Stock Model -- What??

I saw an ad today on a city bus for co-location hosting. It said the name of the company, what it did (like “[Something] Co-located Hosting”), and to the left had a picture of a guy standing with his arms folded, turned slightly, and smiling at me.

Besides being creepy having a grown male man smiling at me…

I want to go to the PR person for the company and ask:

“What does the stock model have to do with your business?”

“Are you assuming the market understands what your business is about, or is turned on by strange smiling men?”

“If your advertising department is incapable of portraying your business, how can I trust that your management team sufficiently understands the business enough to explain it to employees in the advertising department, let alone prospective customers?”

“And if your management team lacks an understanding of the business, how can I place my trust in buying your services?”

I think poor advertisements go beyond this. I personally think that any medium-large-sized companies should have their ads reviewed by a member or subset of the management team, since they do, and the ad will, be representing the company to people that may have never heard of it. How can they expect to get away with stuff like this and still be effective? Perhaps it’s time to re-think your marketing plan.

UPDATE: Oh yes, it was “Colocation with Confidence” — Utah-based Fibernet.

1) Drag a filter to the top of the list and replace "News Feed"

While this isn’t a perfect solution, it gets the job done, and it’s just a little trick that I don’t think many people know about.

2) Make sure "News Feed" is not the default filter.

To hide all the annoying quizzes that fill your news feed, you can just click “Hide” when you hover your mouse over it, and click “Hide [Application Name]” and do each one individually -or- you can hide them all the thousands of them at once. On the left side of your home page, there are a bunch of filters. You can see more if you click the “More” link below them. You can re-roder them how you want; just drag a new one to the top and then click on it.

Every subsequent Facebook homepage load will show that as the default. I choose to do “Status Updates” — but you can pick your own or create a custom filter (a friend list) and put that first.

When you’re done dragging, be sure that you click on it.

1. they don’t tell users of a maximum length for their password, or
2. they don’t know that their system has a maximum length restriction.

This is dangerous! If you’re a developer, you need to understand how your passwords are stored, and what the qualifications are for passwords! If there is a maximum length, it better be LONGER than 25 characters, especially if your system doesn’t allow special characters.

Let me give you a quick rundown on all the sites — that I can remember right now — that I’ve had severe password problems with:

• NameCheap
• Moniker
• DomainTools
• RackForce (fixed)
• Mint.com

First let me disclaim: I cannot recommend that you sign up at any of these sites for their services until their severe password flaws are fixed. I do not, nor should you, trust sites or businesses that let a component as critical as the authentication be fatally flawed. Let me explain each situation I had. NOTE: RackForce has fixed the issue as far as I can tell and I do recommend them to others.

NameCheap’s Stubbornness

In a support issue with one of my domains, I was required by the support rep to supply the last 4 characters of my password. (They have a “20 character” limit, which they do state on their site, and which I do follow to exactly 20 characters.) I immediately became concerned and inquired of my account’s security. Is the password hashed? Encrypted? If so, how come they can view it? What kind of permissions are there for that? Can they view the whole thing?

Despite these concerns, I opened KeePass (my password manager), copied the password, and supplied just the last 4 characters of my password. Their response was, “I’m sorry, but that’s not correct.”

” … ”

“… yes, it is. That’s the end of my password.”

“I’m sorry, no it’s not.”

Eventually this was taken up with their fraud department. Their email was:

“The passwords in our system are absolutely safe and secure. However, our representatives can view and check them for the verification purposes only. The amount of people who are authorised to do that is very limited and this information is *never* given up to the third-party, so there is nothing to worry about. We have carefully checked the chat log and found that the last four digits of the password which you provided in chat really were incorrect, seems that you confused something.”

Not possible, I said! I just logged in with that password. Something is wrong in their system. Unfortunately I cannot trust it now. I don’t know what to do about all my domains, yet. It’ll be pricey to transfer them away.

The issue remains unresolved.

Moniker’s Lack of Initiative

I registered a domain at Moniker (a big mistake) and was going to go manage it, but I couldn’t login. They had this strange login schema for the username and password. You had to login to a separate panel to manage this particular extension. So I typed my username and password as it instructed, but the password was incorrect.

No it wasn’t. I copied+pasted from the same source that logged me in to Moniker a few moments ago (like the NameCheap issue).

I emailed support. After a week I got one response: “Oh, sorry, the login process was slow and buggy for the first few days. It’s working now. Also, please remember that if your Moniker Password has any special characters such as !@$%, the system will not accept it and you will need to reset it to have only letters and numbers.” … so now they tell me that I can only have letters and numbers. They didn’t state that at registration, but good thing I chose not to use any special characters this time. Well the login still didn’t work. “It still is not working,” I replied, and after a week they replied automatically and said “Please respond to this ticket or it will close for inactivity.” — I was waiting for them! Grrr.

The issue remains unresolved.

DomainTools Blatant Lack of Basic Security

The issue here is simple. I went to register at DomainTools (shortly after whois.sc became DomainTools) and as I did, I noticed my password displayed, in plain text, in the URL bar, over a standard HTTP connection.

I quit the registration, cancelled my account, and informed them to find the incompetent developer that did that.

The issue seems to be resolved. I haven’t tried, though, and won’t be trying any time in the next 100 years.

RackForce Overlooks Password Restrictions

I’ve been a RackForce customer for a while, but have to move away from them to lower my costs. I’m pretty satisfied overall. However, their Customer Support Center (CSC) has an issue that the development team overlooked. I know exactly what the issue is, but they apparently have no idea.

I recently did a password change that appeared to be successful. I tried logging in later with it but could not. I double checked the username, password, and the fact that I copied it correctly from my password manager. Indeed everything was correct. So I sighed and just did “Forgot your password?” — sure enough, an email came with my plain-text password.

Not exactly a secure way to store passwords for a billing interface that manages your business account…

What’s more interesting is that the password was only about half my password’s length. It was cut off after the 16th character. It has special characters that didn’t seem to cause a problem, but it would have been nice to know that there’s a 16-character limit on RackForce CSC passwords. I informed them of this and cancelled my account.

Update: They have added “Max 32 chars” next to the password input fields. I guess they increased the maximum length too. I’m glad they resolved this.

Mint.com… where do I even begin… what a mess!

This whole Mint.com thing was a mess. You can take a gander at both of my complaints if you want. Basically, it was a huge disaster. Initially my password was fairly long and complex. I couldn’t login from the homepage, but I could from the “Log in” page. I couldn’t log in from my iPod Touch either (with their app). Once my password was shortened and simplified to a highly insecure level, I was able to fully access Mint.

After discovering this, I basically decided I can’t trust them with my financial information, so I pulled my data and closed the account.

The issue appears to still be unresolved.

At work, we’ve been trying to push out some updates to the Javascript implementation of one of our product’s APIs. It’s a few thousand lines of Javascript, and the enhancements we added changed the way a lot of little things work “here and there.” I started primarily using Firebug, and was satisfied for the first 45 or so seconds.

My conclusion? Firebug has got to be one of the buggiest, slowest, most difficult Javascript debugging tools. I’ve never really had a problem with Firebug to analyze styles, basic Javascript, and AJAX requests. But add a couple thousand lines of code and Firebug loses its appeal pretty quickly. I was frustrated with how often I had to debug the debugger. “Wait, what? My file doesn’t look like that.” or “Where did the breakpoint go?” and “How did it step into that Javascript line? It’s commented!”

Frustrated, I moved on to use Venkman’s Javascript debugger. It’s a little more archaic, but seemed worth a shot. This time I was impressed for a full 10 minutes. That is, until I reloaded the page and it started, literally, breaking the page load. Even pages without any Javascript would send the debugger into “Pause” where I have to hit the “Continue” button to continue loading the page, but then a moment later it goes back to the “Continue” button. I have to close the debugger to reload the page, set it up, then I can re-open it to start debugging Javascript. The “Watch” window was really buggy too. It would seem that watches would magically disappear, but still be visible, if that makes any sense. Venkman has some bugs of his own to work out.

I had hit rock-bottom! Two debuggers that needed more debugging than my incomplete Javascript project — not acceptable. Finally, I upgraded to IE8 and decided to try its new “Developer Tools” window, which includes a Javascript debugger.

I must say, I’m impressed. Microsoft carried over their Visual Studio methodologies and you can notice the similarities between its debugger and the one bundled with IE8. Why do I like it? It’s elegant, easy-to-use, and it works. So one kudo to Microsoft for their new IE8. Granted, it still renders the Javascript slowly (heck, IE6 ran the product faster in our testing than IE8 by almost 2x) — but its debugger is nicely done.

My recommendation? If you need to debug some Javascript, bite the bullet and just use IE8’s debugger. It’s worth saving the time to do that than to spend all of it debugging non-functional Javascript debuggers.

Epilogue

The product that I was developing is now rolled out. You can see a demo of it at Qualified Address’ LiveAddress product page. The demo is in the sidebar on the right. Try validating an address. If you get it close, it should suggest a perfectly-tuned, certified, and standardized address. If users butcher it really bad and our system can’t figure it out or verify it, they now have the ability to be notified of this and to go back and fix the spelling, or “just use the address [they] entered.” We think it’s pretty slick and you’ll like it. Give it a shot.

So please, if you really don’t care, say “couldn’t care less” from now on. It just doesn’t make any sense the other way. I always get confused when people say “Well I could care less!” …. so please think about that. Thanks!

Okay, so I hate taking surveys online. Mainly because they’re long, ugly, boring, and complicated. Especially ugly. And hard to use. And did I say that they’re usually ugly and hard to use?

Google Docs has an answer. You can make surveys or actually anything you want people to fill out and then Google Docs can aggregate the results into a spreadsheet — live — for you, and even chart the results.

View my sample survey to see the result.

So let’s see how this works:

1. Go to Google Docs, login, and click New -> Spreadsheet. In the spreadsheet, click Form -> Create Form.
2. From here, you can start filling out the question and answer sets you’d like to have (click to enlarge screenshot):

   

3. When you’re done with that, you can customize it a little more. Click More Actions – > Edit Confirmation. You can change the message displayed when the form is submitted. You can also “Embed” it to your site or blog under the same menu. If you want, you can email the form directly as an HTML email to any recipient.

   

4. Google supplies a link to the live form at the bottom of the Edit window, or you can click Form -> “Go to live form” in the spreadsheet window.
5. Once you link people to the survey or email it to recipients, they can fill it out and the results will be displayed on your spreadsheet. To view a result summary with charts, you just go to Form -> Show Summary.
6. Tada! Isn’t it pretty? You can try the sample survey I made if you want.

I don’t have much time. I’m just taking a break from my math homework right now… anyway, here’s my take. (Remember, VirtualBox doesn’t want to emulate my nVidia card, so the Aero effects aren’t going to display. What you get here in these screenshots is the basic visual theme.)

Click on any of the screenshots to enlarge them. Press “Back” to come back to this post.

The Windows 7 boot sequence is a little more elegant than the standard progress bar indefinitely moving on the bottom of the screen. Now these colored orbs fly in on the screen, meld together and glow the Windows flag:

The flag glows in and out for several seconds and then the login screen appears. It’s actually quite a nice display. Windows Vista’s is a little sketchy.

Okay then, after that I just installed Firefox and doddled around a bit, aimlessly taking screenshots of things people might find interesting…

Yes, for those of you that complained about UAC (even though you can just turn it OFF … derr), there’s an improved control panel for power over the notifications it gives you.

I’ll probably just keep it off anyway.

Hey look – Windows 7’s WordPad has a ribbon, just like Office 2007! Isn’t it cute!?

That’s right — for the first time since… 1996 … Microsoft has updated Windows Paint. Now sporting a new ribbon, Paint for Windows 7 also has a new selection of colors in the toolbar! Hurray! (If you’ve never seen FreeLoveForum’s parody on MS Paint, now’s the time to go watch it.) They must have spent years instead of months this time, in their facility in California, to decide which were the best 20 colors to add to the toolbar. Okay, honestly, it’s a lot better than the choices since Windows 95.

Unfortunately, Windows’ standard color chooser box is the same and still unchanged since Windows 95:

The Start menu hasn’t changed a lot… but the glow effect on the button is pretty:

The taskbar is more iconic. Also, the roll-overs on menu items is more of a pale blue effect than a translucent glass (even on Aero from what I understand) — Windows 7 does seem more “cartoonish” and less “glossy” to me. Which is perfectly fine. It still looks okay.

Windows Explorer is a bit different. I’ll let you judge for yourself. Notice the new icons, the way the folders are organized, and how there’s even more abstraction from the disk level. Microsoft anticipates most of its users to utilize features such as “favorites” and “libraries” or even their “Homegroup” (part of a Network) than managing files in the file system directly by going to the drive letter – which you can see is down near the bottom.

Large thumbnail view in Explorer is nice though.

And finally, the shut down is actually pretty quick.

That’s all I have for now. If there’s a specific feature you want screenshots for or a tour of, and can’t find it online already, or want something *really* specific, let me know and I’ll do what I can to post the screenshots of that.

Anyway, that’s Windows 7 so far… which do you like better… XP or Vista? And are you anxiously awaiting Windows 7?

I’ll update this post with details later but I so far I think it’s “okay.” Nothing more, nothing less at this point. Since VirtualBox can’t exactly emulate my nVidia card, Windows thinks it doesn’t have the resources for Aero. Oh well.  From the screenshots I’ve seen, the Aero interface looks clean and hasn’t been changed a whole lot.

I’ll post screenshots myself soon (give or take a week).

My first thoughts actually involve the perception of Windows 7 among the generally misinformed public. I will probably argue my case of Windows XP vs. Windows Vista and Windows 7 in another post at a later date, but I think one would be surprised at the results of a quick analysis of the public’s bias against Windows Vista.

Tune in soon for… Windows 7 screenshots, a quick rundown, and perhaps a separate post including my thoughts on the various versions of Windows.

Silly me. A very easy CSS attribute can hide all those annoying borders from your entire website. Just put this in your stylesheet:

:focus { outline-style: none; }

The site I’m working on redesigning now looks a lot more professional and fluent without those annoying borders.

As my Linux adventure continues on my x64 Fedora systems, I was ready to install Flash so I could actually use sites like Acrobat.com and Aviary.

Installation instructions for Fedora x64 (as a Firefox plugin)

1. Download the “pre-release” version of Flash for 64-bit linux at Adobe Labs. For the lazy in mind, the actual .so file in a Gzip archive can be downloaded using this link.
2. Extract the .tar.gz file (which is as easy as extracting a .zip file in Windows).
3. Copy libflashplayer.so file to your Firefox plugins directory. On my Fedora box, the command was:

   cp libflashplayer.so ~/.mozilla/plugins

4. That should do it! Restart Firefox and you’ll have Flash capabilities.

I had to turn my strings into hexadecimal form to find that there was a “hidden” character being printed on the web browser… bah humbug.

By the way – Merry Christmas. :)

My desktop has two extra hard drives: one internal and another external. They are both fully encrypted as well and store data archives and backups.

Click the image to view a larger version. Yellow boxes indicate encrypted volumes. Padlocks indicate new layers of security where passwords have to be typed or supplied. In Fedora, I chose to mount the NTFS volumes (the Windows partition and the two large data partitions) automatically using a shell script at startup. Yes, the password is in it in plain-text (I’m still a Linux n00b), but the whole thing is encrypted, remember? And if a perpetrator gets far enough into this boot process – especially on the Linux side – they deserve to get those passwords anyway.

Haha, so, it’s not quite perfect, and perhaps a little troublesome to boot, but it works. Really, the only security flaws in this set-up are:

• Potential software security holes (rare, unlikely, and preventable … keep software patched and updated?)
• The cold-boot memory attack demonstrated by Princeton (if the attacker is fast, has the resources, availability, and enough alone time)
• Once the volumes are already mounted (e.g. logged in on Fedora), an attacker can manipulate the data in the physical presence of the machine (or remotely if you don’t keep your firewall tight or software patched) — this means that if I walk into the bathroom for a moment and a guru Linux hacker walks into my room, my data is pretty much hosed unless I am done fast enough and am able to beat the guy to a pulp.

If any readers try this, I’d like to hear your experiences. Thanks for reading!

Anywho… I had done a lot of Googling and found a lot of different solutions. So many, in fact, that it was FRUSTRATING! And everything was old, even from Fedora Core 5 to 9, but nothing for 10. I guess something for 9 might work for 10 too, but all the things that were done to get MP3s working seemed complicated… going to su, modifying files, adding repositories, installing dependencies, woah.

Okay. Finally found something that required just one command in the terminal. It looks like I’ll be using RhythmBox to play music on my Fedora side, so I looked into that. Turns out that RPM Fusion has all the software that Fedora/RedHat aren’t allowed to ship. As a Linux n00b, this is a great find. Basically, RPM Fusion is a set of repositories that are able to provide packages for your Fedora or Red Hat system, including MP3 and video codecs. Sweet.

Their config page gives you the terminal command to run for your system to search for software packages at its repositories. Run it (as root). Afterward, any program (including yum and Add/Remove Software) will search through RPM Fusion’s repositories as well. Frustrated that RhythmBox could never find the MP3 package it needed, this was quite a relief. Now, I just tried playing an MP3 in RhythmBox and it found the packages automatically, including the dependencies, and installed them all with a few root authentications. After that, I ran the MP3 file again and it played.

This guide is for beginner-intermediate users. You can view a diagram of the resulting boot process in my later post here.

Goals

• The ability to boot into my choice of Fedora 10 or Windows Vista on my laptop at each boot
• All my data encrypted

Requirements

• A computer with at least one hard disk you are willing to wipe clean (BACK UP your data first!)
• Windows Vista installation DVD
• Fedora 10 (or higher) installation DVD
• Gparted LiveCD isn’t required, but it really helps when partitioning
• TrueCrypt 6.2a
  
• EasyBCD to modify the Windows boot loader (A free, small, and legitimate install – don’t worry. You can uninstall it later.)

Problems overcome by this method

• My notebook’s hard disk could only contain 4 primary partitions.
• Primary partitions are the only ones that OSes can be installed to (Windows, anyway).
• Primary partitions are the only partitions the system can boot from
• Each extended partition counts as a primary partition.
• 6 or 7 partitions are needed.
• TrueCrypt can’t encrypt an entire drive that has multiple partitions, OSes, and various file systems when it only runs on one
• TrueCrypt doesn’t play well with Grub or any non-Windows boot loader.
• Windows likes to be installed first and only on a partition flagged as “bootable” (or, if no partitions are flagged “bootable” at all)

How the boot loaders work together

• We install and use Windows’ default boot loader to the MBR. This is what the computer will boot to first.
• We install GRUB (Fedora’s boot loader), but not to the MBR. This will merely be available for us to boot to later.
• We install TrueCrypt which takes over the Windows boot loader. TrueCrypt’s boot loader goes into the MBR. On boot, the user will authenticate with TrueCrypt then be taken to the Windows boot loader where the option Vista or Fedora (technically GRUB) becomes available.

Instructions

1. Back up your data. You are going to wipe the hard disk totally clean and reformat it very soon.
2. Reformat the entire drive. To do this, I use Gparted LiveCD. If you don’t want to use Gparted, Fedora 10’s installer comes with a partition editor. But, it’s a bit trickier. You’ll have to partially complete the Fedora setup in order to get to it, apply the changes to the disk, then exit setup because Fedora shouldn’t be installed first. (Windows Vista’s partition editor is NOT powerful enough. You cannot use it for this.) I strongly encourage the use of a Gparted LiveCD or LiveUSB.
   I thought about how to split up my drive and after a while, I came up with this:
   

   Partition layout for dual booting Fedora 10 and Windows Vista with TrueCrypt

   I wish I had sized them differently now that I look back on it, but the setup is what’s important for this. Note the padlocks! Each padlock indicates an encrypted partition. The yellow padlocks with “TC” are encrypted with TrueCrypt in Windows. The blue ones are encrypted by Fedora. As you can see, each and every partition – except, of course, the /boot partition – is encrypted. Partitions labeled in red are for Windows. Black is for Linux.

   Okay, so this is a setup that works for me. Basically, you’ll need these things:

   • A primary boot partition to put Grub (the boot loader Fedora can install for you) – I recommend about 50 to 100 megabytes. Do not flag this as “bootable” when partitioning – Windows will complain.
   • An extended partition to hold all the “data” or “miscellaneous” partitions. This will hold your Fedora /home directory (basically the “My Documents” folder of Linux), Windows backup partition (optional), and your Linux swap file (very highly recommended). The swap file should be at least as large as your RAM’s capacity. If you can afford the space, I recommend double the memory, actually.
   • A primary partition for Windows Vista to be installed to.
   • A primary partition for Fedora 10 to be installed to.

   Partition your drive as such and be sure to format with the appropriate file systems. You can use the table above as reference.

3. Write down which partitions (in order) is formatted as what file system. If you can’t remember, you might be hosed. You’ll need to remember which partition numbers to use for what during the installs.
4. Start installing Windows Vista. You’ll be forced to do a custom installation. Choose the primary NTFS partition you reserved for the Windows install. Don’t forget to load hard disk drivers – especially on laptops. If your Windows install hangs around 70%, then you need to install the SATA drivers for your laptop. Once drivers are loaded and you select the right partition, install Windows.
5. After Windows installs, boot into it normally and finish setup. Don’t spend too much time customizing things yet. Once it is running, shut down and install the Fedora 10 DVD. Boot to that and install Fedora. However, take note of the following:
   • Be sure you do a CUSTOM LAYOUT for your partitioning. Fedora will want to wipe things and create its preferred partition layout by default. Don’t let it do this. Make sure you go straight to the part where you can view and modify your current partition information.
   • Don’t format the NTFS partitions. Windows is on one of them.
   • Be sure to set the mount point for the small partition (100 MB?) to be /boot. Check “Format as” and select “ext3.” You cannot encrypt this partition.
   • Set the mount point for the partition for your /home directory to… you guessed it: /home. Check “Format as ” and select “ext3″ then choose the “Encrypt” option.
   • Set the mount point for the partition for your swap file as /swap. Linux will have to format it and you should, of course, select “Encrypt.”
   • Set the mount point for the partition for your main Fedora install to be “/”. Check “Format as” and select “ext3″ then choose the “Encrypt” option.
6. Before continuing, ensure that neither of the NTFS partitions have a check mark next to them. If they do, they will be formatted and you’ll have to start over. Continue. Fedora will warn you it will delete all the data on the modified partitions. That’s okay. You may have to set your passwords now as well. Go ahead and do that.
7. Soon it will ask you about the boot loader. Tread carefully here. Do not write the GRUB boot loader to the MBR. When it says “Install the boot loader on/dev/sda1″ (the “sda1″ may be different) – keep the box checked but click “Change Device” and choose “first sector of boot partition” instead.
8. After that step, you should be home free. Finish up the install and reboot the computer. It will boot straight into Windows.
9. Once Windows loads, download and install EasyBCD. You’ll want it to easily modify the Windows boot loader. Add an entry to the boot loader: click “Add/Remove Entries” – choose the “Linux” tab, select “GRUB” from the dropdown, and name it something intelligent. Choose the partition that contains GRUB, not Fedora. I think this is most flexible. Leave the checkbox unchecked.
10. Add the entry then try rebooting. You should now be able to boot into either Fedora or Windows! Boot into Windows again and let’s encrypt it.
11. Install TrueCrypt and create a new volume. Choose “Encrypt the system partition or entire system drive.” From this point, you’ll have to choose the proper options. Read them carefully! I don’t remember the exact sequence, but you need to specify “Multi-boot” at some point. At the end it will ask whether Windows has its boot loader in the MBR or if a different boot loader is used (like GRUB). Remember: Windows’ boot loader is being used!
12. Once you’ve finished the volume creation wizard, you’ll be asked to “Test” the system. It will restart for you. It should boot into the TrueCrypt boot loader where you’ll type your password. After that, it should load the Windows boot loader where you can boot into either Fedora or Vista!

From here, finish encrypting the system partition, then remember to encrypt any other NTFS partitions you made for Windows.

When you’re done, try booting into Fedora. It should go to the GRUB boot menu where you can select Fedora or change your mind and go back to Windows. As Fedora boots, you’ll be asked perhaps several times for your password as it mounts the encrypted partitions.

Congratulations – your entire hard drive is now secure and running two operating systems that REALLY don’t get along. Now that’s an accomplishment! Go treat yourself to a cookie.