Flying Zombie Robots

Web 2.0 Architectures: What entrepreneurs and information architects need to know

2009-07-22T23:11:00.000-05:00

Web 2.0 Architectures is written by three authors and it shows. The book sways between discussion and dissection - addressing entrepreneurs, curious technologists and architects. It's inconsistent in its treatment of the material it chooses to add to its scope. Fortunately, this doesn't mean the book isn't useful to read or fairly enjoyable in parts.

Early on the authors take on the considerable task of explaining Web 2.0. They use an approach in which 1.0 applications are compared to their 2.0 successors or competitors. This approach does not work for several reasons.

The 1.0 application on display has evolved since Tim O'Reilly picked the contrasting applications a while ago. So there is no good benchmark to use. The authors point this out in several places, which makes the whole comparison more kludgey. Instead of an architectural analysis that is crisp, the comparisons devolve into feature discussions. So what defines Web 2.0? A set of features, the approach, its execution? The resulting discussion doesn't really come out and clarify Web 2.0 any more or less than available material on the Internet.

However some central themes to emerge in this discussion that are put to good use later.

The early discussions in this book are not dilineated from a technical perspective. There is no clear architectural model or patterns that are used to drive the explanations. Sure architectural patterns are listed, but they are not defined to begin with. So you have to go read up about them or have the knowledge beforehand. In either case, you may already end up knowing enough that the book may not be adding value.

The second half of the book presents a reference architecture for Web 2.0. Its a decent chapter, but not comprehensive. I was very unclear about how to utilize the information that was presented in Chapter 5.

Chapter 7, which talks about Web 2.0 patterns at a deeper level, is easily the most enjoyable chapter of the book. Like it predecessors, its not comprehensive, but it covers important ground.

Each Web 2.0 pattern is explained very well. There is a paragraph on the context in which the pattern should be utilized. There is material on the pattern's static structure and dynamic behavior and notes on implementation (these are a little thin for some patterns). A nice section on gotchas (called consequences) is also available.

The patterns covered in this book are:

Service Oriented Pattern
Software as a Service
Participation-Collaboration
Asynchronous Particle Update
Mashup
Rich User Experience
Synchronized Web
Collaborative Tagging
Declarative Living and Tag Gardening
Semantic Web Grounding
Persistent Rights Management
Structure Information

Some patterns are a little broad - for example, is Rich User Experience really a pattern or an expectation in the Web 2.0 context that consists of serveral, constantly evolving, well-understood patterns that encompass graphic design, usability and dynamic web programming? Fortunately, regardless of the approach, the resulting discussions in this chapter are all good ones.

Web 2.0 Architectures is a book is fairly easy to read - its written in an accessible way. There are some errors in a couple of diagrams, but for the most part the accompanying figures are spartan and adequate.

Elliot Jay Stocks' Sexy Web Design

2009-06-19T17:23:00.000-05:00

"Let's start working" says Elliot Jay Stocks at the end of Chapter 2, and I really enjoyed this book as soon as Chapter 3 began. But more on that later.

Sexy Web Design: Creating Interfaces that Work (SWD) is described as a book for a web designer - anyone 'responsible for the look, the feel, or the mood of a web site'. But SWD isn't a tutorial - wisely so - because this area is too vast to cover in any one book. Instead it explores the areas a web designer needs to know about in order to become successful at his or her craft. Particularly it focuses on those areas that you need to zero in on in order to create eye-catching web sites. In essence, SWD is a sitemap for web designers.

The first few chapters of SWD are spent explaining what sexy web design is and why its important. A few examples are used to embellish the points. Its the least compelling section of the book although I liked the idea behind dedicating a chapter to research (Chapter 2) - essentially guiding designers to look for inspiration in many places.

Happily as soon as Chapter 3 begins, Stocks' rolls up his sleeves - so to say - and goes about telling us what a good web designer needs to know - how to define the structure of a site using sitemaps, how to define pages using a wiremap and how to go from sketches to templates. In the next chapter, the pages are brought together under the topic of Navigation and Interaction. Stocks covers the different types of navigation that a designer needs to know about. He covers forms and audio-visual content.

All through these two chapters, Stocks' simply describes the landscape. The idea behind this approach seems to be that once a reader is familiar with what they need to know, they can decide which topic they need to know more about.

Chapter 5 is about aesthetics such as fixed width versus fluid width layouts, colors, imagery and typography. There is some coverage on how to develop consistency and make your site pop through the use of contrast.

Sexy Web Design is best oriented for web-savvy users and site builders who need to get sophisticated about site design quickly and efficiently. You'll need to supplement this material with a lot of more in-depth information. But reading the book is a great way to kick start the exploration.

Stocks explains how to do sitemaps, wireframes, design of pages, navigation and interaction in Chapters 3 and 4. These are great for identifying areas you can go dig into later - depending on where you need most expertise.

In one long Chapter (5), Stocks tackles aesthetics - covering topics such as fluid width versus fixed width layouts, color, imager and typography.

As a sitemap of web design, Stocks' book is very valuable. You will need to find additional material for deeper dive into the topics covered here.

Sexy Web Design: Creating Interfaces that Work is published by sitepoint

Book Review: The Manga Guide to Databases by Mana Takahashi

2009-02-11T21:35:00.015-06:00

In The Manga Guide to Databases (TMGD), Ruruna is the princess of a faraway land called the Kingdom of Kod and she has a bit of a problem. Her parents have left her in charge of Kod’s famous fruit export business. And managing the data related to the prices and sales is getting the good princess all down.

TMGD is somewhat curiously structured. It’s not as much a guide to databases as it is an introduction to relational databases. Instead of explaining database concepts and the utility behind it clearly, author Mana Takahashi takes an early dip into database constructs such as normalization and Structured Query Language (SQL).

Because Takahashi gets into database nitty gritty early, she doesn’t have time to build a really good introduction to her characters or the core benefits behind building databases. You have to come convinced of the utility of databases before you read the book.

Having said that, once the characters have grown on you – the story cruises along nicely and even the hard stops by way of text chapters don’t derail it. The narrative is not innovative but it has a mythical charm to it.

To organize her fruit business, Princess Rurana has help from her childhood aid Cain. Things pick up when Cain opens a mystery book sent by the king by mail. The book is, conveniently, a tutorial on databases. But it comes with its own instructor – a Tinker Bell like fairy called Tico who is only visible to Cain and Rurana.

Tico quickly convinces her students that relational databases are the way to go. She teaches them how to build a database and then how to normalize it. Soon Rurana and Cain are designing databases. By chapter 4, they are knee deep into SQL (which is the strongest and most readable chapter of the book).

The book is wrapped up by a couple of chapters that are more in line with what one might expect from a Manga Guide. Chapter 5 talks about some operational aspects like Security, Optimization, ACID transactions, Disaster Recovery and Query Optimization. The final chapter explains how databases are used in every day applications.

TMGD is illustrated by Shoko Azuma, who relies on classic Manga sketches and emanata to evoke emotions. TMGD is translated from Japanese and because of the way Azuma has rendered it, clean up and translation is cleaner than say The Manga Guide to Statistics. But I did wish that emanating text had been a bit more dynamic instead of static.

All in all, TMGD is a fun way to learn about databases and core concepts, but it’ll require a few leaps of faith.

Book Review: RESTful .NET by Jon Flanders

2009-01-25T11:51:00.000-06:00

As Jon Flanders explains early on in his enjoyable book, Representational State Transfer (REST) is a set of guidelines on how to architect your web applications. Because it is tightly aligned with HTTP, architectures that follow the principles of REST are able to hook into a number of benefits that come built into the technologies that surround the web.

Flanders delves into REST briefly, but he does it well enough that you understand its value even if you haven't consumed the groundbreaking book RESTful Web Services.

The transition to programming REST using .NET is just as nicely handled. Windows Communication Foundation is a sprawling technology precisely because it is a model that covers a wide variety of programming paradigms (it supports a multitude of protocols like messaging, HTTP, SOAP, etc).

There is a quick tutorial on implementing HTTP services using WCF - which serves to remind us that WCF isn't only tightly coupled to SOAP. The rest of the book is divided up into chapters that zero in on specific implementation using WCF: Read-only services, Read/Write services, RESTful services and Feeds. Flanders also covers both server side implementation and client-side consumption of the services. There is coverage of Ajax and Silverlight clients and a short chapter on using WCF Workflow to deliver the REST services.

The value of the book is that it zeroes in on the essentials and provides very lean tutorials

RESTful .NET's biggest strength is that it is concise, clear and lean. To that point, you need the basics of HTTP, SOAP, WCF, XML, C# and (briefly) ASP in place to fully appreciate the book. The most valuable chapter for me was the one in which Flanders covers programming feeds. But there is enough diversity in terms of types of constructs implemented, that you'll find something of value here.

Highly recommended if you are a Windows Web programmer and have a growing interest in REST.

Book Review: The Manga Guide to Statistics

2009-01-06T07:57:00.000-06:00

Shin Takahashi’s The Manga Guide to Statistics A Manga Guide to Statistics contains – as advertized – both Manga and Statistics. What exactly is Manga? It’s a style of drawing that was birthed and refined in eponymous Japanese comics. Its characterized by a heightened display of emotions (think: plenty of emanata), hip characters and dramatic framing. But above all, Manga characters look cute – often achieved by drawing large eyes that dominate a face and denoting the nose and mouth with minimal lines.

There is plenty of cute in Takahashi’s book – courtesy of crackerjack illustrator Iroha Inoue.

The Manga Guide to Statistics has a loose plot that drives exploration of the subject of Statistics. Rui is a schoolgirl, prone to flights of romantic fancy and subject to bouts of panic around Statistics. One fine day her father brings a colleague home – the dashing Mr. Igarashi (characterized by bright eyes and wispy, long hair). Igarashi gives Rui an informal introduction to Statistics. And in an effort to win Igarashi’s heart, Rui pesters her father to arrange for lessons for her.

This her surprised father does dutifully. Only Rui’s instructor is the geeky Mamoru Yamamoto. This setback only spurs Rui on to really focus on mastering the subject. Tremendous lessons ensue that introduce Rui to concepts like Frequency Distribution, Mean, Median, Standard Deviation, Estimation Theory, Cross Tabulatiions, Normalization, Standard Scores, Probability, Corelation and Hypothesis. Will Rui learn Statistics and win the love of Mr. Igarashi? Can Mamoru keep up with Rui and help her complete her mission? Hey, is Mamoru really that bad looking?

The Manga Guide to Statistics has lovely, crackling illustrations. Inoue keeps the reader engaged with panels that burst with energy, drama queen depictions of mood and spanking fashion and style. Often a lot of text and numbers enter the comic because the nature of the subject demands it. But overall, you don’t lose the accessibility of a comic book.

In what I thought was a stroke of genius, Takahashi shows us how to apply the concepts in the book using Microsoft Excel. This makes a lot of sense because Excel is either widely accessible or functionally mirrored by other software (such as say: Google Docs).

The inherent accessibility of its comic book format makes The Manga Guide to Statistics an able introduction to Statistics as well as a handy reference for those who want to revisit the subject.

Harald Mante: The Photograph

2008-05-30T12:02:00.009-05:00

Harald Mante's The Photograph (Rocky Nook, 2008) - translated from German by Thomas C Campbell III is my first text on picture composition and design. I've read books about the technologies involved with photography and books that explain why a particular photograph really works.

But Mante's book explains the principles behind good photographs. And the value of this is that it gets you past understanding why a particular picture looks good and into how you can replicate the success of that photograph.

How exactly does Mante go about doing it? He breaks his large book down into the basic elements of interest in a picture. There are five major sections on photo composition in the book dealing with points, lines, shapes, universal contrasts and color contrasts.

Take the first section on points. Mante starts by discussing pictures with a single point of interest and how its position can change the perception of a photograph. Then he introduces additional points, carefully explaining how collections and groups adds perception options to the composition.

All through his text, Mante deploys copious photographs - some almost thumbnail size. I found this to be hugely useful because it gave me lots of data points for each of the principles described by Mante. There are multiple elements at play in each of the pictures, but instead of explaining all of them at once, you tend to focus only on the ones being described. This allows the reader to understand the mechanics contributed to the picture by the immediate principle alone.

In the next section Mante explores the use of lines (real and perceived) in photographs. By the time the next section rolls around on shapes, the book really pops because you can see how the various elements of points, lines and shapes are interacting within a photograph.

What I enjoyed most in the final two sections on contrast is that while the discussion can tend to be obtuse, Mante offers a lot of practical details. In one instance Mante talks about how wide-angle lenses and long-angle lenses contribute to contrast in a picture. We all know that happens but Mante articulates it in a way that it is reusable by photographers.

All wide-angle lenses support the impression of spaciousness on the two-dmensional surface by exaggerating the perspective and the sizes of the objects between the foreground and background. Long focal-length lenses can convey impressions of depth only by contrasting the sharply reproduced detail in the plane of focus with the blurred, out-of-focus background or by showing shapes that overlap ambigously.

This level of practical details is excellent.

I had some minor problems with the book. While I appreciated the photographs in both quality, volume and relevance - I wish they had been captioned exclusively to drive home the underlying principle. Because Mante describes theory, the book tends to be difficult to read in long stretches - so I would recommend keeping aside enough time to absorb the information in it.

Book Review: The Digital Photography Companion

2008-04-07T19:51:00.005-05:00

Derrick Story's book - The Digital Photography Companion - is sized conveniently enough, like a slightly oversize mass market paperback. And the intent is obvious. Story wants to create a manual that is easy to take along with you pretty much wherever you go (hint: vacations). He follows it up by writing in a conversational style and includes lots of bright color pictures that further increases the reader's engagement.

Story covers both digital SLRs and compact cameras. And in an excellent opening chapter, he explains the major differences between the two. Some part of the audience for this book might find the information on image sensors to be too technical - and for them there is enough practical advice to help choose a camera. But for those looking for a more in-depth explanation, this chapter is a great hook.

Right after that Story lays out the features and functionalities of digital cameras in alphabetical order. This I felt put the book in camera manual territory. I own an old Canon Powershot G3 and while Story was describing the features (somewhat mechanically) I felt his book offered no more value than my manual (which is very well written by the way and a text that this book squarely competes with).

Once we are past this alphabetical cataloging, the book really starts to shine. How does it do that? By offering lots of practical advice on how to create take great pictures, sometimes by replicating studio settings with low-tech contraptions. For example, Story shows you how to devise your own light meter, shoot in rain, bounce light off household reflective surfaces and trick your camera's white balance.

Besides being very useful, these tips also offer terrific insights into how the digital camera works. It enhances your understanding of the instrument you are working with.

Later the book also contains a useful chapter on how to post-process your pictures using software. Story covers a number of popular packages such as Apple iPhoto, Adobe Photoshop and Lightroom and Microsoft Expression Media. I would have really liked to see Story cover some web based image editing applications in order to get in touch with Web 2.0 technologies. There is also coverage of printing your pictures - a detail in the book that I really appreciated. And instead of trying to cover printer features and explain how to choose a printer in depth, Story keeps the focus on the camera by creating a short table with specific printer recommendations for different types of users.

LinkedIn RSS Feeds

2008-04-01T13:43:00.004-05:00

LinkedIn - which has been rolling out features of late - has just announced RSS feeds for network updates. If you are a LinkedIn user I recommend you try it out to stay informed of what is going in your network.

You can check your network updates using a on-site page generated by LinkedIn (try clicking on this link to see yours). You can subscribe to LinkedIn RSS feeds by clicking on this link.

New Blogger resources for pictures

2008-03-21T16:48:00.002-05:00

If you're a blogger like me and looking for pictures to brighten up your posts, there are a couple of new resources I've found in the last week that look really promising.

First there is compfight. Its a search tool that will take your keywords and dig through all the tags, file names and relevant information on Flickr and return the results to you. There are several things that are cool about this search compared to others I've seen that mine the Flickr repository.

compfight does a good, fast job at searching. It returns results in the form of a set of thumbnails - which makes selecting the right result to view much easier. This is along the lines of some search tools like Exalead that return thumbnails in a results set. In addition you have the option of searching through images that are under a Creative Commons license, thus reducing your exposure to unwanted usage of images.

The other tool is picapp which lets you search their own repository. You can use any image returned through picapp's search in your blogs freely. They have a lot of high quality stock images and also a number of more popular pictures as well. For example, if you did a search on Aishwarya (Rai), you'd get a number of images that you can plug into your posts without worrying about copyright violation.

A command based program launcher

2008-03-08T19:53:00.005-06:00

If you have a Start Menu that is full of programs, you're probably just as frustrated as I am when it comes to starting them. You have to click on the button, then scroll up and down trying to find the group folder you want.

This need to hunt programs down from weeds of stuff results in all kinds of program launchers being devised for quick starts. However, if you want to launch something which you use only occasionally and isn't in the launcher (because they are constrained by real-estate), then you are stuck with the old problem.

Recently I started using Enso Launcher from Humanized. This utility in essence indexes the program names in your Start folder and makes them available for recall via typing instead of clicking.

The way you use it is pretty simple: you keep the Caps Lock key pressed down and start typing the name of a program you want to launch. Say I want to launch Adobe Illustrator, I hold the Caps Lock key down and type in Adobe. At this point the Enso Launcher will start suggesting names based on keyword matches with the programs in your Start folder.

You can either type out the full name or type in enough characters to narrow down your choice to a few and then scroll and pick the right one. The only awkward thing about this is that you have to keep the Caps Lock key depressed all the time you are doing this. This can lead to some funny accidents. But the only other option would be to launch the Enso Launcher first (or give it focus - thus requiring it to run somewhere on the desktop).

With a key recall, it can run invisibly and pop up only when called on. The choice of the Caps Lock key is a good one once you get past the idea that you have to keep a key down during its operation. For those of us who know have learned to type via instruction - this works very well although I would think hunt and peckers might have a rougher time with it.

In any case, I'm glad I found the utility and I'm only too happy to use it.

A brief glossary from Hacking: The Art of Exploitation

2008-03-02T14:37:00.000-06:00

In his introduction to spelunking for system hacks, Hacking: The Art of Exploitation, author Jon Erikson outlines a number of techniques for the readers. While his treatment is thorough and essential reading to understand how the hack works, I've outlined the majority of techniques listed in his book in glossary form.

GENERALIZED MEMORY TECHNIQUES

Buffer Overflows
Inject a piece of code in a program buffer, causing it to overflow and transfer control to the injected code. When the corrupted piece of memory is a variable on the stack, this is called a Stack-based Overflow. Buffers allocated on the heap can also be subjected to the same corruption. So can the BSS segment by overflowing function pointers.

Format String Vulnerability
This particular exploit is related to using a function like printf in an unprescribed way such as printf(text) instead of printf ("%s", text). When text contains a format parameter, printf will add to the frame pointer to reference memory in the preceding stack frame. Thus, %s can be used to read from arbitrary memory addresses and %n can be used to write to the same. Code injection is now possible.

In addition two techniques: Direct Parameter Access using the $d feature of printfs and Short Writes using the %h feature can be used to simplify reading and writing memory addresses with this exploit.

Overwriting .dtors
This technique involves overwriting memory reserved for destructor functions (the .dtors section which is writeable) to spawn a root shell.

Overwriting the Global Offset Table
The GOT contains a jump entry for the exit() function. Overwriting this function in memory can be used to spawn a shell.

NETWORKING

Network Sniffing
A network device can be set in promiscious mode to sniff packets sent to other computers on an unswitched network. Useful information (say a username and password from someone logging on) can be obtained in this way.

Raw Socket Sniffing
A programmatic technique to sniff packets at layers below 5 (session) in the OSI model. Somewhat unreliable in terms of capturing packets and requires logging in as root, but useful if session layer sniffing is not possible.

libpcap Sniffing
Using the cross-platform libpcap make life easier when sniffing raw sockets.

Active Sniffing
This technique - used on switched networks where packets are only sent to specific MAC addresses - involves inserting a proxy system between two MAC addresses and intercepting packets that go between them. The proxy system sends spoofed ARP replies to each MAC address (ARP cache poisoning).

Denial of Service
This form exploits put the system under attack in a state where it is unable to respond to requests from legitimate users. This can be done in two ways: by crashing a service via program exploits or by flooding a service with so many requests that it runs out of resource to handle them all.

Denial of Service - SYN Flooding
This technique exhausts the "reliable" connection states maintained by TCP/IP by flooding the system with SYN packets from a spoofed nonexistent source address.

Denial of Service - The Ping of Death
An ICMP echo message is sent with a payload that exceeds the permitted 65k of data. Although this is an old vulnerability that has been fixed it tends to show up in newer protocol implementations such as Bluetooth.

Denial of Service - Teardrop
This attack sends fragmented IP packets with no overlap, which is expected by all systems. However some systems do not check for this error condition and can crash.

Denial of Service - Ping Flooding
A deluge of pings is sent to a system, thus making it too busy to respond to any other requests.

Denial of Service - Amplification Attacks
Ping Flooding can take a lot of resources to maintain. Instead using spoofing and broadcast addressing a single stream of packets can be sent to a number of hosts with a spoofed address of the system under attack.

Denial of Service - Distributed DoS Flooding
A basic ping flood but launched from a large number of compromised systems in order to increase the deluge to the system under attack.

TCP/IP Hijacking
Carried out from the same network as the system under attack, the TCP packet sequence number from the header is spoofed (after discovery via sniffing by the attacker) and sent to gain trust with the system under attack.

TCP/IP Hijacking - RST Hijacking
This form of hijacking involves injecting a Reset packet in the header.

TCP/IP Hijacking - Continued Hijacking
The attacker sends a spoofed data packet to the host with a bogus sequence number. This causes the entire sequence incrementing and acknowledgment to get out of sync, causing a hung connection at the system under attack.

Port Scanning
This technique involves figuring out which ports are open, listening and accepting connections on the system under attack. This is usually a non-destructive way of getting information about where system vulnerabilities can be exploited by determining which network services are available on the system under attack.

Port Scanning - Stealth SYN (or Half Open) Scans
A SYN packet is sent by the attacker and the response (a SYN/ACK packet) from the system under attack is examined for validity. When validated it indicates a port that is open for business. A RST packet is sent to the port for a graceful shutdown of the sequence - thus leaving the system under attack none the wiser.

Port Scanning - FIN, X-mas and Null Scans
Three ways to find out if a port is open for business. A nonsensical packet is sent to every port on the system under attack. If the port is listening, the packet will be ignored and lost. If the port is not listening, the attacker will get back a RST packet.

Port Scanning - Spoofing Decoys
This is a actually a countermeasure to avoid detection. The attacker simply hides attempts at port detection between connections from decoy IP addresses, thus making it harder to pin point the attacking IP.

Port Scanning - Idle Scanning
This involved port scanning technique is also a countermeasure that makes the attacker's IP undetectable. In this technique the attacker uses an idle host machine to perform proxy port scanning on the system under attack.

Port Scanning - Proactive Defense (shroud)
The author presents a number of defensive techniques to prevent accurate port scanning by an attacker.

SHELLCODE

Shell-Spawning Shellcode
Various techniques to transfer execution to shellcode in a program that spawns a shell.

Port-Binding Shellcode
Once spawned, the shell needs to bind itself to a port and listen for incoming connections.

Connect-back Shellcode
Port-binding shellcode is easily foiled by firewalls. In that case, shellcode that initiates the outbound connection (not filtered by firewalls) and spawns a shell can succeed.

COUNTERMEASURES

In order to avoid detection after an exploit, a number of different things need to be considered. For example, your IP address can be logged in a file and traces of this must be erased or obfuscated. In addition, the loss of service itself might alert the system administrator of an intrusion - in which case the author shows an example of how to perform an exploit and keep the service running so no one is wiser.

CRYPTOLOGY

Man-in-the-middle Attacks
The attacker sits between two systems both of whom believe they are communicating with the other. The attacker maintains two separate encrypted communication channels with two encyrption keys with each system under attack. This form an attack starts by redirecting traffic with a known technique like ARP cache poisoning.

Password Cracking
User passwords are hashed one-way, it is mathematically impossible to reverse the hash. When a user enters their passwords, the value is hashed again and compared to the pre-hashed stored value for authentication.

Password Cracking: Dictionary Attacks
In this technique, every word in the dictionary (potentially) is run through a one-way hash and compared with the user's password. User passwords are stored somewhere and must be available to the user in encrypted form first. If a match is found, the word hashed from the dictionary is the user's password. Custom dictionaries can be made using different languages, standard word modifications and appending numbers to words.

Password Cracking: Exhaustive Brute-Force Attacks
This is an academic technique in which every possible combination of words in a dictionary are used to compare with a hashed password in order to find a match. The sheer number of possible permutations makes this technique an unrealistic one in terms of yielding a result in a reasonable amount of time.

Password Cracking: Hash Lookup Table
A variation of the exhaustive brute force attack but all the hash values for words in a dictionary are precomputed and stored in a lookup table. This technique requires gobs of storage and only works for one salt value.

Password Cracking: Password Probability Matrix
In an effort to balance storage space required beforehand and computational power required at the time of the hack, a lossy form of compression can be used to create an inexact hash table. In this technique, each password hash will map to several thousand precomputed values which are then converged in real-time.

Wired Equivalent Privacy (WEP) Attacks

WEP Attacks: Offline Brute-Force Attacks
First a few packets are captured over wireless and then an attempt is made to decrypt them using every possible key. A practical cracking method has been devised that reduces a 40-bit keyspace down to 21 bits.

WEP Attacks: Keystream Reuse
A keystream is an encrypted seed that is used to produce encrypted packets. It consists of a WEP key and an Initialization Vector (IV). The encrypted packet is produced by XORing the plain text message with the keystream. If two packets have been encrypted with the same keystream, then XORing these two packets will yield the two plaintexts XORed with each other. If one plaintext is known, the other can be recovered.

WEP Attacks: IV-based Decryption Dictionary Tables
Once the keystream is known (using the technique above) it can be used to decrypt other packets with the same IV (IVs are 24bit). A table of keystreams can be saved for each IV and all subsequent packets can be easily decrypted.

WEP Attacks: IP Redirection
In this technique, an attacker will receive an encrypted packet from the access point and send it right back after modifying it to ensure the checksum remains the same. The attacker must know the destination IP address (which can be determined via keystream reuse due to IV collisions). The access point will decrypt this packet and send it back to the attacker's IP.

WEP Attacks: Fluhrer, Mantin, and Shamir (FMS) Attack
This commony used attack against WEP takes advantage of weak IV values that leak information about the secret key in the first byte of the keystream. Erikson's book contains a detailed explanation of how this attack works.

Book Review: Hacking: The Art of Exploitation

2008-03-01T11:47:00.000-06:00

In the preface to his book Hacking: The Art of Exploitation, author Jon Erikson does a crisp job laying out the counter argument to letting the art of hacking flourish unfettered by artificial legalities. "There's nothing good or bad about knowledge itself; morality lies in the application of knowledge". Being unfamiliar with actual hacking techniques (beyond what I chuckled at in Die Hard 4), this happened to be a really good way to begin the book.

Its important to understand what this book tries to cover. Erikson covers specific hacking techniques. He stays close to Linux and C to illustrate the techniques and he exploits a lot of open source software. The goal is to familiarize the reader with the different modes of exploitations.

Later in the book (Chapter 6), he explains: "The state of computer security is a constantly changing landscape...if you understand the concepts of the core hacking techniques explained in this book, you can apply them in new and inventive ways to solve the problem du jour. Like LEGO bricks, these techniques can be used in millions nof different combinations and configurations. As with art, the more you practice these techniques, the better you'll understand them." Clearly, Erickson is passionate about the subject matter he covers in his book.

Any ability to exploit vulnerabilities requires a thorough understanding of the underlying subject. Here Erikson's book offers a number of quick primers on topics such as C programming and network protocols. These introductions are valuable because they introduce the subject and give you deep dives into specifics. They give you some sense of how hacking can lead to a greater understanding of the system under exploit. For example in Chapter 4, Erikson goes from introducing us to the OSI model to socket programming in four pages. But because of a very engaging writing style, it doesn't feel like a hurried course.

After the introduction in which he covers C programming language basics, Erikson introduces us to exploitation via a buffer overflow example. He covers network hacking techniques such as denial of service, TCP/IP hijacking and port scanning. He delves into the more involved topic of spawning shell code to gain control of a system. And in a very entertaining Chapter 6, he shows you how to bypass security measures that detect and track hackers. In the final chapter, he covers hacking techniques for cryptography.

Given its structure, Hacking is part introduction, part handbook. If there is one recommendation I would make, it would be to embellish the source code with figures. The issue here is that you have to read through reams of code to understand how the hack works. Which is as it should be, but when you are reading about a particular hack, it breaks the flow of thought considerably.

Instead if the code could have been explained with a flowchart or pseudocode and the hack shown with a diagram, the reader would get a quick understanding of how the hack worked and would be better positioned to work through the code. In addition, the book could address a wider audience - especially those that are interested in learning more about hacking without necessarily being hackers themselves.

Google Health (and Marissa Mayer)

2008-02-28T13:26:00.006-06:00

Marissa Mayer who, besides being one of the early Google employees and now VP of Search & User Products, released a first look at Google Health on the official Google blog today. Its got some rudimentary screen shots that, coupled with Marissa's description of the service, tells us a little about it.

(More on the curiosity generating, high profile Marissa Mayer in GoooGirl from San Francisco magazine).

Basically its a way for users to manage their own health records and history. Based on the menu selections on one screenshot, Google Health provides for a way for you to track your medical conditions, prescriptions, medications, allergies, procedures, test results and immunizations.

You can import medical health records from participating health professionals and organizations. This is where Google will need to set up agreements with health care providers. But given their clout, there is not a daunting task.

There are several things that are neat about this.

The service seems to be coming at a time where satisfaction with health care in North America is reaching new lows. And since health is a highly private matter, most users will want to be in control of their records themselves. Besides, lets face it, with doctors specializing and the only good doctors around being specialists, the best doctor to piece your health together is you.

The service will address the fastest growing age segment in the US, which is senior citizens. Most people in the 50+ age group tend to be value shoppers but given value, which this service would provide, they are willing to spend money.

The potential for advertising and cross-selling is huge and allows Google to deliver targeted advertising in a special market segments like pharmaceuticals and medical services.

OneCAT: The 120 mpg air-powered car

2008-02-14T15:09:00.005-06:00

BBC reports that India could soon see a car that runs on compressed air and runs an impressive 120 miles per gallon. The car is called OneCAT, the inventor is frenchman Guy Negre and the development deal is being backed by Tata, makers of the recent and highly newsworthy Nano.

The car will be driven by compressed air stored in carbon-fibre tanks.

The tanks, built into the chassis, can be filled with air from a compressor in just three minutes - much quicker than a battery car.

Alternatively, it can be plugged into the mains for four hours and an on-board compressor will do the job.

For long journeys the compressed air driving the pistons can be boosted by a fuel burner which heats the air so it expands and increases the pressure on the pistons. The burner will use all kinds of liquid fuel.

If the car becomes reality, Tata will have exclusive distribution rights.

Mikkel Aaland's Photoshop CS3 RAW

2008-02-12T12:46:00.000-06:00

The outstanding thing to note about Mikkel Aaland's book Photoshop CS3 Raw: Get the Most Out of the Raw Format with Adobe Photoshop, Camera Raw, and Bridge is that is organized very systematically. Instead of providing a breathless description of everything you can do with the software, Aaland focuses on why you would do something and how to do it. Its an effort that is fun to read and easy to reference.

Each page in the book has two-thirds of its horizontal are dedicated to screen shots and pictures. Often, menus and tabs are broken out and overlaid on the images to explain procedural instructions. A third of the same page is devoted to text. The text and pictures are lined up really well so that you don't have to endure a lot of flipping back and forth.

Sometimes this layout leaves little space for some detail that would be enlightening. But in keeping with the spirit of the book, Aaland applies the same level of consistency to the amount of information he provides - which focuses on the digital photography instead of digital processing or photography itself.

The first chapter contains a really neat, concise explanation of what RAW files. A highlight of this is that Aaland dissects the pros and cons of using RAW files in a very practical way - concluding that both RAW and JPEG has a place in the lives of a professional photographer (and even provides some nifty examples). This really drew me into the book. I also liked Aaland's segue on how to use a color target in a quick and dirty way to level set your camera's color processing.

Chapter two shows you how to use Adobe Downloader to grab pictures from camera to computer. Chapter three shows you to organize them using Adobe Bridge. This chapter also contains a nice explanation of picture metadata and why it is important (for example for checking exposure which Photoshop doesn't have a tool for). Aaland then shows you how the basic workflow of editing a photoshoot in RAW.

Aaland also quickly runs through the options (space, depth, size, resolution) and tools (navigation, zoom, hand, white balance, color sampler, crop, straighten, retouch, image orientation) in Photoshop for processing RAW files. This is mainly a feature walkthrough, but Aaland does digress occasionally to offer insights (such as using the crop tool to create a panorama).

Later you learn how to distribute tone across a picture. Aaland explains how to interpret the color histogram, pick a suitable color space, map tone and how to adjust clarity, saturation and hue. Each topic covered contains material on why each setting is important. Although it doesn't dig into the details of how Photoshop applies the effects to each picture, there is just enough explanation to make you savvy about using these settings.

My favorite chapter was Chapter 8 on Sharpening where Aaland starts off with an excellent discussion of how Photoshop sharpens images. (A lot of the textual material here is reused from the Lightroom Adventure book.)

Finally there is a really useful chapter on how to convert RAW files to black and white. Aaland shows the simple conversion process from color to grayscale but then adds a number of useful lessons, among them: how to use the color sliders to darken or lighten certain areas of the grayscale image, how to add special effects like grainy film and cross-processing.

Live Mobile Cricket Scores

2008-02-11T15:58:00.001-06:00

There are several ways to stay in touch with cricket if you are on the move and have a mobile handy. I'll list the services I've used mostly (and they work pretty well).

Yahoo
This is a non-interactive SMS service. SMS the keyword "cri" to 58243 and you will receive an SMS with scores from all international matches being currently played.

The SMS cricket service itself is free although you will incur regular SMS charges from your operator.

This service doesn't work in the US.

If you are stateside and want to check scores on yahoo, you should hit their UK sports sites for cricket scores on: http://eurosport.yahoo.com/cr/sc/. This is not optimized for a mobile screen but if you can scroll past the headers, you get a pretty good snapshot of all recent international matches. (Note: you'll need an operator data plan for this).

Cricket Companion
To download this application to your phone, point your mobile browser to http://www.getjar.com. Then click on the "Quick Download" link. Enter 22776 in the code and click Next. You'll be directed to a link to download the application to the Mobile.

Cricket Companion is a Java application. For a full list of phones that are supported, check this site - basically any phone with Java support. (Note: you'll need an operator data plan for this).

Cricinfo
Cricinfo provides a free wap site for scores at: http://wap.cricinfo.com/. You can look at both live scores and previous results. (Note: you'll need an operator data plan for this).

Mobicast
This Plusmo application is my personal favorite. It allows you to look at scores and ball-by-ball commentary all from within an easy to use Java application. Download from http://ci.plusmo.com. (Note: you'll need an operator data plan for this).

BBC
Point your mobile browser to http://www.bbc.co.uk/sports. Then click on Cricket and then Latest scores or Results depending on what you want to check.
Scores link: http://news.bbc.co.uk/sport2/hi/cricket/scorecards/default.stm
Results link: http://news.bbc.co.uk/sport2/hi/cricket/results/default.stm
Not well optimized for mobile use but pretty decent.
(Note: you'll need an operator data plan for this).

Book Review: Mikkel Aaland's Photoshop Lightroom Adventure

2008-01-29T09:10:00.000-06:00

Mikkel Aaland's tutorial of Adobe's next generation digital photography application is called Photoshop Lightroom Adventure, and its a high-concept spin on a photography expedition to Iceland that resulted in a book.

The idea behind the expedition - Aaland's brainchild and sponsored primarily by Adobe - resulted in a team of photographers spending time in Iceland during summer. The idea was to shoot pictures and then bring them back for processing in Lightroom, thus unlocking its potential. The project also served as a test bed for the application - resulting in a number of tweaks and features that were incorporated into Lightroom eventually.

Aaland starts the book by introducing his team with pictures and thumbnail bios - this is a nice touch and allows you to get a feel for the virtual team of authors who provided material that went into the book.

As far as the book goes, its a fairly conventional tutorial - but the layout makes it stand out. Filled with colorful pictures on glossy paper, Lightroom Adventure is part coffee-table book, part technology tutorial. Its pages are divided horizontally into thirds: a third is devoted to text while the other two thirds are reserved for screen caps and photographs.

Its a format that is hugely engaging to read. Periodically Aaland will break with a two page splash of a particulary striking photograph shot by someone on the team. It is embellished with something personal about the photographer and the circumstances under which the picture was taken. The pictures may interrupt the flow but actually do a stellar job of integrating the book under the Icelandic Expedition theme.

Because all the pictures used by Aaland also have the same theme, they hold the tutorials together really well. Of course, it helps that the pictures themselves are gorgeous, taken by a highly competent and creative team of photographers.

This brings us to the intended audience of the book. In his forward Aaland identifies his audience as "Anyone...be they an amateur photographer or a professional". And here lies one of the problems with the book. There is coverage of a lot of complex photography (and digital photography) concepts. But they are skimmed over assuming the reader understands them.

In a section on digital sharpening, Aaland explains why the number 25 is the default for the sharpening amount. "Every RAW file is subject to a demosaicing algorithm that includes purposeful blurring. This blurring helps prevent color fringing by slightly blending adjacent pixels." Huh?

For the most part the sections are pretty crisp and engaging although there were times when a little more explanation would have clarified the picture, so to say. The section on sharpening, mentioned above, is outstanding in its balance of "how to" and "how does it work". But several other sections aren't as fortunate in their treatment.

The book also covers impressive ground in terms of exploring and explaining the features of a complex application. There is coverage of virtually everything you'd like to know about Lightroom - which pretty much encompasses all the recent advances in PC-based digital picture processing. Thus the book is also a really good tutorial of the subject as well.

The second half of the book contains a chapter called "Develop Recipes from Iceland" in which Aaland takes one cool treatment of a photograph and breaks it down step by step. This is the closest the book comes to in terms of helping you understand when to use the many slick features provided by Lightroom.

I closed the book having thoroughly enjoyed it, but also wishing the collective experience of the talented team had been harnessed to provide some invaluable tips on digital photography along with its processing in Lightroom.

You can try Adobe Lightroom for 30 days by downloading a copy from this location.

Book Review: Learning ASP.NET with Ajax

2008-01-11T21:03:00.001-06:00

Built on top of the .NET framework, ASP.NET is Microsoft's flagship technology for building web applications. By tightly integrating it with Visual Studio, which remains the premier development IDE across all platforms, Microsoft has made ASP.NET a compelling technology.

The important thing to understand about O'Reilly's Learning ASP.NET 2.0 with AJAX is its guiding purpose. As stated in the preface: "What is the quickest way for me to build real web applications with the least handcoding?" In essence its a beginner's guide to ASP.NET and in that, it remains true to its purpose throughout the book.

Aligned to the purpose, the authors (Jess Liberty, Dan Hurwitz and Brian MacDonald) focus heavily on the tool used to build ASP.NET applications - Microsoft Visual Studio (or Visual Web Developer). All the code is in VB.NET. This bothered me a bit initially because I program primarily in C#, but while going through the book, I realized that this barely slowed me down in terms of understanding the code. In fact, translating some of the examples into C# was not only a breeze but kept my eyes from glazing over.

I'll get one more issue with the book out of the way: its treatment of Ajax is cursory, primarily coming in Chapter 3. And its tightly bound to its usability within Visual Studio. Given the goal of the book, this is fairly consistent because the authors resist digressing into a discourse of Ajax and instead stick to integrating Ajax into the overall ASP.NET tutorial.

This singularity of vision is the strength of this book and makes it a pleasure to read. It comes with some really good samples and code discussions, and it guides you through the major features of ASP.NET as exposed by Visual Studio. At some points I did long for some real-world discussions (what are the cons of using Master Pages, for example).

The book covers useful ground for beginners: there is a chapter on maintaining state, one on interacting with a database, another on errors and exceptions, yet another rather useful one on security and personalization. Again, because the book is a starter course in ASP.NET, the authors keep it light, expecting you to fill in the gaps yourself. Everything you learn in the book is tied together in the end in the final chapter where you read about building a basic commerce application. (The author's don't cross-reference material from individual chapters, however).

Learning ASP.NET with Ajax is an excellent text on table stakes ASP.NET. Its very well organized and contains a good balance of text, pop out tips and source code.

You can download ASP.NET here and the AJAX extensions here. Visual Web Developer, which is a web-centric version of Visual Studio, along with the .NET 2.0 framework is available for a free download here.

Designing Web Navigation: A book review

2007-12-08T18:24:00.000-06:00

Early on in his impressive book - Designing Web Navigation (O'Reilly Media, 2007, Technical Editor: Aaron Gustafson) - author James Kalbach carefully and precisely introduces us to the fundamentals of web navigation.

This isn't a book in which the author has thrown in a grab bag of his experiences together and presented them with splashy graphics. Instead, Kalbach breaks out concepts, often presenting conflicting points of view (he mentions Alan Cooper's call to dispense with navigation entirely) and embellishes it with research from the fields of usability and human factors. This approach makes the book feel academic but it doesn't take away from the readability of the text at all. (In fact, it would make a pretty good textbook for a related course)

At one point in the initial chapter, Kalbach quotes research from usability expert Jared Spool that suggests that users who use Search to find a page in a web site are much less likely to browse the site than if they found the page using the site's own navigational aids.

This point is a critical one because it underpins Kalbach's focus on navigation. You can rely on Search to get users to your page, but the search engine now becomes the navigation of choice for the users - it has no vested interest in keeping users on your site. If you want your web site to be sticky, then design great navigation.

A little later when explaining the types of navigation and constructing key questions to formulate when designing navigation, you have the epiphany that this book isn't just about web sites. Instead it is laying down the paradigm for the flow of any application - networked or otherwise.

All through the first part, Kalbach's ability to dig into the details and anticipate the curiosity of the reader holds up well. Thus, right after listing the different mechanisms of navigation (paging, tabs, breadcrumbs, etc), he talks about some uncommon forms of navigation and ties them to the browser's own navigation mechanisms (back button, bookmarks, etc).

In Part II, a framework for navigation is presented. In the two early chapters in this section: Evaluation and Analysis, Kalbach talks about taking a step back at the beginning of a web design project to ask some key questions about the site under design. Evaluation and analysis techniques are discussed but importantly a systematic way of conducting preliminary research for the site is presented.

In the chapter on Architecture, we learn how to lay out navigation concepts, information structures, organizational schemes and site maps. These form the blueprint of the application flow. The stress on these aspects is important. As software architects have known for long, time spent up front is cheaper than time spent correcting things later (if they can be corrected at all).

Two more chapters round out this section: one explains layout and the other digs into presentation via typography and color. The treatment here is cursory but gives the user a fair idea of what is involved. A suggestion would be to bolster the references at the end of each chapter with some books that provide a detailed practical treatment of these topics.

Newer technologies like Ajax are changing the level of interactivity built into web sites. And in doing so, they are opening up new ways to navigate content. Kalbach doesn't forget to address this in his final chapter. But this is a newer area and the body of research isn't of the same density. Most of this chapter is spent discussing some of the newer techniques, their advantages and some common pitfalls. There are useful examples to go peruse to observe a noted technique. As Ajax pervades web sites - and given that this is an important text I would like to see around for a long time - I hope Kalbach integrates his final chapter into the rest of the book in later editions.

Each chapter is accompanied by a brief list of questions. These have been well thought out - I found myself reading and thinking about most of them and it actually helped me revise the material collated from the book up to that point. There is a list of references also and each book suggested is accompanied by a few lines that describe its relevance and importance. If you collect all of these, you will end up with an impressive list of reference material on related topics - and most importantly you'll know when to break each one open.

Congratulations also to O'Reilly and the book's design team. Color and white space are balanced beautifully in the book. The font (Hoefler Gotham) is crisp, clear and easy to read. My only nitpick would be that the color of the smaller headings is a little light - which caused me to miss them on several occasions. The graphics look consistent and sharp, the binding is excellent. I'm not a huge fan of break-out boxes but they've been done well here.

Book Review: The Unofficial LEGO MINDSTORMS NXT Inventor's Guide

2007-12-02T11:58:00.000-06:00

The really neat thing about David J. Perdue's enthusiastic and systematic starter guide for Lego robot fans - The Unofficial LEGO MINDSTORMS NXT Inventor's Guide - is that it incorporates a number of practical, essential things you need to know. But it does this without making the task of building robots feel intimidating. In other words, its a book that makes you want to get off your chair and start building Lego inventions.

A lot of the book's readable style comes from the progressive way in which the material is presented. Perdue starts by introducing the various parts in the kit and giving an overview of how these are put together and programmed. This is followed by an introduction to the various pieces - a breakdown of the NXT, servo motors and various types of sensors. By digressing briefly to explain how these parts may be used, this chapter gets your juices flowing.

Just as importantly, Perdue then lays out the physical TECHNIC pieces and explains how these are used. This gets specific - various pieces and their capabilities are explained, giving you the ability to address them using specific terms (clearing up a lot of communication if you are building this with a friend - or a child).

Later, there are short paras with pictures on how to combine these pieces to create standard constructs in robots - wide beams, corners, angles, dynamic structures, etc. This bit of practical advice presented in menu form up front is a great idea because later as you are building the robot, you get to recognize the design pattern you are using.

Finally a discussion on constructing gears to transfer motion and an introduction to the NXT-G programming language brings you to the invention projects. The walkthroughs on the projects are fairly engaging to follow. There are step by step instructions how to build the physical robot.

The accompanying pictures are pretty clear but I've always had problems with the progressive building steps. In this book there are a couple of embellishments that really helped. First, each step has a picture and count of the parts added in that step. And sometimes there are arrows to show how the insertion of those pieces takes place. In fact these help so much that I'd have liked the arrows to be there in every picture and perhaps formatted in a different color for clarity. In more complicated robots, portions are built separately and then put together in an effort to organize the complexity.

In terms of the accompanying programming, Perdue simply shows the program in a breakout figure. The program is commented briefly enough that you know what various blocks might be doing. You can download all the programs for the robots from Perdue's web site. This is a cursory approach but its forced by the limitations of having to explain a graphical program.

There are seven major bots in all - there are robots with wheels (zippy-bot), legs (guard-bot) and even one with a turntable using an ultrasound sensor (golf-bot).

Also be sure to check out the Amazon site for the book where Perdue has added pictures of selected bots with notes.