Free society ; some tips

I've recently watched Lessig's presentation on free culture.  It has been recommended to me as an example of interesting use of slides, but it is also an excellent lecture on how copyright stifles innovation and development.  The following is the basis for the whole lecture:

1. Creativity and innovation always builds on the past.
   
2. The past always tries to control the creativity that builds on it.
   
3. Free societies enable the future by limiting the past.
   
4. Ours is less and less a free society.

There's another noteworthy quote (by JC Watts, a US congressman/senator?): "If you're explaining, you're losing."

Regarding tips: perl's CPAN shell is an excellent tool to install packages and their dependencies. However, it uses active FTP by default which is more and more dysfunctional because of firewalls.  Exporting the environment variable FTP_PASSIVE=1 before running will make it use passive FTP.

Few rants...

First: I'm switching from emacs back to vim. It's nice to have everything integrated into emacs, it's calculator is especially good (reminds of HP48), but I've found emacs nearly impossible to use for C++ coding. Namely, its internal parser gets often confused, and it won't let you type a simple colon (':'). Usually closing the file and opening it again fixed the problem, but not few days ago. Emacs simply refused to allow me to type in ':' (as in 'public:'). That was too much for me, and I switched back to vim (I've anyway used vi emulation in emacs; i find concise vi-keystrokes much more accessible than emacs' endless strings of characters in combination with alt/meta..)

Second: ubuntu sucks! I have it installed on my desktop machine on work, because that's "what everyone else uses" and only ubuntu CD's are available for installation. Today I ran the latest upgrade of 8.04, rebooted the machine and I was greeted with half-functional GNOME. I.e. the gnome-panel was missing and had I not had some folders on desktop that allowed me to get access to the file manager and eventually run an xterm, it would be completely unusable (i.e. none of the keyboard short-cuts worked either). Solution? I have no idea -- I installed xfce4 to get a functional desktop. The good thing is that xfce4 does not display the annoying update notification every now and then :-D Anyway, ubuntu owes me compensation for 1.5 hours of lost work time. Talk about "no-cost" software :-P

To hell with climate change, time to speak up for the fish!

Most media are writing about the polar ice melting, polar bears being exterminated.. like anyone's going to notice that they're gone. At the same time, something much worse is happening, and it should deserve at least as much media coverage as climate change: unsustainable overfishing in the seas. This article is a very awakening and scary read. Spread the word and make politicians do something! I've never seen a polar bear, nor do I have a particular desier to see it, but i like very much to eat fish.

[PS. I think that disappearance of any species is regrettable, but I certainly prioritize a food source over some exotic animal. It's regrettable that media don't have same opinion.]

Sudoku solvers and cairo graphics

I have decided to play a bit with constraint programming, so I'm rewriting my logic game solvers as constraint programs. For that I'm using the minion constraint solver to which I interface through python; I wrote a simple parser of minion's textual output. I wanted some pretty-printing, and doing it in purely textual mode has shown to be rather tedious to code. So I turned to the excellent cairo graphics library for drawing solutions. The library is surprisingly simple to use, and also comes with python bindings. Now I'm working on another puzzle, and after cleaning up the code a bit, I'll upload the new package.

Dent game: an example of nonexistant security

In Norway, there's a commercial campaign (ending 15.4.) for Dent candies; you're invited to play a game (www.dent.no), and the best scores win some prizes (the coolest prize is a free cinema-ticket for two valid for 1 year). Since the prizes are attractive, I was wondering what kind of security they implemented. Surprisingly (or not; Norwegian companies have a bad track record with security issues), the answer is none!

Before submitting my result, together with my data (email address and phone number), I fired up wireshark and found out the following:

• They first connect to stats.indexstats.com to report some basic statistics (a cookie with base-64 url, among other stuff, is sent and an empty GIF is returned).
  

• Then a simple POST request is sent with the score and entered data about the user. Everything through ordinary HTTP, and everything in cleartext! Some binary data is returned, but I haven't bothered to figure out what it is.

So it's trivial to record the traffic into a file, change the score, and resubmit the better score by e.g. netcat. (No, I haven't done it myself -- the hardest part seems to be guessing high enough to win, but still plausible score.)

What could have been done differently? It's impossible to secure an application 100% when the user has full control over the computer, but I think that just AES-encrypting the sent data with a key preshared between the client and the server would have risen the hacking bar significantly. You'd have to download the raw flash file, try to find the encryption key inside it, guess the encryption algorithm, etc. If the encryption key is not stored contiguosly in the file, then you'd also have to reverse-engineer the flash code to see what's going on.

In any case, very badly done web application.