I’ve decided to take this time to complete the One Hundred Push-ups challenge. It’s a 6-week program for people of any skill level. You start out with an initial test to see how many push-ups you can do right now (I did 50).

From there, each training week has 3 days in which you workout, with each workout taking about 7 minutes. On Week 1, Day 1 I’ll start out with the following sets of push-ups: 10, 10, 8, 6, max (at least 7). By the end of program I’ll be doing: 56, 45, 42, 40, max (at least 56).

I had been working on my own ORM solution but I think PHPFour’s library has a much better approach - it feels more like CodeIgniter to me than my own solution. I’ve yet to dig through the code extensively but upon first glance I didn’t notice any relationship methods which would definitely be a worthy addition to this library.

Finally, I’d like to offer an errata to their installation instructions:

1. Replace the system/libraries/Model.php file with the attached Model.php (CodeIgniter version 1.6.3)

Should be:

1. Rename the attached Model.php to MY_Model.php and place within your application/libraries directory.

We all know you shouldn’t be hacking the core…

The basic premise behind the service is simple and has been accomplished in the past. Designers usually present more than one concept to a client and when the client makes their final decision, the left over designs don’t have anywhere to call home. Designers will often keep them around for future clients or personal projects, or even place them up for sale on template sites. Clever Andy, at first glance, is pretty much the same thing.

But - here’s the twist (and it’s a big one): Clever Andy doesn’t sell your design off to someone else. That wouldn’t do your design justice (plus, you wouldn’t make as much money). Clever Andy actually takes your design, turns it into a full-fledged operational ExpressionEngine site, actively seeks out clients that need the applications, tweaks it for the specific client, and then sells the entire package to them.

What’s in it for you? A 20% commission off the sale of the entire sale price (not just the design portion, the entire application’s sale). Clever Andy also sets up a Basecamp account, Mint stats, email via Google Apps for Domains, and hosting on EngineHosting.

Clever Andy definitely sounds like a great concept - for designers and customers alike. I’m definitely looking forward to seeing some of the work they release!

This practice of having a profile everywhere but rarely using it does not seem to exist only within my own little world - most people I have discussed with have done the same thing (made a profile everywhere but use very few). This is somewhat disconcerting, especially as I work on a social network for a client and a personal project of mine geared towards poker players. Luckily, both of these projects have other motivations and goals behind them - not just the social networking aspects of the service.

Anyways…

I recently signed up for Last.fm because I have difficult time remember the names of bands and songs I like. This service is absolutely awesome! I spent a few hours last week setting up foobar2000 exactly how I want, getting registered on last.fm, and now music recommendations hit my inbox once a week based directly off of what I have been listening to.

I know I’m not using the service to it’s full potential, though. I’m not very concerned with writing a blog about the music I listen to or finding concert tickets (not to many concerts on Dirty Tampa, lol). But, as a music recommendation engine - last.fm is top-notch!

I’ve setup a group for CodeIgniter developers - if you are already a last.fm member feel free to join. If you are not a last.fm member but, like me, you’re listening to music if you are awake, I highly recommend joining. Finally, feel free to check out my profile and be amazed at my taste in music - everything from KoRn and Godsmack, to Britney Spears and Justin Timberlake, to Three 6 Mafia and Lil Wayne.

If it’s not country, I enjoy it and there are a few country songs I’ll even listen to as well (it must become more prominent with age).

I’ve been debating how to stay in contact with my wife without literally killing myself. With her in Alaska, the prime time to call her is around 10-11 PM my time. On top of that, I have to walk a mile and a half to the nearest phone, wait in line, deal with base operators, crossed phone connections (I don’t want to hear about the crazy, sexy dream you had about your wife - I’m trying to tell my wife about the one I had of her).

So, early today, it just clicked: Skype! I can even continue using my phone cards for free and when those run out, it’s only $0.056 per minute which is cheaper than any phone card I’ve seen around and about three times cheaper than the cell-phone places here. Plus, I can lay right in my bed and talk to her - whenever I want.

The sound quality is great which is saying a lot for their service because our connection sucks (average 10k/sec download). Expect to see Skype gracing the Recommended Products section in the sidebar. I’ve always enjoyed it for quick chats with my clients but I never really “got it” until now - I’m so excited.

My fifth book, which isn’t on the list (since it’s not Sci-Fi) is To Kill a Mockingbird by Harper Lee.

Based on a Avnet Labs benchmarks, it appears I have another reason to stick with CodeIgniter - it’s amazingly fast. This really comes as no surprise, it’s something we’ve known since the beginning.

Additionally, Avnet has posted a feature-by-feature breakdown between the two frameworks (the precursor to the benchmarks).

This is a great opportunity for Powerset - they’ve yet to go public with their entire product (they currently only allow searches of Wikipedia content - it’s really good, too) and Microsoft is sure to benefit, but are they going about this the right way?

Google owns search. It’s been this way for a long time and despite Google’s best efforts their brand has become synonymous with search (This branding leads to a “watering down” of the brand making it less powerful - think of Kleenex. How many of you have a different brand of facial tissue sitting around the house yet still call it Kleenex?).

So, Google’s been dominating the search market forever and as we all know - people are biased, prejudice, and come to every table with predisposed opinions in regards to the rest of those around the table.

Google: Best search engine their is - great bonuses (Apps for Domains, Mail, etc). Are they spreading themselves to thin? They have a bad habit of ignoring some of their bonuses.
Yahoo: A portal - most of their stuff is easily replaced with newer, more engaging content. Flickr and del.icio.us are nice. Should have sold to Microsoft. How much are they really contributing to this Google/Yahoo search Flash content idea?
Microsoft: uhh… probably better than Yahoo, I don’t know. My wife uses MSN Messenger to IM me (I use Pidgin). Microsoft/MSN/Live - can’t they pick a name and stick to it?

See what I mean? Adding Powerset to Live Search is a waste of the technology! I’m sorry Live but you will never become king of search - at least not apparently.

Here’s what should have happened: Microsoft acquires Powerset and leaves them alone. Let the team keep doing what they are doing, developing a technology that will surpass Google one day. I’m not saying Powerset is the company that will do this - especially not as Live Search - but the technology itself is the future of search.

Google was spread by word of mouth by a bunch of us nerds - I still remember when I first was told about it, on mIRC. I’ve used it at least 80 times every day since that first introduction - it was small, simple, and just a bunch of nerds making something better.

Powerset didn’t quite have the small, simple, and bunch of nerds parts down - it’s had quite a few highly publicized multi-million dollar rounds of financing. But, it easily could have taken the “word of mouth” tactic and spread like wildfire through the nerd community. That’s the key to search - the nerd community. When my wife/mom can’t find something on the Internet they ask me and I always reply, “Google this: [well formed search phrase].”

What if I would have started saying, “Powerset this: [natural language search].” It will never happen with Live in the header…

I’ve taken this as a note to rewrite that article as well as to extend it a bit…

Computer systems in general and your web application especially, never store passwords in plain-text. This is a very basic concept - if you don’t quite grasp the reason behind not storing passwords as plain-text I’ll take the stance of security expert Matasano Chargen and advise you to use someone else’s security system (Redux, for instance).

I’m sure we are all aware of the fact we should not be storing passwords at all; rather, we should be storing a hashed string representing that password. By hashing the password, we theoretically create a one-way encryption mechanism whereby the original password can not be restored. We then validate users by using the same hashing algorithm on their input and check if the two hash strings match.

Let’s look at the following code for example:

function password_check($password) {
  // This is the valid password hash - let's pretend it came from a database
  $v_password = 'af2c41eb4e034ed0a417d1ec637082072a4d3aae';

  // Load our security helper, so we can use the sha1() function
  // if our server doesn't have it already.
  $this->load->helper('security');

  // Check if the hash of the passed password === the valid password hash
  if (sha1($password) === $v_password)) {
    return TRUE;
  }
  return FALSE;
}

Now, I bet you are looking at that string af2c41eb4e034ed0a417d1ec637082072a4d3aae and thinking, “Man, that’s pretty secure! There’s no way I could guess what that password is.”

Let me show you a little trick, thanks to our good friend Google. A quick search for that hash string returned this text file, that has loads of hash strings for a variety of English words. One of those words happens to be wizard, which also happens to be our password.

So, if we can’t hash a string and be safe - what are we to do?

The most common method of securing a user’s password is by adding a little salt. By assigning each user a random string (the salt) and appending that to the password string, prior to hashing it, we have significantly improved our security.

Using the same code example as above, but now adding in the salt:

function password_check($password) {
  // This is the user's salt - which we pulled from a database
  $salt = 'Pr8Qm7ahY';
  // This is the valid salt + password hash - let's pretend it came from a database
  $v_password = '2dab11e9958c2e785ec6dbaaa4fc461969531b01';

  // Load our security helper, so we can use the sha1() function
  // if our server doesn't have it already.
  $this->load->helper('security');

  // Check if the hash of the passed password === the valid password hash
  if (sha1($salt . $password) === $v_password)) {
    return TRUE;
  }
  return FALSE;
}

The first thing you should have noticed is our valid password hash changed - significantly. I invite you to Google that string - you won’t come up with any results (well, maybe this page after the GoogleBot pays me a visit - but nothing worthwhile).

So, is it unstoppable? Absolutely not - by no means. I think it’s safe to say that any string that is encrypted can eventually be decrypted. Security isn’t a practice in making an unstoppable algorithm, you simply need to create an algorithm in which the return is not worth the time invested in cracking it.

The password within this system could easily be cracked by simply hashing every possibly combination of characters. Using our salt + password (which is 15 characters) and our character set ([a-zA-Z0-9]) there are 2.40656038 × 10⁷³ possible combinations.

I ran the following code on my laptop 5 times, within the CodeIgniter framework, to come up with an estimation as to how many 15-character SHA1 hashes your average computer could process. Please bare with me, I realize this is a fairly arbitrary number that could be astronomically improved by changing any of the included variables (compiled low-level language, dedicated system, more RAM, faster processor, etc). Additionally, I am hashing a randomized string each pass rather than incrementing one of the character positions in a structured manner (which is the preferred method of a brute-force attack of this nature).

function time_sha1($loops = 10000) {
  $this->load->helpers(array('security', 'string'));

  $this->benchmark->mark('loop_start');
  for ($i = 0; $i < $loops; ++$i) {
    sha1(random_string('alnum', 15));
  }
  $this->benchmark->mark('loop_end');
  echo $this->benchmark->elapsed_time('loop_start', 'loop_end');
}

This gave me an average of 0.65142 seconds per 10,000 hashes, or 15,351 per second. So… on my little laptop I would only make it through 484,430,371,026 after a year of searching! It would take 4.96781483 × 10⁶¹ years to test out every combination (and that is assuming I knew the length of the hash and password together was 15 characters).

There are definitely some good conversations discussing the merits of slower encryption methods (mcrypt and bcrypt, for instance). The slower your encryption method the more secure your application is from a brute-force attack of this nature, but (and take this for what it is worth) in my experience and in my past projects, I have had little need to go beyond the salt + password hash algorithm. Of course, this all depends on the application you are working with - banks, government agencies, corporate intranets? Sure, you have the horsepower and the need for a higher level of encryption than most of us will ever need.

Next time: What to do when a user forgets their password.

Alaska, my state of residence, is second only to New Hampshire in regards to broadband adoption rate. 62.5% of homes in Alaska use a broadband connection, compared to New Hampshire’s 64.9% (data was taken from the U.S. Census Bureau’s 2007 Current Population Survey).

I definitely encourage everyone to look over the Internet for Everyone website, a lot of good information there and hopefully they can get something accomplished in Washington.