and logical. But sometimes things go horribly wrong. An example that I recently learned about, and the impetus for this post, is the format used for Yahoo IMs. Here’s a handy pocket reference:

  1. Mixture of ANSI escape sequences and HTML
    Bold, italic, underline and font color are specified using ANSI escape sequences, but font size and font face are specified using the <font> HTML tag.

  2. HTML tags aren’t closed
    Subsequent tags just override the value of the previous tags. Message formatting is more linear than hierarchical. For example, “<font face=’Georgia’>test1<font face=’Courier’>test2.”

  3. HTML font tag size attribute is in points
    For example, “<font size=’14′>test.” Normally the size given in the font tag is a relative value between 1 and 7, with 1 being “small” and 7 being “large.”

  4. Special HTML entities aren’t escaped
    For example, if an IM contains a less than sign it is sent as “alien < predator.” Normally < > and & are written as &lt; &gt; &amp; in HTML documents so that programs can accurately determine if a < is the start of an HTML tag or is a literal less than sign.

    Why does this matter? It means the user cannot send this IM, because it is interpreted as a font tag instead of plain text: “<font size=’32′>Huge text.” This generally isn’t a problem for normal users, but can be a nuisance for web developers, who may want to IM that text to a friend and have it appear the way they typed it.

“Change of Address” Letter

August 3rd, 2009

I recently changed my address for my Health Savings Account with Wells Fargo. They mailed a letter to me at my new address that says, “If you did not request these changes or have any questions, please contact our Customer Service Center.”

Seems kind of useless. Maybe they should have mailed this to my old address?

An Open Letter

August 3rd, 2009

From: Yours Truly
To: Haynes Automotive Repair Manual for Honda Civic 1996-1998 and Acura Integra 1994-1998

Dear Chapter 11 Section 25,
I believe your step #5 to be somewhat misleading. It reads, “Remove the lower screws securing the sound insulator panel to the lower steering cover, then remove the steering column cover retaining screws (see illustration)” The first half of this step is accurate, and is correctly reflected in the picture. However, I have found that in a 1998 Acura Integra the steering column cover retaining screws do not need to be removed.

Also, your instructions should probably mention that there is a third screw behind the coin tray, and that the coin tray can be removed by depressing the two buttons on the top side of the coin pocket and folding it down all the way, then using a flat piece of metal such as a flat head screw driver to carefully but firmly lever the bottom left corner of the body panel away from the coin tray so that it pops out.

Thank you,
Mark Doliner

On Error Handling

July 29th, 2009

I just installed the Windows 7 Release Candidate in a VM. The VM restarted after installing some updates and showed this message:

Configure Windows features, do not turn off your computer.

Do not turn off your computer? Really? What if my power goes out? Will something break? Will it not recover automatically? Will it become unusable and I’ll be forced to repair it or something? Because that’s pretty shitty. It’s 2009–things like this need to be error proof. If you can’t handle that then get out of the operating system business.

Mouse

July 27th, 2009

I’m pretty selective about the stuff I use. For mice I prefer:

  • Wired, not wireless. I don’t like the extra weight/inertia of batteries. I don’t really see a benefit for my usage, and it seems like a hassle to have to charge or replace batteries.
  • Optical. Cleaning gunk out of a mouse wheel is tiring. Do they even make mice with balls anymore? I guess probably the males.
  • Reasonably high refresh rate.
  • I’ve never gotten into the habit of side/thumb buttons, and I tend to click them on accident more than on purpose.

For the past few years I’ve been using a Micosoft Intellimouse Explorer. It’s ok, but I had some problems with it (see the review for more details) so I decided to switch.

I’ve been using a Razer Salmosa for the past few weeks and I’m happy with it. For some reason the Razer company makes some really expensive mice. I don’t know what would justify a $129 mouse. Maybe it solves world hunger one click at a time.

A Bit About Me

July 5th, 2009

This is long and self-centered. You probably don’t want to read it.

  1. I value my time. Like, a lot. I’m pretty busy. From August through December last year I worked on average about 60 hours a week at Meebo, and somewhere between 5 and 10 hours a week on Pidgin (a lot of time was spent migrating to our new servers and reconfiguring services). I spent about 5 hours a week rock climbing and maybe 40 minutes running. I spent the rest of my free time relaxing with Emily, and I really value that time.
  2. I care about people, my country, and this planet.

These two themes affect my feelings on a lot of other things:

  • I despise spam. You have no idea. In my life I’ve spent hundreds of hours deleting spam email and configuring spam detection and filtering on mail servers and mail clients (thankfully gmail takes this burden away from me).

    Think of everyone else in the world who deals with spam on a daily basis. People clicking “delete” on spam in their inbox. Companies who sell spam filtering software and hardware. Companies who buy spam filtering software and hardware. IT staff who install and configure spam filtering software and hardware. Surely a significantly greater amount of money is spent trying to block spam than is earned by the people who send spam. People who send spam are parasites of society. They cause countless man hours to be wasted for their own gain. Think of what could be accomplished if all this time and energy was spent doing something worthwhile.

  • I don’t like wasting other people’s time. I try to be on time. I try not to ask other people to do things that I could easily do myself. I try to be as fast as possible whenever I’m in line at a retail store, bank, restaurant, etc.
  • I don’t like it when other people waste my time. Being late for meetings, being slow, being lazy, etc. Obviously some things are out of your control, and you really can’t hold those against people.

On Emily and my flight back from Raleigh to San Francisco on New Years Day we missed our connection in Atlanta because our flight was late leaving Raleigh. We were forced to spend the night in Atlanta, which ended up making us about 15 hours late getting home. There were 7 people total who missed the flight by only a few minutes.

But the annoying thing is that we could have been on the plane. We ran from our arrival gate to our departure gate. Three of us were there 5 minutes before the schedule take off time of the plane, and the other 4 weren’t much later. We saw the plane sit at the gate for maybe 10 minutes before it pushed back. Our luggage made it onto that plane, but because the gate attendants had already closed the door and were no where in sight, we couldn’t board.

That’s 7 people who were delayed 15 hours. No only that, the flight we were on the next morning was now oversold. Which means 7 other people were delayed. The airline paid for our dinner, a hotel, and breakfast the next morning. All in all that’s thousands of dollars wasted because the Delta employees working in the terminals in the Atlanta airport didn’t wait for the passengers who they should have known were coming. Ridiculous.

To say I was livid is an understatement. We waited in line for maybe 20 minutes to talk to the customer service lady to get our flight rescheduled and to get meal and hotel vouchers. There were 3 Delta employees in the area, but only 1 seemed to actually be doing anything. In fact, while we were talking with the employee who was actually useful, one of the other employees came over and complained about how long the line was. WTF?

I know the entire airline industry is doing pretty poorly, and part of me feels bad, but another part of me is like, “oh, no wonder.” Your uselessness is costing the airline industry money. And that trickles down to everyone. You may not have noticed but the US economy isn’t in real great shape. Maybe you should actually do some work?

Why I work on open source

July 5th, 2009

I haven’t written about this before, have I?

I think the world is better off with free software. I don’t have anything against closed source or non-free software, I just think typical development processes for free software produce better products in the long run. They produce something that meets the needs of users better, with less fluff.

And I guess I feel like I can have a positive impact on open source software. Working on Pidgin is like my way of giving back to the authors of all the other free software that I use.

And I take a lot of pride in the code that I write. It is a reflection of who I am. If I write something that’s buggy then it makes me look bad. So you don’t need to try to talk me into fixing something that I wrote, because I care regardless. I care a lot more than you do, believe me. And it pains me when I don’t have time to fix my bugs.

I really do have a lot of opinions

July 5th, 2009

I’m not sure there is a mobile phone provider in the US that I would be happy with.

  • AT&T – I was always happy with their service. But I feel like it’s too expensive. I also feel like it’s a mistake for them to waste money to only double the speed of their 3G network. I think AT&T and their customers would be better off if they didn’t upgrade their 3G network, reduced prices, and accelerated the launch of their 4G/LTE network.
  • T-Mobile – Their coverage is noticeably worse than AT&T where I live, and pretty much the entire way down Highway 1 to LA. In our old apartment on the corner of Evelyn and Mary in Sunnyvale I didn’t even have voice coverage. And 3G coverage is spotty everywhere. I do feel like their prices are reasonable when compared to AT&T. They might want to give up on 3G and instead launch LTE before AT&T and Verizon.
  • Verizon and Sprint – I don’t have personal experience with either, but CDMA? Come on. GSM seems more prominent in countries I care about. And while I don’t travel much and probably wouldn’t even use my phone overseas if I did, I think there is a lot of value to interoperability. I’d consider Verizon and Sprint only after they’ve switched to LTE.

And woo boy, I hate that unlimited data plans don’t unilaterally include unlimited text messaging. This is one of those things where carriers charge consumers because they can, not because the pricing model is fair. And while that’s a reasonable business decision (although aggressive), I find it really disrespectful to the consumer. Services should cost an amount proportional to the overhead it causes on the carrier. Twenty cents to send 100 bytes is insulting.

The unjust cost of SMS is my primary motivation to make a kick ass IM client for Android. It’s why I’m willing to work so hard on it. And why I won’t stop until I’m satisfied with the product.

“Hackers”

July 3rd, 2009

Just watched Hackers for the first time ever. Pretty entertaining. Decent soundtrack (or two or three?) Orbital, Underworld, a Massive Attack song with Tracey Thorn (although I don’t see it on any of those albums). A few mentions of the words “elite” and “leet” and someone uses the phrase “blowin’ up” with regards to his pager beeping–pretty early references in my mind (1995).

Pro Tip: If you want your movie to look silly in a few years, try adding a camera flyby that depicts the inside of a computer, and use as much neon as possible.

An Open Letter

June 7th, 2009

Dear California Government and US Federal Government,

Quit fucking borrowing money. It’s how you got into this mess. It might make things better in the next two years, but it’s reckless to assume you’ll magically be able to afford to pay back all your loans in the future. It’s also irresponsible to force your debt onto future generations. Suck it up and create a balanced budget. Cut spending, raise taxes, whatever.

I’m a 27 year old kid who tinkers with computers. You are responsible politicians and this is your job. Please stop screwing up.

Yours,
Mark