Mad, Beautiful Ideas

ChromaHash: Not As Dangerous As You Think!

2009-11-06T18:44:07Z

The ChromaHash module I’ve submitted to the YUI3-Gallery got hit up on Reddit this week, which incidentally is the second time ChromaHash has been discussed there. And this time around, the discussion was just as negative this time around.

First, a lot of people focused too heavily on the fact that the demo screen is a confirm password box, commenting that a simple checkbox confirming the password was the same would be sufficient. Of those who did recognize that this was meant to be used on a login page as well, we got the general reaction we get that since this gives any information about the password, then it’s wholly unacceptable, and it completely compromises the password security.

Now, Mattt Thompson, creator of ChromaHash for jQuery (and who’s module mine is based off of), has written a pretty good post outlining why this implementation isn’t as bad as the reaction we’re getting off of certain information security folks, and I’m not planning to reiterate his points (at least, not entirely), since I, as a person with great interest in information security, think that Mattt’s post is more than sufficient at making the point.

Instead, I’m going to talk a bit about some of the suggestions that have come out of the Reddit threads.

Salt Password with Username

Actually, this is a reasonable option, since it would ensure that users with the same password don’t discover that. There are a few implementation-level details, since we’ll have to tell chroma-hash where to find the salting value. The initial thought I have is making the salt object optionally take an array, where any element of the array that is a valid CSS selector, then I’ll take the value property of the node referred to by the selector and append it to the other elements of the array (as strings) to get the salt value. This does mean I’ll be recomputing the salt periodically, but I think there are ways around that (subsribing to the ‘change’ event for the node, for instance). This suggestion, I think, warrants some more consideration. Though really, password collisions should be pretty rare.

Could reconstruct password as user typed it.

This is really only an issue for slow typists, since in my implementation the color shifts take half a second. This ought to be user configurable, and it will be in a new release soon-ish. An alternative, that I’m not as convinced to it’s usefulness, would be to set a delay between the last keypress and the animation beginning. I might do this one, but again, I’m not convinced it’s useful.

Randomly salt password on pageload

Umm, no. This would make this tool completely worthless.

People are colorblind.

Yes, approximately 14.5% of the population has some color-related vision problems. But that means 85.5% of the population isn’t. And even the people who are color-blind can still glean information from chromahash, even if they’re more likely to encounter collisions. Plus, this is a non-essential tool, so it’s not like using chromahash prevents the color blind for interacting with your site.

Any information about the password is TOO MUCH INFORMATION

Actually, my favorite one of these is a guy who made a bruteforce for chroma-hash. Now, his example is kind of bullshit because he uses a crap password, so of course it’s fast, but it completely fails to take into account a few notes:

We’re using MD5 on the backend, which outputs 32 hexadecimal digits, of which we’re only using 6 to 24 (which is configurable by the ‘bars’ option). The collision space, particularly if you only use one or two bars, is non-trivial.
There are very few circumstances where an attacker could get the exact hex values for a chromahash, when they wouldn’t have better mechanisms to steal your password (ie, keyloggers). And for those cases where it could be, disabling chromahash (at least, the YUI3 version I wrote) isn’t very difficult, and could be wired up to a key event handler, an example of which I’ll probably have later.

It’s highly unlikely that someone will be able to get enough immediate data from this system to be able to make a reasonable attack on a password, certainly not when there are so many other, easier ways to perform that attack. And ChromaHash is configurable, based on when it goes color as well as how many bars it displays, which both would help this situation.

Ultimately, however, passwords are a failure as a security mechanism. Most people use the same password (or small set of passwords) everywhere, they don’t change them very often. Not to mention the fact that a lot of people storing password are doing a poor job of it. I worked at an e-commerce company not too long ago that when I took over their web presence, the passwords were in the database in plaintext, access rights were driven by a cookie. Hacking this site was trivial until I rewrote it, and even then, there are a few things that I didn’t do correctly right away, like not salting my MD5 hashes I was storing in the database (or using MD5 as my hashing algorithm in the first place…).

I believe that ChromaHash can improve usability, since it provides immediate feedback to the user that their password is accurate, and given that many people are visual, I think that they’ll develop, rather quickly, a gut reaction to the hash colors if they’re wrong or not. Will it work for everyone? No, but it could help most people.

We need to move beyond passwords as an authentication mechanism. I’m a big fan of the Yubikey, particualrly when paired with OpenID, though just migrating toward OpenID is a huge improvement. But ChromaHash, as it stands, does not significantly weaken the nature of passwords.

YUI3 Gallery - Community Driven Development

2009-11-05T19:35:31Z

Dav Glass has probably become one of my favorite people on the Internet. The work he’s done in the last year or so to make the Yahoo! User Interface library more of a community driven project has been really awesome, between the new forums, the transition to GitHub, and now reaching a new level with the YUI3 Gallery.

I’ve been using YUI3 since shortly after it was released, quickly recognizing the benefits of YUI3’s advanced architecture over YUI2, going so far as to submit a bit of code, in the form of the collection module, and the work I’ve done on the Chroma-Hash module for YUI3. And that’s just the code I’ve made public.

So, I was really glad to be able to begin contributing to the Gallery, having already uploaded two modules, with one or two in mind now that Dav’s mentioned the Gallery API. The great part about Gallery is that, if your module is free, licensed under the YUI BSD license, and you’ve signed a Contributors License Agreement, you can have it pushed to Yahoo!’s content distribution network. Global, high availability serving for JavaScript widgets? Hell yes.

The best part of the gallery is that it’s a dead simple way to make modules widely available for use, even if those modules will never really make sense in the context of the YUI framework itself, like my Chroma-Hash module, Luke Smith’s Konami Event, or Dav Glass’ quick and dirty port of the Simple Editor, but still might be useful to other people today. Plus, it’s an incubator for code that might someday make sense in the core (Dav’s YQL module being an example).

Yahoo!, and specifically the YUI team, have demonstrated exactly how a corporately backed open source project should run, as well as being a great example of why git (or really any distributed source control system) is so great for collaboration, especially for a growing team.

And it’s just one way to contribute. Dav does a great job outlining all the methods that exist today, and some still to come

Cloning XML Nodes from one Document into Another

2009-11-03T16:00:00Z

Microsoft’s .NET Framework was designed in part to offer a powerful architecture for working with the Web. In the early 2000’s, when .NET was first being designed, that meant having strong support for handling and manipulating XML. Visual Basic.NET even includes support for XML literals. The result of this need was the System.XML Namespace, which contains all the methods and objects you’ll need to manage an XML document.

Almost. First, System.XML is kind of a pain to use, but that’s mostly because parsing XML with a statically typed platform is pretty rough, and frankly, the only languages where working with XML is usually even reasonable are dynamic, unless the XML format is very, very strongly defined, such as in SOAP.

System.XML, however, has no built in mechanism for cloning an element from one document (or document fragment) into another. Attempts to do so (even to copy simple attributes) will always result in exceptions because the elements were derived from different documents.

Recently, I was writing a simple set of MSBuild tasks to do xml file replacement on arbitrary XML files after reading a fragment in from a different document. This was in response to a problem I had using the web.config file replacement tasks from the Web Deployment Projects. Namely, the web deployment project’s task works by using the System.Configuration tools to do the section replacement, and that was causing me problems when referencing a non-GAC assembly in one of the pieces I was replacing when doing a build to production. Their task needs the file to appear to be a valid web.config, and errors out if it thinks it’s found a problem. Mine doesn’t care what you’re replacing with, so long as it’s XML.

My first attempt, was something like this:

// This XML Doc won’t be repeated, since the method signature won’t change. /// <summary> /// Replaces a section of an XML document with the document fragment found in a given file /// </summary> /// <param name="document">The XmlDocument object to modify in place</param> /// <param name="section">The XPath referencing an XmlElement (or set of elements) to replace</param> /// <param name="filename">The path to the file containing the Xml Fragment to replace with</param> void ReplaceSection(XmlDocument document, string section, string filename) { var sections = document.SelectNodes(section); var fragment = new XmlDocument(); fragment.Load(filename); <pre><code>foreach (var s in sections.Cast<XmlNode>()) { document = s.ParentNode.ReplaceChild(fragment, s).OwnerDocument; } </code></pre> }

As stated above, this is going to throw an exception, because the fragment comes from a different document than the document I’m trying to replace into. So, it because necessary to clone the fragment into a new node, but this is non-trivial.

void ReplaceSection(XmlDocument document, string section, string filename) { var sections = document.SelectNodes(section); var fragment = new XmlDocument(); fragment.Load(filename); <pre><code>var newNode = document.CreateNode(fragment.FirstChild.NoteType, fragment.FirstChild.Name, fragment.FirstChild.NamespaceURI); newNode.InnerXml = fragment.FirstChild.InnerXml; foreach (var s in sections.Cast<XmlNode>()) { document = s.ParentNode.ReplaceChild(newNode, s).OwnerDocument; } </code></pre> }

XML Parsing engines are great, so that InnerXml property is a lifesaver, since otherwise I’d have to recursively clone the entire fragment tree in order to do the replacement.

Keen eyed observers will note that this is also incomplete. since it doesn’t take into account Attributes on the fragment element, and will in fact, no include them at all. XmlAttributes have the same weaknesses as XmlElements regarding your abililty to simply replace them with ease, so yet more code is required to clone them.

var newNode = document.CreateNode(fragment.FirstChild.NoteType, fragment.FirstChild.Name, fragment.FirstChild.NamespaceURI); newNode.InnerXml = fragment.FirstChild.InnerXml; foreach (XmlAttribute attribute in fragment.FirstChild.Attrbitues) { var newAttribute = document.CreateAttribute(attribute.Name); newAttribute.Value = attribute.Value; newNode.Attributes.Append(newAttribute); }

This is an awful lot of code to have to write simply to convert an Xml Fragment into a form that .NET will allow me to inject into a new document. But, now that it’s written, it can be pretty easily injected into a new static method you can use!

public static XmlElement CloneNodeIntoDocument(this XmlDocument doc, XmlDocument fragment) { var newNode = document.CreateNode(fragment.FirstChild.NoteType, fragment.FirstChild.Name, fragment.FirstChild.NamespaceURI); newNode.InnerXml = fragment.FirstChild.InnerXml; <pre><code>foreach (XmlAttribute attribute in fragment.FirstChild.Attrbitues) { var newAttribute = document.CreateAttribute(attribute.Name); newAttribute.Value = attribute.Value; newNode.Attributes.Append(newAttribute); } return newNode; </code></pre> }

As always, the code samples on my blog are BSD-Licensed, feel free to use and remix them, just give credit where due.

New Thoughts on Carbon Sequestration

2009-11-02T21:17:12Z

Generally speaking, I think that most people in the environmental movement tend to focus a bit too heavily on the issue of carbon emissions, often to the exclusion of other issues. For instance, we’re supposed to use compact fluorescent lamps, because they use less power, but ignoring the mercury used in production (given that most people don’t properly recycle the bulbs, this is a huge heavy-metals problem waiting to happen). Same thing with hybrid cars, like the Toyota Prius. So little of what goes into current environmental thinking even begins to consider long-tail, that while we’re busy putting out this current fire, we’re literally pouring gasoline on the next one.

Which is why, it’s so awesome to see real work going on that could potentially solve a lot of problems. Like this talk from July 2009 at TED by Rachel Armstrong on work that she’s involved in that works on literal nanotechnology that creates this microscopic, almost alive, protist-like things that can create limestone reefs in the ocean. And she proposes using this technology to save cities like Venice, which has been sinking into the sea for centuries.

If this works, and I do have some concerns about the ecological impact (namely, how does this system stop growing), it stands to be absolutely amazing, allowing us to create reefs which not only shore up our buildings, but also sequester carbon and serve as habitat for wildlife. Really fascinating.

But more interesting in the short term, because it definitely seems that the implications are far simpler, is some work being done by Gary Lewis of BioAgtive Technologies, where they’ve designed a tractor kit which takes tractor emissions and uses them to fertilize a field. The Australian farmer in the story linked figures he’s saving a half-million Australian dollars per year on fertilizer costs. Plus, he’s taking an output that he’d have anyway and utilizing it in a productive manner.

It’s this sort of enviromental work that really excites me, because they seem to be something which will bring around real, long term, meaningful change in environmental thinking. Incidentally, this is part of why I love TED. The talks are fascinating, and tend to focus on things that you’re not likely to hear about elsewhere.

Food-Grade Hydrogen Peroxide?

2009-10-26T18:22:59Z

Recently, I was having a conversation with a friend who is an esthetician and she mentioned a conversation she’d had with someone recently, who had begun asking about ‘food-grade’ hydrogen peroxide. With some further investigation, the person said that they had heard anecdotal evidence (my words) of a man who drank food-grade hydrogen peroxide to make him healthier, and that he had lost weight because of this practice, however, the health food store where this person found the product indicated they’d only used it for cleaning tables. Knowing what this person was planning, my friend said that she didn’t know where to find the product, and had to offer to talk to a nurse client about the practice in order to convince this person not to run out and start drinking the hydrogen peroxide.

My first question was what is food-grade hydrogen peroxide? According to the website foodgradeh2o2.com, it appears to be a 35% solution of h2o2 (what you buy in the drug store is usually only 3%), and they claim that the ‘stabilizers in it are not the toxic stabilizers used in industrial and pharmaceutical grades of hydrogen peroxide’. I’ve been able to find absolutely no documentation for the stabilizers used in ‘pharmaceutical grade’ hydrogen peroxide, but given that we often apply this stuff to open wounds, I can’t imagine that they’re that bad.

Of course, in addition to people talking about using hydrogen peroxide for weight loss, there are also sites that talk about using hydrogen peroxide for cancer treatment, which apparently works both via ingestion and injection. The basis for this is the idea of ‘oxygen therapy’, which, incidentally, the American Cancer Society does not advocate, and in fact claims has been linked to several deaths.

Hydrogen Peroxide has some solid uses, like as a disinfectant, stain remover and bleaching agent. But the way Hydrogen Peroxide accomplishes these tasks chemically, should make anyone wary of using this stuff internally. When the chemical, H₂O₂, breaks down it generally results in 2H₂O₂ -> 2H₂O + O₂, part of why it makes such a great rocket fuel, but it also means that there is a lot of free oxygen running around, just looking for atoms to rip electrons from (remember, ‘oxidation’ is just another name for rust!). Yes, we do use this tendency of oxygen to rip electrons from atoms to generate our energy we use, but there are a lot of dangers to over-exposure to oxygen. That bubbling you see when you put hydrogen peroxide on a fresh blood stain (or cut for that matter)? That’s caused by cells rupturing as the oxygen released when the peroxide decomposes begins tearing apart proteins and cell membranes.

Food-Grade Hydrogen Peroxide might have better stabilizers in it than what’s available at the pharmacy, but I’m not entirely sure. And the chemical can often serve as a better replacement for chlorine bleach as a cleaning agent, but what drinking it is doing to you internally (if it causes weight-loss at all, it’s probably because it prevents your body from actually absorbing nutrients after a long time ingesting it), is pretty much exactly what it’s doing when used externally. Tearing cells open. Denaturing proteins. Use it to clean and disinfect, but anything that can be used to kill bacteria, is going to cause you problems internally, and should be treated with care.

Corporate Charity Crappiness

2009-10-24T01:35:37Z

I’ve got a pet peeve regarding the way large companies handle their charitable donations. Mostly, that they use the fact that they are considering being charitable as a means to drive direct sales of their products. Like Yoplait’s Save Lids to Save Lives campaign, or Dawn’s 1 bottle = $1 to save wildlife campaign. Okay, so instead of just donating a sum of money to charity and making announcements about that to try to drive sales, they make you buy their product in order to donate a small sum of money per sale. Fine.

What bothers me more are all the caveats they put on the donation. Yoplait requires you to collect the lids and mail them to them. Dawn requires you to go to their website and enter a code to ‘activate your donation’. Look, I’m not the one donating to charity. You are. Track you god damn sales, and figure things out that way. These companies are hiding behind these processes which most people aren’t going to follow through on (people are lazy about this shit, I know I am), in order to try to keep from actually having to donate. According to Dawn’s FAQ their donation program ran from July 1, 2009 to October 1, 2009. Their donation counter as of right now? $126,991. You can fucking bet that Dawn has sold more bottles of their dish detergent than that over third quarter of this year.

Even worse, as far as I’m concerned, is that these companies then put these artifical caps on their donation size. For Dawn, it was $500,000 (not that they even came close). For Yoplait, it’s $1,500,000, and that’s at $0.10 per lid. That means they need to recieve fifteen million lids to reach that figure. And after that? Fuck you, breast cancer. So what, the company can afford to donate $0.10 per lid they recieve up to fifteen million sales, but not a dime after? Now, Yoplait has guaranteed a minimum donation of $500,000, which is awesome, but I’ll be really interested to see what their final donation is, after all this is said and done.

I’m all for corporate sponsorship of charity. And I have no problem with these companies making a big deal of the fact that they’re donating to charity. But imposing artificial limits on their donation, and requiring me to jump through hoops for them to make these donations is flat ridiculous and dishonest. Make a promise to donate a percentage of all sales or profits over a given timeframe to a given charity. Great. But don’t create extra work for your customers, who you know full well are unlikely to follow through, in order to try to get the PR boost for being charitable, when in reality, you’re probably going to be donating a lot less than you imply in your marketing and outside of the fine print on your advertising and labeling. That’s just being dishonest. At least in Yoplait’s case, they’re a lot more upfront about the requirement to mail in lids, and the max donation, then I ever saw on Dawn’s advertising.

JSON Encoding of .NET Objects

2009-10-22T17:00:54Z

For a recent project, it was a user requirement that we be able to save a snapshot of some statistical data on demand. I decided that the best way to do this would be by saving a JSON representation of the data, since I was going to be providing a JavaScript method to render the data, and for comparisons, at a later date. I knew that .NET had a mechanism to convert an object to JSON, because ASP.NET MVC has a JsonResult object that returns data as a JSON string to the client via the browser. However, my Google-Fu failed me, and my searches didn’t return the mechanism to do this.

I’m using .NET 3.5, and I was appalled at the difficulty I was having, especially since ASP.NET AJAX is standard in .NET 3.5. But all I kept finding were items off the list of C# parsers from the json.org. Those libraries and projects are probably fine, but I was trying to avoid adding a new dependency, and again, I knew this had to be possible in core .NET 3.5.

After cracking open the MS-PL source for ASP.NET MVC, I found my answer: The JavaScript Serializer class!

Now, JSON is a data-interchange format that happens to be syntactically compatible for JavaScript, so I think that name sucks, since I’m storing this data as JSON, but fine Microsoft, call it what you will. And using the class is dead simple.

var serializer = new System.Web.Script.Serialization.JavaScriptSerializer();
string json_string = serializer.Serialize(_model.getData());
DataObject obj = serializer.Deserialize<DataObject>(json_string);

I’m not completely happy with this API. My first reaction was that I shouldn’t have to instantiate the JavaScriptSerializer class at all. Apparently this requirement is because I can define a custom JavaScriptTypeResolver to aide the serializer in converting my object to a JSON string, but I would still like to see a Singleton implementation of the JavaScript Serializer that allows me to call the Serialize and Deserialize with the default type resolver, but given that this doesn’t appear to be changing for .NET 4.0, I should probably just get over it.

Angel Financing and Pitch Fees

2009-10-13T22:40:12Z

Jason Calacanis has been on a crusade lately, one which I can fully back. Frankly, this was something of a surprise, since I’m generally debating unfollowing Calacanis on Twitter, and his voice grates on my ears from too many episodes of This Week in Tech where I grew to tire of his elitist attitude. While I acknowledge and respect his success, I’m generally far less sure about him being right than he is.

That said, I really like Calacanis’ focus on helping startups. He’s been involved with TechCrunch50 in the past, and lately he’s begun a crusade against Angel Investors who actually charge startups to pitch, including a followup where he discusses that one of the firms is threatening to sue him for telling the truth and expressing an opinion in an ugly fashion, something I can certianly relate to.

Why is it so unreasonable to charge investors to present? Simply because these angel investors (a term I consider to be somewhat dishonest) are usually given a pretty significant share in a company in exchange for their investment. I’m not saying this isn’t a deserved share, this is after all an investment, but these investors are looking to make money, plain and simple, and startups happens to be a pretty good way to potentially turn a good profit. Sure, there is more risk, but when a startup pays out, it pays out big, generally.

Anyway, enough complaining about the term ‘Angel’. The fact is these investors occupy a really import market segment. Of course, reading some of these rebuttals, it seems that the people charging are firms that represent investors, not the investors themselves, which says to me that they simply have a flawed business model.

Ultimately, what’s coming out of Calacanis’ post is simple: If you’re a startup, looking for venture capital, don’t pitch to any organization which requires fees to pitch, or put you in contact with investors. Investors want to invest their money in startups they believe in. Sure, finding investors can be difficult, but starting with people like Jason Calacanis, who know a lot of VCs, or any of the investors on the panels at TechCrunch50.

When you’re chasing a dream, make sure you don’t get screwed in the process.

Know Your Farmer, Know Your Food

2009-10-12T22:19:21Z

I’ll admit, I was skeptical when Tom Vilsack was appointed US Secretary of Agriculture. Vilsack’s entire political career had been from the heart of the corn belt. He’s a noted supporter of corn-based ethanol. In short, he seemed like another Big-Ag shill who had taken over the chief role in US farm policy.

It appears I was wrong.

While I wouldn’t say that Vilsack is anti-big agriculture, he’s done a lot of work promoting farmer’s markets, and other activities that I do support, including the USDA’s new “Know Your Farmer” campaign, which provides support to small-scale local farmers, and even talks about the health importance of a diet based more around fresh fruits and vegetables and meats than the processed fare that many Americans, especially lower-income families, live on today.

Now, I’m still not a supporter of this administration. I think that the USDA needs to do more to revamp the agricultural system, but the work that is being done to encourage the development of local and regional food systems is exciting, and needs to be encouraged.

Classic Adventuring in JavaScript

2009-10-09T17:45:22Z

Ajaxian more than earned it’s spot on my RSS Reader this week when they told me about sarien.net. Now, if you’re around my age, you have really fond memories of the old Sierra Adventure games, and sarien.net is the perfect way to honor these classic games, by making them playable in your web browser.

Now, there have been other browser-based retro gaming sites, but in this case, it’s implemented in JavaScript and Canvas. Of course, this means it only works in new browsers (Safari 4, Firefox 3+, etc), and that it doesn’t work in IE at all, but this is a seriously cool hack.

Martin Kool, the guy behind the site, has a pretty decent write-up about the tech, though I’d like some more techy-details, that I’ll have to go to the source for.

So, how’s it work? Well, Martin has extracted the data files from the old Sierra games, and run them through a special parser that converts the AGI code to JavaScript. This is no small feat, really, as JavaScript has no support for things that AGI requires (like GOTO), and using the Canvas support in modern browsers to render the images. He does add support for the Q42 multiplayer engine developed at the company he works for so that you can visit with other players while you’re playing, though I’m unsure how interested I am in that, luckily, you can turn that bit off.

Martin’s rewrite of the javascript code, converts the application into an enormous switch-case block which allows a reasonable equivalent to the ‘goto’ that AGI uses. I haven’t had a chance to analyze the exporter, so I can’t say much about it, but I agree with Martin, that I hope Activision-Blizzrd (the current copyright holders of the old Sierra games) allow this site to remain as what it is, a beautiful shrine to these fantastic games, and hopefully it might encourage more movement on the adventure game front in the modern world.

Flock of Dodos

2009-10-08T15:00:00Z

Randy Olson earned his Ph.D. in Biology from Harvard University in 1984 as an environmental ecologist, primarily in reef ecology. In the late 90s, he decided to go into film making, and caught a lot of attention for 2006’s “Flock of Dodos: The Evolution - Intelligent Design Debate”.

Okay, so it’s a documentary about the ‘debate’ between ID and Evolution from a guy who, quite simply, firmly knows that Evolution takes place. It’s probably stands up to logical rigor as well as Michael Moore on a treadmill, right?

I’ll admit a bit of bias, in that I find the ‘debate’ around Evolution ridiculous, but Olson gives the ID people ample time to try to convince him of their world view in his movie. Probably close to 75% of the movie centers around discussions with ID proponents, and they generally are glad, and quick, to show how little they truly understand about modern evolutionary theory.

I’ll be getting to that part in a bit, but I will say that Olson, for his part, doesn’t let the evolutionary biologists off free and clear. He paints an, unfortunately somewhat accurate, portrait of the modern evolutionary biologist as a older, white male, who is completely incapable of expressing their work in reasonable terms, and who tends to become belligerent when presented with someone who doesn’t accept a well-understood (by those who’ve read any of the literature, at least) scientific fact like evolution.

In fact, both sides of the argument fail to provide a rigorous platform with which to convince people of their cause. The ID proponents use ridiculous comparisons and poor science to push their agenda, while the scientific establishment has tried to pretend these people don’t exist in the modern age. Sadly, these people do exist, and so do people who honestly believe that the Earth is flat.

The core argument that the ID proponents put forward is that Darwinian Evolution can’t explain everything. Which is certainly true. But then, Darwin didn’t really try all that hard to describe how common descent began, and Darwin’s On the Origin of Species was published 150 years ago (next month, actually). To suggest, as ID proponents surreptitiously do, that evolutionary theory hasn’t progressed in 15 decades, is ridiculous. In fact, the biological community no longer believes with one of the core ideas presented in “Origin”, that the primary driver of evolution was ‘survival of the fittest’. Certainly that’s viewed as a driver, but not as the most important one.

The, there is Michael Behe, a well respected biochemist, who is basically responsible for the modern face of Intelligent Design. I’ve seen Behe speak, the video from the talk being available online. Behe is, as one might expect, the consummate Intelligent Design proponent. He mentions that he’s a professor at Lehigh University, but that his department clearly states that they disagree with him on the issue of Intelligent Design, regarding it as unscientific.

It’s not so much that he mentions this, but how he mentions it that’s offensive. He says it, to suggest that he is somehow being persecuted by his peers, when really, if he was being truly persecuted, he wouldn’t likely even be on the faculty at Lehigh anymore. All his department has done is said that, while they respect Behe, and his science, they don’t believe the Intelligent Design is science, and don’t want his affiliation with Lehigh to lend credibility to it.

Why doesn’t the Biology Faculty at Lehigh University believe that Intelligent Design is Science? Because it isn’t. Science is defined as follows:

The collective discipline of study or learning acquired through the scientific method; the sum of knowledge gained from such methods and discipline.
A particular discipline or branch of learning, especially one dealing with measurable or systematic principles rather than intuition or natural ability.

Intelligent Design fails to live up to either of these definitions. The most trumpeted principle used by ID proponents, irreducible complexity, states that some systems are too complex to have been arrived at via gradual evolution, and small steps and changes over time. Behe’s favorite example of this one, is that of a flagella, specifically the protein ‘motor’ that drives the filament. Admittedly, this is a complex mechanism, one that, to my knowledge, Science is currently unable to explain the origin of. However, that doesn’t make irreducible complexity a scientific principle.

Science, and the scientific method, are based around asking questions. Even after Darwin wrote “Origin”, there were a lot of things he didn’t understand. Darwin didn’t know the mechanism by which traits were passed from parents to offspring, but we’ve answered that question, because someone formed some intuition that they could then measure and test via ‘systematic principles’. Irreducible Complexity says “I don’t know how this happened, so clearly, it must have been implanted by some sort of designer.” That’s not science. That’s anti-science, and a classic application of the logical falacy of ‘argumentum ad ignorantiam’.

This is also to ignore the outright lies that ID proponents will tell in order to push their agenda. The focusing on the term ‘theory of evolution’, even though in Science and Mathematics, something can only earn the title ‘Theory’, when it has passed scientific rigor to the point where it is universally accepted. The lies which talk about Ernst Haeckel’s embryo drawings as if they were still being used in modern teaching. In the movie, Olson takes an embryology text book on the bookshelf of the gentleman he’s talking to who is making this claim about Haeckel’s embryos, and they can’t even find a mention of Haeckel in the book.

Intelligent Design has to assume that science has stood still for the century or more, because it’s the only way the are able to put together a wide breadth of arguments into the failures (or more accurately, misunderstandings) of evolutionary theory.

What people need to understand is that science doesn’t exclude the existence of God, or a Creator. It simply doesn’t presuppose such existence. It seems to me that because they don’t make that presupposition, because a scientific universe could exist without some sort of divine outer influence, many people believe that it completely precludes the possibility of divinity. And certainly there are some vocal members of the scientific community who routinely mock the faithful, but for most in the community, the existence of God simply isn’t relevant to the work that their doing.

Ultimately, part of the reason ID has gained so much traction is that it’s simply better marketed, in part because the scientific community felt they didn’t need to defend themselves against it’s claims. We need to support groups, like the National Center for Science Education, who seek to defend the teaching of science from the illogical attacks from Intelligent Design, and other fundamentally religious arguments. They are under funded compared to their opposition, however, but you can join for as little as $30 per year, a perfectly reasonable amount to try to change science education in this country for the better.

Undoing a Lockout on an Android Phone

2009-10-06T15:00:00Z

Over the weekend I ran into a major problem with my Android-based phone. While we were moving into our new condo, I had the phone in my pocket, and had somehow triggered the touch screen pattern-unlock mechanism, and proceeded to accidentally lock out my phone badly enough that it was demanding my username and password to unlock the device.

Unfortunately, I apparently can’t remember that password.

Fortunately, if you have debugging over USB enabled, you can hack your way into the phone.

Yes, this is a security vulnerability, but most any device has some security problems when you have physical access to it, and at least in this case, you have to enable USB Debugging, which is only enabled by default on developer firmwares.

To perform this fix, you need to have the Android SDK, and your phone needs to appear on the output of adb devices. Google provides a Windows Driver, and most Linux distributions should work fine. Once you have the device attached, just execute the following.

$ adb -d shell
# sqlite3 data/data/com.android.providers.settings/databases/settings.db    
sqlite> update system set value=0 where name='lockscreen.lockedoutpermanently';
sqlite> .exit
# exit

The effect should be almost immediate. Press the ‘Menu’ button on your phone, and you’ll be prompted for your pattern. If you’ve, for some reason, forgotten what your pattern is, you can follow these instructions to disable the pattern prompt, which was the basis for my solution.

Home Ownership The DIY-Way

2009-10-05T21:04:58Z

My wife, Catherine, and I have finally had a chance to move into the Condo we bought two months ago. Needless to say, I’m exhausted today, but the reason it’s taken so long for us to get our stuff into this place is simply the sheer amount of work we needed to do.

We had to replace the carpet, with a beautiful hardwood floor, including new trim. We had to repaint the walls (which has been painted with a really lousy paint). I had to fix the toilet which started leaking last week after the place had been empty for eighteen months. We had to replace the curtains, which smelled as bad as the ugly carpet, as the previous owner had apparently smoked cigars regularly in the space. This list seems short, but there are many smaller projects that I can’t really name at the moment. Worse, it pales in comparison to all the other projects that we want to do.

Monday has generally been my ‘sustainability’ posts, which I hope to be able to talk more about in the future as we settle into the new place, but I’m going to be working in posts about the repairs and additions that we make into our new condo. My parents had given me the Black and Decker Complete Photo Guide to Home Repair which has helped be a guide to many of the projects that we’ve taken on, and certainly many more we will be. It’s a good guide, and I’d recommend it based on my experience with it.

Some coming posts I have regard said broken toilet, freeing heavily rusted pipe fittings, replacing a bathroom ceiling fan, some wiring stuff. Really, I’ve got an insane amount of work I want to do, and no doubt, each new project will result in a new post here. This is still, and will remain, a primarily technology blog. But this content has a place as well, and I certainly hope it will help someone else.

Derived Property Data Binding in Silverlight

2009-09-29T22:27:29Z

For our Silverlight-based Schedule Proofing application at work, we have a special requirement for Summer Session, where they have course ‘blocks’, or a set of predefined dates beyond just ‘full term’ and ‘whatever’. This required a few interesting blocks, but mostly, it required some interesting tweaks related to data binding, that unfortunately, I had to do in code.

The relevant XAML looks like this:

<my:DataGrid x:Name="Selector"
            AutoGenerateColumns="False"
            HeadersVisibility="Column"
            GridLinesVisibility="None"
            IsReadOnly="True"
            Visibility="Visible"
            FontSize="11"
            RowDetailsVisibilityMode="VisibleWhenSelected">
    <my:DataGrid.Columns>
        <my:DataGridTemplateColumn Header="Start Date">
            <my:DataGridTemplateColumn.CellTemplate>
                <DataTemplate>
                    <TextBlock Text="{Binding StartDate}" Margin="5,4,5,4"/>
                </DataTemplate>
            </my:DataGridTemplateColumn.CellTemplate>
            <my:DataGridTemplateColumn.CellEditingTemplate>
                <DataTemplate>
                    <mye:DatePicker SelectedDate="{Binding StartDate, Mode=TwoWay}" />
                </DataTemplate>
            </my:DataGridTemplateColumn.CellEditingTemplate>
        </my:DataGridTemplateColumn>
        <my:DataGridTemplateColumn Header="End Date">
            <my:DataGridTemplateColumn.CellTemplate>
                <DataTemplate>
                    <TextBlock Text="{Binding EndDate}" Margin="5,4,5,4"/>
                </DataTemplate>
            </my:DataGridTemplateColumn.CellTemplate>
            <my:DataGridTemplateColumn.CellEditingTemplate>
                <DataTemplate>
                    <mye:DatePicker SelectedDate="{Binding EndDate, Mode=TwoWay}" />
                </DataTemplate>
            </my:DataGridTemplateColumn.CellEditingTemplate>
        </my:DataGridTemplateColumn>
            <my:DataGridTemplateColumn.CellTemplate>
                <DataTemplate>
                    <TextBlock Text="{Binding BlockName}" Margin="5,4,5,4"/>
                </DataTemplate>
            </my:DataGridTemplateColumn.CellTemplate>
            <my:DataGridTemplateColumn.CellEditingTemplate>
                <DataTemplate>
                    <ComboBox ItemsSource="{Binding TermInfo.Blocks}" DisplayMemberPath="Name" SelectedItem="{Binding SelectedBlock, Mode=TwoWay}" />
                </DataTemplate>
            </my:DataGridTemplateColumn.CellEditingTemplate>
        </my:DataGridTemplateColumn>
    </my:DataGrid.Columns>
</my:DataGrid>

The relevant portions of the data structure looks basically like this:

class SectionData
{
    private DateTime startDate;
    private DateTime endDate;
    private YearTerms termInfo;

    public YearTerms TermInfo
    {
        get
        {
            return termInfo;
        }
    }

    public DateTime StartDate {
        get { return startDate; }
        set
        {
            startDate = value;
            NotifyPropertyChanged("StartDate");
        }
    }
    public DateTime EndDate {
        get { return endDate; }
        set
        {
            endDate = value;
            NotifyPropertyChanged("EndDate");
        }
    }

    public SummerSessionBlock SelectedBlock
    {
        get
        {
            if (termInfo.Blocks == null) return null;

            var b = termInfo.Blocks.Where(q => q.Begin == startDate)
                .Where(q => q.End == endDate)
                .SingleOrDefault();
            return b ?? termInfo.Blocks.Where(q => q.Name == "Custom").Single();
        }
        set
        {
            var b = termInfo.Blocks.Where(q => q.Begin == startDate)
                .Where(q => q.End == endDate)
                .Any();
            if ((value.Name == "Custom" && b) || value.Name != "Custom")
            {
                startDate = value.Begin;
                endDate = value.End;
            }
            NotifyPropertyChanged("Block");
            NotifyPropertyChanged("StartDate");
        }
    }

    public string BlockName
    {
        get
        {
            return SelectedBlock != null ? SelectedBlock.Name : string.Empty;
        }
    }
}

public class YearTerms
{
    public ObservableCollection Blocks { get; set; }
}

public class SummerSessionBlock
{
    public int Year { get; set; }
    public int Term { get; set; }
    public string Name { get; set; }
    public DateTime Begin { get; set; }
    public DateTime End { get; set; }
}

Alright, that’s a lot of code, and most of it, I’m not really going to address here, since I’m assuming a basic understanding of Data Binding and Dependency Properties. Basically, all those NotifyPropertyChanged calls ensure that the UI gets updated. Also, the YearTerms.Blocks property will, in my case, be NULL for all terms that aren’t a summer session.

Now, since blocks don’t mean anything outside of Summer Session, I don’t want that column to be visible outside of that case. This isn’t a big problem, since all the sections which will be viewed on one instance of this data grid will, by definition, be from the same term, however, attempts to use XAML DataBinding failed with XAML parsing errors.

    <my:DataGridTemplateColumn Header="Block"  Visibility="{Binding BlockName, Converter={StaticResource VVC}}">

The VVC StaticResource just sets the Visibility to Hidden if BlockName is the empty string, Visible otherwise. As I said, this excepts with an obscure XAML parsing error. Unfortunately, things that can be quite simple in XAML can be a real pain in code when using Silverlight or (presumably) WCF. Partially because of how you have to identify the column. The solution is fairly simple, when the DataContext of the DataGrid is modified, I simply determine what the visibility should be and call a function that sets the visibilty.

public void SetColumnVisibility(string columnHeader, Visibility visible)
{
    try {
        Selector.Columns.Where(c => c.Header.ToString() == columnHeader)
            .Single().Visibility = visible;
    } catch (Exception e) {
        throw new ArgumentException("Column '" + columnHeader + "' does not exist.");
    }
}

Have I mentioned yet that I really love LINQ? This code is all wrapped up in a custom control, but I’m debating converting this function to an extension method on the DataGrid, since nothing quite like it is offered. This function is called from the web service callback responsible for setting the data context on this control, and it ensures that users only see this column when it makes sense to. Would have been nice to data bind this, but in reality, the binding works because I know that the data which determines the column visibility is technically shared among all members of the data, but the Silverlight Runtime doesn’t have any way of knowing that for certain.

More annoying is the second problem. The Date fields should not be modifyable directly by the user unless they’ve selected a special ‘custom’ option in the Blocks list. The ‘custom’ option is added at runtime, and is defined with start and end dates being just within the boundaries of the full term option. Which involves setting the IsReadOnly flag on the Columns for Start Date and End Date. Again, the Data Binding fails with a completely unhelpful XAML parsing error, and in this case, the data that I’m binding against is unique for the row, and doesn’t effect the rows around it, so I was kind of at a loss.

The problem with IsReadOnly on the DataGridColumn is that it effects all rows, not really what I want. So, really it’s out. But I don’t see a way to bind the IsEnabled flag on the Cell using a data binding (I’m fairly new to Silverlight, so this is likely my failing). So, to code it is. The problem I found was that, Silverlight doesn’t make it really easy to access the individual cells for a datagrid. You can get access to columns easily, and rows through a few events, but to access the cell….that’s non-trivial.

private void SetDateEditability(DataGridRow dataGridRow)
{
    var msi = dataGridRow.DataContext as MasterSectionInfo;

    // The fields should be editable if either of these are true, but not otherwise
    bool editable = msi.BlockName == "Custom" || msi.BlockName == string.Empty;
    // Should only except if Columns can't be found
    try
    {
        // I need these columns with these two names.
        var e = Selector.Columns.Where(c => c.Header.ToString() == "Start Date" || c.Header.ToString() == "End Date").Select(c => c);
        // For each column in the LINQ query above
        foreach (var column in e)
        {
            // Get the Cell Content for the argument row
            var el = column.GetCellContent(dataGridRow);
            // Get the cell itself, and set it's IsEnabled flag.
            (el.Parent as DataGridCell).IsEnabled = editable;
        }
    }
    catch (Exception) { }
}

Now, the question is, when does this method need to be called? It needs to be called anytime the selection for the Block column changes, which is accomplished through the CellEditEnded event on the data grid. For my purposes, I check that the edited cell is in the Block column, to save just a bit of time, but you can always decide how necessary that is in your own application. However, this isn’t sufficient, since it doesn’t effect the rows as they load, so you’ll also need to add a LoadingRow event handler which calls into this method for each row as it loads.

So, there you have it. How I created a virtual property driven by two backing properties, and tied the editability of the backing properties to the selection. I’ll be the first to admit, it’s not the prettiest looking solution in the world, and I’m sure it could be done better, but I was under a deadline, and really, this works pretty cleanly, for a solution derived from a Silverlight newbie.

Pollan Protests in Wisconsin

2009-09-28T22:45:28Z

Apparently, this is going to be a particularly good year for Michael Pollan, at least in terms of book sales, as both Washington State University, and University of Wisconsin-Madison have chosen his books for their Freshman Common Reading programs. I don’t know what the freshman class at UW-Madison looks like this year, but at WSU that equates to around 3300 copies of the book, The Omnivore’s Dilemma, just for Freshman. The Bookie was also offering 20% off list to anybody else who wanted to buy the book (Students/Faculty/Staff/Parents/Alumni/etc) so all told, I really have no idea how many copies of the book are now floating around the WSU campus, but it’s not insignificant.

And, it almost didn’t happen.

Due to financial shortfalls here in Washington, the University felt it was going to have to completely cut the Common Reading program, largely because the program has historically involved an author visit, but the school couldn’t afford it. There were rumours that the real reason for the cut was pressure from Agribusiness, which I’ve never seen any real credible proof of, though certainly Pollan’s book is critical of the sort of agriculture common in the Palouse (re: monoculture), an agriculture which WSU has been instrumental in creating through years of wheat genetics and hybridization. Universitry of Wisconsin-Madison, who chose Pollan’s later In Defense of Food: An Eater’s Manifesto, is no doubt just as tied to Agribusiness as Washington State.

[Bill Marler], whom I’ve wrote about before, decided to provide a donation to WSU to keep Pollan on the agenda, and the Common Reading program has been moving forward, with a planned visit from Pollan on January 13th of 2010. Having read both of Omnivore and Defense, I’m looking forward to the visits, though I suspect that WSU’s experience with Pollan’s visit will be no less controversial than his visit to Madison.

Civil Eats has already broke this story down, and I’m planning on simply adding to what Paula Crossfield has had to say on the issue, though perhaps not as kindly as she has been.

First, the Defense of Farmers group. Anyone who claims that Pollan is anti-Farmer is a fucking idiot. In both Ominvore and Defense, Pollan routinely says that the small amount American’s spend, and expect to spend, on food is downright ridiculous. Currently, it’s about 10% of our disposable income. Prior to 1933, that figure was closer to 25%, per the Salem-News article linked above.

And what’s allowed for that? Mechanization. Hybridization. Specialization. The hallmarks of modern agribusiness, and they’ve done a fantastic job in churning out massive numbers of calories. However, the food that’s resulted, is quite easily shown to be not as good for us. We have the highest instances of obesity, diabetes, heart disease, and a whole host of other problems than we ever have had historically (but the problems in the health care industry are totally the insurance companies, right?). These problems are effecting more people every year. And younger people. In the last thirty years, incidence of Diabetes among people under the age of forty has gone up a full percentage point, nearly three times. Among older people (45+), it’s at least doubled. And when you look at Type 2 Diabetes, the type most often linked to weight and nutrition, it’s figured that over 13% of African Americans, 9% of Latino Americans, and 8% of Caucasian Americans suffer from Type 2 Diabetes.

And why would the numbers be more prevalent among racial minorities? Generally these people are poorer than Caucasian Americans (this is a generalization, and one I don’t intend to discuss the reasons for here. It’s an injustice, a pretty disgusting one, but it’s also a completely different discussion). And heavily processed foods tend to be cheaper, so they tend to be consumed more by poorer people. If agribusiness were to be restructured along the lines presented in Pollan’s book (which is basically impossible, and possibly improbable), then these people would be getting more fresh fruits and vegetables, and less corn-derived food products. And, yes, they’d be paying more for it. Which might not be a bad thing. More money on food, less on Cable TV and other non-necessities.

And, there would be more jobs for farmers. Higher prices paid to farmers (particularly if Farmer’s Markets can become more prevalent). It might actually be possible for a farmer in the corn belt, or the heart of the dairy belt, to survive without government subsidy. And to make more money than they do now. And, we’ll be taking better care of the soil, and ourselves. No more hypoxic algae blooms. No more nitrate contamination of drinking water (There is no corroborating evidence of the so-called ‘blue baby syndrome’, but artificially high nitrate levels have been shown to negatively impact water life). And most likely, a decrease in the incidence of obesity and it’s host of related health problems that have begun to plague the developing world.

But we live in a post-consumer economy. It’s hard to sell people on the idea that we need, in the words of Arthur Sinclair to “get a lot of white collars dirty.” We need more farmers, and we need people who are willing to spend more money on food. And those two goals…might be tough to reach. Still, neither of those goals are anti-farmer. In fact, they’re far more pro-farmer than any agricultural policy than we’ve seen in a long time. They’re ideas that seek to make sure that Farmer’s can actually afford a living wage, and not be dependent on government subsidies, because the current food system is a boon to Monsanto, Tyson, and other large-scale agribusiness. Not to the American farmer.

The second point I’d like to address, are comments by John Lucey, Madison professor and food scientist, who was quoted by the AP as complaining about how Pollan says Food Science has merely broken foods down to nutrients, and completely missed the point of the work in the strides that food science has made in food preservation, food safety, and meal prepration time. Now, Food Safety is kind of a joke. Just read Bill Marler’s Blog, we have one of the most unsafe food systems in the world, and most of it is because of the work of modern food science, which has created this single supplier system we have. A food safety problem at a single plant, can make people sick nationwide, something that was never possible before the shelf stabilization and preservation additives that Dr. Lucey is claiming are so great. Which is to say nothing of the other risks such additives occasionally supply.

A lot of these problems are not the blame of food scientists. And not all additives have been linked to potential health risks due to overexposure (and it’s really easy to be overexposed to food chemicals these days). However, food science has not proven to be a panacea, and while there has been good things to come from it, it hasn’t made us any safer than we used to be. If anything, food science has caused most people to lose any sort of cultural knowledge of food, instead trusting it to the supermarket and the labels therein, which is the real crime in Pollan’s eyes.