blog.dave.io

A smattering of iPhone pictures from the last few weeks

Sat, 05 Nov 2011 05:00:29 -0700

Just because, that's why.

+1 Axe of Protein Folding: distributed computing using gamers' brains

Tue, 20 Sep 2011 13:28:00 -0700

To disable M-PMV’s protease, we need to know exactly what it looks like. Like real scissors, the proteases come in two halves that need to lock together in order to work. If we knew where the halves joined together, we could create drugs that prevent them from uniting. But until now, scientists have only been able to discern the structure of the two halves together. They have spent more than ten years trying to solve structure of a single isolated half, without any success.

The Foldit players had no such problems. They came up with several answers, one of which was almost close to perfect. In a few days, Khatib had refined their solution to deduce the protein’s final structure, and he has already spotted features that could make attractive targets for new drugs.

via blogs.discovermagazine.com

Over ten years trying to solve part of a problem. Turn it into a game, give it to the Internet, use mathematical magic on the large number of varied solutions to come up with the answer.

That answer - to the whole problem, not just part of it - came after a few days.

(A full discussion and explanation of this will appear on Geekosaur in the next few days)

Permalink | Leave a comment »

Disasters happen when you implement good cryptography, badly.

Fri, 16 Sep 2011 06:57:06 -0700

Link: Top-grade, SHA1 Encryption - The Daily WTF

And then came the "data breach" email — everyone's personal data (which, for Paul, was just his throw-away email) was now in the hands of some hackers.

Great post from the Daily WTF - shows off how it's very easy to end up in a bad situation when you have good crypto, implemented badly. Implementation is everything, and if you don't understand how to use it then you might end up completely negating any security that you'd hoped to gain.

If you're having trouble working out what's going on in the code snippet, drop me a comment and I'll explain.

Permalink | Leave a comment »

The banking industry is ludicrous.

Thu, 15 Sep 2011 10:59:00 -0700

The banking industry is ludicrous.

Have you ever made a bad decision that cost you more money than you could afford at that point? Maybe up to two grand, maybe less. I've certainly been in situations myself where the loss of twenty quid would have meant that I couldn't afford food for a period of time. For a huge chunk of the world, even two quid is a massively significant - quite feasibly life-saving - amount of money.

UBS lost two billion dollars. That's two with nine zeros after it if we're being generous and assuming an American billion. The vast majority of us won't even approach that figure if every income throughout our lives were to be totalled up. It's an absurd amount of money. Large companies are wiped off the map for losses of a fraction of that figure.

UBS lost two billion dollars and they're concerned that it might - not 'will', 'might' - mean that they report a loss this quarter rather than a profit.

My sympathy is rather limited. Sorry, UBS, you can't have a new private island this quarter, you'll have to settle for the ones that you already have.

Here's an idea: once, just once, at the end of a financial year, the banks agree that they'll all break even. Profits in excess of break-even are used to build housing, provide clean water and food, and put an end to want across the globe. There'd be enough to do it many times over. Since all banks do it unilaterally, no single institution makes any gain or loss over another, and the money ends up back with the banks anyway - who do you think will get the contracts to fix everything up?

Except it won't happen, because capitalism relies on not a division of labour, but a division of quality of life. Otherwise, nobody would spend money and enter debt to try and have a decent place to live, or clean water and food, or education for their kids.

Bollocks.

Permalink | Leave a comment »

Great food. Bad gender stereotyping.

Wed, 14 Sep 2011 11:04:00 -0700

The Breakfast Club has three restaurants across London. The most recently opened one, in Shoreditch, is themed around an eighties childhood. The food is incredible.

However...well, these are the toilets. Let me know if you can guess which is the gents' and which is the ladies'.

I'm sure this was done with the idea of denoting which was which without the good old icons, while keeping in theme. I get it. However, what it manages to do is support the forced childhood gender binary.

Army toys for the boys. My Little Pony for the girls. Therapy for the transgendered.

Permalink | Leave a comment »

Have some colourful North London.

Sun, 24 Apr 2011 11:13:48 -0700

Permalink | Leave a comment »

yup, that's a bad slogan...

Wed, 30 Mar 2011 03:01:00 -0700

via flickr.com

Best placard from the London anti-cuts protests. BEST.

Permalink | Leave a comment »

Untitled

Sat, 19 Mar 2011 23:52:02 -0700

Permalink | Leave a comment »

An Hour At The London Hackspace (video)

Sat, 12 Feb 2011 14:43:00 -0800

An Hour At The London Hackspace from Dave Williams on Vimeo.

Permalink | Leave a comment »

Human Sexuality Chart

Fri, 04 Feb 2011 13:24:00 -0800

On one hand, this is an incredible piece of work - view full size -

On the other hand, through careful analysis, I have managed to simplify it -

And that's pretty much the way I feel about the whole issue.

Permalink | Leave a comment »

Candied Bacon Sandwich á la Dave

Thu, 20 Jan 2011 15:22:00 -0800

I made some candied bacon.

For those unfamiliar with this particular cause of massive heart attacks, this is what candied bacon is supposed to look like.

This is, of course, candied bacon as prepared by someone who

Has prepared candied bacon before
Is willing to do their research into how best to cook candied bacon
Is probably quite a good cook, or in fact has done anything with their oven other than reheat things during the past six months

As such, it's complete bullshit. Bollocks to that, said I, and went out to buy some sketchy bread with which to make a monster.

To make candied bacon sandwich á la Dave, you will require

Bread. Go to the corner shop and get some. Don't fanny about with artisan bread, it's half past ten at night and it's BACON TIME. The bread is just there to stop you burning your fingers.
Bacon. Again, any bacon will do. I used Cornershop Best unsmoked back bacon that probably came from a cylindrical pig in some godforsaken shed somewhere.
Maple syrup. This is where you want the good stuff. The wonderful Ali brought back a litre of it from Canada for me recently, but Sainsburys' own brand is great too. A bit expensive but it's pure, which is important because you're going to be skirting around burning the crap out of it a bit later.
Butter. If you forgot to buy butter when you went to the shop, use a tub of Utterly Butterly that has been in your fridge for a good few months now. 'Letting it mature' works for cheese, and cheese is almost exactly the same as butter. If you use vegetable oil, you are a gigantic fanny and are hereby required to go and eat some carrot sticks or something instead.

As you can see, it's a highly complex dish to prepare.

Stop smoking about fifteen minutes beforehand. You're going to need your nose.
Turn on the extractor fan, because otherwise your fire alarm is going to go nuts.
Turn on the heat on the hob.
Take a lump of butter and put it in the frying pan. Heat enough to melt.
Pour exactly one metric slurp of maple syrup into the butter goo. Just eyeball it, bearing in mind that since you WILL burn it a bit later because you fuck up, too much is as bad as too little.
Get it sizzling a bit and pop in your bacon. A bit of overlap is fine but don't stack it.
Cook bacon until it looks like it's turning a 'cooked' colour. Push down on the bacon with a spatula thing to make it sizzle. This doesn't help, but it sounds awesome.
Flip the bacon over. At this point the side that's been cooking will look like someone has Ronseal-ed it. That's okay.
Cook until the smell changes. At this point, your maple syrup has stopped caramelising and started burning. That's bad. Get the bacon out of there and pop it on a plate.
Place bacon in sandwich, place sandwich in face via mouth.
Rejoice.
Afterward, you may want to go for a run to work off the calories. I suggest running to your nearest A&E, which you should arrive at just in time to collapse clutching your chest.

BEHOLD.

Coming up: Dave decides to try candying every meat he has around, including chicken breast chunks and sausages.

Permalink | Leave a comment »

Untitled

Wed, 05 Jan 2011 06:27:02 -0800

Permalink | Leave a comment »

Untitled

Sun, 02 Jan 2011 16:55:42 -0800

Permalink | Leave a comment »

Untitled

Sun, 02 Jan 2011 16:10:40 -0800

Permalink | Leave a comment »

Untitled

Fri, 31 Dec 2010 21:53:15 -0800

Permalink | Leave a comment »

The Orgasm Bird

Mon, 27 Dec 2010 15:12:20 -0800

Memo.m4a Listen on Posterous

This bird is part of the Dawn Chorus in Singapore. I'll leave it up to
you to work out why I call it the Orgasm Bird.

Permalink | Leave a comment »

Jelly beans and jelly beans and jelly beans

Sat, 25 Dec 2010 04:31:19 -0800

Jelly beans for dessert am BEST.

Permalink | Leave a comment »

Crypto: hard.

Wed, 15 Dec 2010 13:27:08 -0800

Everyone knows that when you're encrypting stuff, key length is important. When you choose a key length, and assume no mathematical attacks, you're essentially betting on Moore's Law being upheld and it taking unreasonably long to brute-force the key for your ciphertext.

Fewer people know that the algorithm you use is also very important. Aside from crack speed - my MacBook Pro, running John the Ripper, can test two million single-DES characters a second but only five hundred OpenBSD Blowfish characters a second - you have to beware of using algorithms with mathematical attacks against them which can make brute-force attacks unnecessary.

The real kicker, however, is modes of operation.

Universal Language

Encryption works with numbers. Really big numbers, but fundamentally just numbers. Any data can be expressed as a really big number. If I want to represent the text

LOLDONGS

I can convert this into ASCII (Unicode works fine too, but just ends up with even bigger numbers). This results in

76 79 76 68 79 78 71 83

Computers like binary, and binary reacts well to being concatenated together, so let's convert that to binary and remove the spaces, as we know each character is one byte.

0100110001001111010011000100010001001111010011100100011101010011

This is a number. We like to think in base-10, though, so just to prove a point let's change it back briefly.

5,498,697,526,314,682,195

Big number, right? Trouble is, as plaintext goes, "LOLDONGS" is actually really small. When we start playing with even just a few kilobytes of data to encrypt, this number gets very big very quickly, and doing maths with numbers that big is hard. So, what we do is we break up the message into blocks. Here, let's use the character boundary (one byte) as a block.

01001100 | 01001111 | 01001100 | 01000100 | 01001111 | 01001110 | 01000111 | 01010011

Much easier. Each block can represent a number no bigger than 256 in base-10 (11111111 in binary), which is a lot more manageable. Now it's time to actually encrypt the data.

The Bitgrinder

Since we've decided that we're going to work on 8-bit blocks, for the sake of example, let's choose an 8-bit key. There are all kinds of key derivation algorithms and caveats for keys, but in this case let's keep it simple. Our key is

01010101

And that's the way it is. We're also going to use a very basic algorithm called XOR, which is a bitwise operation meaning 'exclusive OR'. In binary:

1 XOR 1 = 0
1 XOR 0 = 1
0 XOR 1 = 1
0 XOR 0 = 0

Pretty simple. The result is 1 if the input bits differ and 0 otherwise. But we're not just using XOR for shits and giggles; it's got a really cool feature that makes it perfect as a basis for cryptography: it's reversible.

In the following, x is the plaintext, y is the key and z is the ciphertext:

x XOR y = z

z XOR y = x

How cool is that? Let's look at a real-world example:

10100011 XOR 00101010 = 10001001
10001001 XOR 00101010 = 10100011

We now have the very base case for most symmetric (pre-shared key) encryption, so for simplicity's sake we're going to use just plain vanilla XOR as our algorithm. Don't do this in the real world. Ever.

Now we have to choose how we're going to apply this algorithm. The simplest way is something called ECB ("Electronic Code Book"), but it's discouraged for reasons you're about to discover. Let's apply ECB with 8-bit blocks, again to make it easy for ourselves.

Plaintext | 01001100 | 01001111 | 01001100 | 01000100 | 01001111 | 01001110 | 01000111 | 01010011 Key | 01010101 | 01010101 | 01010101 | 01010101 | 01010101 | 01010101 | 01010101 | 01010101 -------------------------------------------------------------------------------------------------- Ciphertext | 00011001 | 00011010 | 00011001 | 00010001 | 00011010 | 00011011 | 00010010 | 00000110

Brilliant! We can put the ciphertext back together and share it, safe in the knowledge that without the correct key nobody can figure out what it means, right?

Wrong.

Notice that the first and third block, when encrypted, are the same. So are the second and fifth. That's because we operated on each block completely independently, so the same input resulted in the same output. This makes us vulnerable to something called frequency analysis, where we look for repetitions and make educated guesses about the original data. Now, I could go into details about how this works, but the reason I wrote this post in the first place is that I found an even better way to demonstrate why ECB is a bad idea.

The Part With A Penguin

Here is Tux.

Tux is just your everyday penguin. He's sitting down, chilling out, maybe thinking about fish. Now, as we've shown, any data is just a number, and so's this image. If we represent the image as a series of pixels, each pixel having a numerical value describing its colour, we have nice easy blocks to align ECB to. Let's take each block (pixel), apply our cryptography in ECB mode and see what the image looks like on the other end.

Well now. The image looks very different - strictly speaking, what we have here is a completely different image. Trouble is, humans are exceptionally good at pattern recognition when it comes to images. We recognise similarly coloured areas as shapes - we need to do this to understand and react to our environment.

Because of this, we see Tux anyway, if he does look a bit trippy. ECB has transformed the image into something completely different numerically, but statistically there's still a pattern that we can use to work out enough about the original image to effectively break the cryptography.

It doesn't always work that way, but the important part is that ECB leaves enough information intact in the seemingly encrypted data to run serious risks of side-channel attacks.

Now You See Him, Now You Don't

So what do we do to get around ECB? Fortunately, cleverer people than I are out there. There are many ways to improve things, but they all started with a mode called CBC - Cipher Block Chaining.

Because we can assume that the person decrypting the message has the key, we can assume that any mathematical operation performed using the ciphertext and the key will always end up with the same result whoever performs it, as long as that operation is known to all parties. So what we do is instead of using discrete blocks, we involve the result from the previous block in the block currently being encrypted.

Here's Tux after a round of CBC.

Brilliant. We have no guarantees that this is completely secure, but the obvious frequency analysis sidechannel has been blocked.

And that's why we don't use ECB.

Johnny Mnemonic

What should you take away from this? A few things.

Cryptography is hard.
No, seriously. It's harder than you think.
If you're using crypto, you are much better off leaving the bit-banging to cleverer people.
Calling OpenSSL, GnuTLS and/or GnuPG at high levels is almost always a good idea.
AES is good. If you don't trust the NSA, use Blowfish - Bruce Schneier is cleverer than you.
If you're implementing your own crypto, you are almost certainly doing it wrong.
Never use ECB without a form of strengthening unless you have an exceptionally good reason and balls of steel.
Tux wants fish.

I leave you with a mnemonic.

OPACUE
Only Paedophiles And Communists Use ECB

And you're not a filthy commu-nonce, are you?

Super.

Permalink | Leave a comment »

In 1982, this body scanner was just overexaggeration for the sake of comedy.

Sun, 12 Dec 2010 08:18:00 -0800

Things have changed a bit now, eh?

airport-scanners.mp4 Watch on Posterous

From Airplane 2.

Permalink | Leave a comment »

Untitled

Wed, 01 Dec 2010 05:04:49 -0800

Permalink | Leave a comment »