Phew

Feb. 9th, 2010 02:00 pm
me
Thesis proposal deadline got extended about a week, so while it's still a rush, I don't have to feel quite so guilty about enjoying a nice day:




(Okay, that photo was actually taken in January, but I did go skating on Sunday. So there!)
me
Another post to Web Insecurity. This one is pretty much explained by the title:


Amex thinks shorter passwords without special characters are more secure

I was working on a background section of my thesis proposal and was talking about how some misconceptions regarding security policies can result in web sites being a lot less secure. But [American Express] takes security misconceptions to a new low...


(Read the rest. And weep. Or laugh. It's pretty terrible.)
me
This post is so short that I figured I might as well copy the whole thing from Web Insecurity. Sorry about the full duplicate!


Barcodes for breaches



qrcode

Barcode: <script>alert("test")</script>

I'm highly amused by the XSS, SQL Injection and Fuzzing Barcode Cheat Sheet. Who knew security attacks could look almost... pretty? It's just standard XSS and SQL injection test code translated to bar codes, so they could be used as injection vectors. I know I've scanned codes to grab an app I want faster on my phone, and I'm seeing codes popping up in the free daily papers, which I find somewhat interesting given that early attempts to get people to use barcodes have met with commercial failure and ridicule. Oh well, it's all ok now that we have smartphones, right?

Anyhow. This is still an entertaining attack vector. Maybe governments (such as my own!) will ban bar codes as hacking tools next?

me
I've rearranged my data feeds so I get more security news, and I'm finding I want to write a little bit about it, so I've resurrected WebInsecurity.net for the purpose of talking about recent security news. It's actually a nice warm-up exercise when I find myself having writer's block while I work on my thesis proposal. That's actually what I was hoping for when I started WebInsecurity.net, but then I found a lot of what I wanted to write should probably be in the proposal and it wasn't working so well as a change of pace. So time to reboot and try something easier to keep myself in good writing form.

So there will be new stuff at WebInsecurity.net and if you're so inclined, here's the webinsecurity.net rss feed or you can go use the fancy-schmancy subscribe buttons on the site itself. Edit: Oh, and there's [syndicated profile] webinsecurity_feed for the dreamwidth folk! (Have I mentioned how much I love dreamwidth lately?)

As most of these are just plain interesting, I'll probably post short summaries here too. So here's today's!


Web Insecurity: Credit card companies covering their ass(ets)
Exactly whose security does your credit card company have in mind? Here's a hint: It's probably not yours.

[B]asically, 3-D Secure [MasterCard SecureCode and Verified by Visa] provides economic security rather than technical security -- but not for you, the customer. It's providing extra security for the banks by passing the buck.

(Read more)
me
I now have a proposal defense date: March 3rd.

I believe the paperwork is still going through, so I won't assume the date is set in stone 'till I get the official call confirming that that works for all involved. But the upshot of this is that I need to get the final draft of the proposal to my committee by Feb 10th. (Oh, did I mention I have a committee? They're awesome.)

Anyhow. Me. Proposal. Less than a week from now.

It's almost there, so while there may be some terror and hysteria happening, it's mostly relief. Promise! But there is still work to do, so if I'm scarce for a bit, don't be too surprised.
me
I've uploaded the photos from the IBM Extreme Blue Case Study Competition on Saturday. I uploaded these on Monday, but I haven't had a chance to caption them yet (and as you'll see from the next post, I may not have time for a little while). You can take a look now anyhow!


Adorable icon care of John
My latest post is at Geek Feminism: Quick Hit: The Safety Dance. It's about inappropriate con behaviour. Here's a teaser:

When I saw The Safety Dance: Helping End Sexual Harassment at Conventions, I was immediately transported back to one of my very first Linux conferences. A friend walked up to me and tickled me, and then was horrified when I told him that that was totally inappropriate behaviour out in public. Why was I so concerned? Because this story from ConFusion is exactly the sort of thing I feared that could follow...


(Read the rest)
me



It was pouring rain last night, and Winterlude has become Waterlude. Such is life. It'll probably freeze again next weekend, but right now I was entertained by the reflections in the puddles on the canal, so I took a few winterlude->waterlude photos.

On the bright side, it was comfortably warm for a walk to the library, and the sunset was pretty too:


chair
This is a letter I just sent to several researchers who were conducting a survey on open source developers. As you can see below, I never answered the survey, and I explain why in hopes that future researchers will learn from these mistakes and present more compelling research initiatives.

Dear Barbara Scozzi and Antonio Messeni Petruzzelli,

I just wanted to let you know why I never took part in your survey, despite the fact that I have taken part in similar surveys in the past.

The first reason should be readily apparent from the subject line of this message: your message really looked like spam. This was especially true when I received multiple copies of the message from your team, to the same email address.

The second is that you sent the survey in Microsoft word (.doc) format, which seems like an inappropriate choice when contacting open source software developers. Typically, OSS developers prefer to use open source alternatives such as Open Office, and many people have been burned by years of MS Word viruses and are justifiably hesitant to open such an attachment. And honestly, I would have preferred to do a quick web survey rather than spend time opening, editing and returning a document to you. There are a variety of survey tools available and I highly recommend you investigate these options for future research. They can make the task of responding to your survey much less onerous for participants.

The third is that you managed to mis-spell my first name in the salutation of the first email I received from your research team, despite the fact that my first name is spelled correctly in the Sourceforge user data you seem to have used to find me. While this may seem minor, this sort of small rudeness did leave me with a negative first impression of your team.

Finally, you may wish to be aware that if you are reaching current GNU Mailman developers, as seemed to be the case, you may do better searching on Launchpad, which we switched to for development over a year ago, if memory serves.

You may wish to take a look at Mary Gardiner's writings regarding how best to present yourselves and your research when doing such surveys. She has a very short summary here:

http://geekfeminism.org/2010/01/04/gf-classifieds/#comment-3355

And further discussion of related issues here:

http://puzzling.org/logs/thoughts/2010/January/6/ethics

Thank you for your time, and I hope this letter helps you engage more participants in your future endeavours.

Terri
chair
The current GNU Mailman logo
The current GNU Mailman logo
My favourite open source project, Mailman, is looking for a new logo.

I volunteer my time to Mailman because I like working with software that helps people communicate, because I like the Mailman community and because I like the other communities it's helped to build. Programming languages may form the foundation for open source software, but Mailman mailing lists often form the foundation for open source communities. And it's not just the open source folk affected by Mailman: Even my local friends have been using mailing lists to communicate for over a decade now. It's just one of those things that has quietly become infrastructure in my life, and in the lives of many other people. Although we don't have particularly precise numbers, it's a reasonable guess that millions of people use Mailman daily.

I'm working on scheduling some of my time so I can work on Mailman 3. Yes, despite the thesis deadlines breathing down my neck. It's worth it.

So if you've got some graphic design ability, I hope you'll be willing to volunteer some of your time for that new logo. :)

Submissions will be open until February 28, 2010.
me
I take part in a weekly photo challenge, and this week's topic was Something With Meaning. I liked my photo and decided that I might as well share the story I wrote to go with it here too.

Clarinet wasn't my first choice of instrument, but my very small little fingers left me unable to fully play the flute, and my teacher convinced me to switch. I was lucky: one of three students selected to do extra music training early in my elementary school, and although I resented being different, those small-class music lessons were something I looked forwards to every week. I became an avid musician, even when my tiny school could barely support my interest.

I continued to play through high school... then destroyed my ability to use my hands right near the end of my high school career. I could barely open doors, or brush my teeth, and I was told I couldn't keep playing. I refused to give up clarinet, giving up instead my ability to take notes, and a lot of pride as I had to ask people to do a lot of little things for me. I got a neck strap and practiced only in small spurts with a lot of pain. I went on tour to the UK with my high school band. I played bass clarinet for the school musical a year later in part because I couldn't handle the upper clarinet parts. But it seemed like I'd always be in physical pain.

But anti-inflammatory drugs, physiotherapy, changing behaviour, and a lot of time can make a huge difference in a repetitive strain injury. I made a full recovery. No loss of motion. No pain. And I still play with a neck strap, but I still play.

So this is my clarinet, the one I bought part way through high school that saw me through the worst of the story. And I'll be bringing it to rehearsal on Wednesday, just like every week.
me
I decided it was time to start backing up my dreamwidth entries. After looking at some of the available clients I decided the quickest way to do this was probably going to be a shell script, and thankfully there was a list of tools for the purpose of backing up livejournal entries.

So, I chose the one that seemed to back up the most stuff, LJSM, and tweaked it for Dreamwidth. This wasn't that much work (I needed to change livejournal.com to be dreamwidth.org in one place, then I needed to fix it so the titles were set correctly in the index) but in case anyone else wants it, here's my modified version, DWSM:

http://terri.zone12.com/code/dwsm.pl

I'm sure I'm not the only lazy person out there who'd do more backups if they didn't have to think too much about it. I think everyone's new year's resolutions should include "make more backups" and I'm doing my part to make this a reality. So here you go: one less excuse!

Instructions



Download DWSM: http://terri.zone12.com/code/dwsm.pl

Basically, you need perl and you need to know how to run stuff from the command line. If this makes no sense to you, you might want to ask someone else for help. For those you know what I'm talking about, you'll want to run something like:

./dwsm.pl -a -u terriko:password terriko

Only you need a real password and probably you'll want to supply your own username in both places. Or only the first if you really want a copy of my journal. Or you can set the second one to any journal name if random acts of backup are your thing. Grab all your friends' journals and print a newspaper! Automate it to run every day and never think about backups again! Whatever. You have fun there!
me
Three links of interest from this week:

Conversations About the Internet #5: Anonymous Facebook Employee: What makes this story so entertaining isn't so much the content (which is pretty unsurprising, IMO) but the way in which it's presented. The drama! The intrigue! My personal favourite is describing eye-tracking, a fairly common technique used to analyze designs, as scary scary "psychological analysis." Seriously fun way of presenting what otherwise would be rather pedestrian information (OMG, Facebook keeps track of your relationships and behaviours! Like, oh, every other company that has any data about you...)

Programmers need to learn statistics or I will kill them all: You'd think there's no way that the essay could top the title, but it's actually a fantastic explanation of the problems many programmers have with statistics, as well as a reasonable rant about how little they care when they're told they're wrong. I've seen these mistakes in high-level peer-reviewed "scientific" papers in my field, and it kind of drives me (and many others) crazy. So if you're a computer scientist, go click that link and make sure you're not making those mistakes. You don't have to be stupider than slime mould, mathematically speaking.

An interesting side-note in that paper, for the women:

"Oh, and you wonder why I say, “he”? I never have this problem with female programmers. Maybe it’s because I’m tall (6’2”), or nicer to them, but they always speak rationally and are really keen to learn. If they disagree, they do so rationally and back up what they say. I think women are better programmers because they have less ego and are typically more interested in the gear rather than the pissing contest."


I leave interpretation of these remarks up to you. *grin* They don't have statistical significance anyhow. But either way, read the essay: it's a snarky but awesome and clear explanation of common statistical errors.

ProtectMarriage.com issues Cease and Desist for Prop 8 Trial Tracker logo depicting family of two mothers with two kids: ProtectMarriage.com threatens what seems to be a spurious lawsuit regarding a logo that is quite covered under parody laws. Prop8trialtracker.com hires the best lawyer ever, who responds with a rather impressive letter. I find it awesome that you can cite case history regarding entertaining stories like the slogan "Open up a Can of Woof-A**" -- I guess it's not entirely surprising that trademark case history will include a lot of funny/embarrassing examples, now that I think about it. Still, kudos to the lawyer who put together something so funny and clear on such short notice.

Dog Walking

Jan. 3rd, 2010 09:26 pm
me
For a while now, I've been wondering about volunteering as a dog walker for the humane society.

Some thoughts:

- It's a non-trivial time commitment.
+ It can replace my fitness class, and I manage that time commitment fine.
- I don't think I can skip out as easily (not worried about weather, but deadlines and exhaustion).

- I haven't had formal obedience training, which they imply they'd want.
+ I did grow up with a dog, and have walked dogs with varying levels of training.
- I haven't got a lot of experience with larger dogs.
+ But I have managed medium-sized ones fine.

+ I've had two people offer to come with me
+ So it'd be a fun, active activity with friends where we're doing good for the community.
+ And unlike my fitness classes, this one's free!

- It may be incredibly hard to avoid falling in love with the dogs.
+ But I can't reasonably own a dog in the near future, so this could be a nice compromise.


So the question in my mind is mostly, "would they accept me as a volunteer?" Their page makes it quite clear that they prefer more experienced walkers, but I figure there's no harm in asking, and I think I'm trainable if they're willing. I'm going to wait 'till mid January when my latest paper has been submitted and I have a better sense of my schedule for this term.

But if anyone has done this or has any advice, or suggestions for other neat things I could do if they don't want me for this... I'd love to hear it.
me
Recipe for Katamari Cookie (there can be only one?):

1. Bake some gingerbread and sugar cookies
2. Place cookies a little too close on the cookie sheet
3. Put them in the oven and let them become one disturbing mass
4. Cover with all the icing you can find
6. Roll up a little bit of every type of sprinkle available
7. Continue rolling up other cookies, candies, decorations, people, the family dog...
8. (optional) Try to get the darned song out of your head


me
A friend asked for the recipe, and since I've typed it up, I might as well blog it!

Mom got it out of some very old Chateleine magazine, but I don't seem to have noted the month/year.

Ginger Cookies (Chateleine)

1 1/2 C shortening
2 C sugar (original was brown or maybe half-and-half, but I use white)
2 eggs, beaten
1 C molasses
4 1/2 C flour
2 tsp soda
1 tsp salt (I usually omit this or just put a pinch)
1 tsp ground cloves
2 tsp ginger
2 tsp cinnamon

Cream shortening & sugar, add eggs, add molasses, sift rest, stir.

350F ~10 minutes (depending on how thick you make them)

If you make them thicker (or make sure you put them in a sealed container before they dry out) these can actually stay chewy for a few days. Otherwise, they can become stereotypical crisp gingerbread, perfect for dipping in milk.




The Dalek cookie pictured featured chocolate icing and silver balls, since that was the closest we had to appropriate accoutrement for a Dalek cookie. Dan hand-formed it, so don't bother asking me where you can buy Dalek cookie cutters (although I wouldn't be surprised if they exist...).
me
On the whole, I like my students. They are smart, creative, awesome folk who astound me by what they know as often as they astound me by what they don't. But when I'm marking, these fascinating individuals somehow manage to come across as the most annoying intellectual toddlers. I honestly don't think most of them mean to be rude, they just don't realise what they're doing. So here's a few things that have irked me this term, why they bug me, and how you can avoid ticking off the person who controls your marks. I doubt tutorial centres teach this kind of learning skill, but maybe there should be courses in, uh, university etiquette with regards to communicating with your Teaching Assistant (TA).


1. Don't ask for more marks while your TA is still marking. As in, if your mark was posted 5 minutes ago, it's too soon to ask. If your TAs are marking more than one thing at once (e.g. a midterm and an assignment) you should probably wait until both are done.

Why shouldn't you do this? If your TA gets an email while they're still busy with other students' work, they're going to be (a) too busy to help you immediately and (b) may forget by the time they have time. TAs are also students, and have to set aside their own work while they mark, so they've got other stuff piling up and want to get back on top of that before dealing with you. Your query will be about as welcome as a yappy, biting dog, and some TAs are seriously vindictive about remarking.

What's better? Wait a few days before sending that email, or better yet, come to office hours where the TA is being paid to help you right then with whatever problem you bring forwards.

2. Don't say things like, "I didn't have time to edit this." My knee-jerk reaction to "I didn't have time to edit this" is "well, in that case, I don't have time to mark your unedited crud either."

Why shouldn't you do this? It says, "I didn't care enough about this assignment," with a dose of "I have poor time-management skills," and potentially "I don't care if you have to wade through absolute drivel to give me a mark." Not polite, and encourages your TA to do a half-baked job of marking to match your half-baked job of writing.

What's better? Editing your assignment. But failing that, just a quick "sorry" before "I didn't have time to edit," can make a huge difference in tone, thanks! And if you're submitting a buggy program rather than an unedited essay, some information about the known bugs can go a long way towards good will.

Corollary: That said, while I'm suggesting an apology here, you don't really have to apologize so much for asking for help during office hours. I like helping people (I just hate marking) and we're being paid by you, to help you. So I like the politeness of it, but please please please don't feel guilty about pulling me away from whatever I'm doing to kill time until someone needs help!

3. Don't just email the first TA on the list or the easiest to find TA every time you have a problem.

Why shouldn't you do this? Half the mail I get from students I have to forward to the other TAs because someone else was in charge of that question, or that tutorial section, or wahtever. Waiting for me to notice and forward the mail on delays you getting a response (and introduces more places where your mail might get forgotten), so it's really better for both of us if you get it right!

What's better? Try to figure out who marked which assignment and contact the appropriate TA. Ideally this would be easy to find, but university courseware is often terrible, so if it's not, try asking or just email all the TAs so that the appropriate one can respond. The latter is what I do if I get an email from a student whose problem is not mine to deal with, anyhow.

Side note: I get the lion's share of email from students, and they often tell me it's because I'm the most memorable, friendly, approachable or helpful TA. Which is sweet and a great ego-boost, but no matter how much you like me at a teacher, I'm still not always the right person to email!

Heh. Not that I'm going to win any awards for being approachable after this post!

4. Don't be unprofessional. This term I learned that one of my students can't spell a word that most definitely should never have come up in our interactions, let alone in one of his assignments. And that's only one of many not cool things I've seen this term (and others, but this one has been particularly bad).

Why shouldn't you do this? Do you really need to ask? It looks bad, and can even hurt your future when someone says, "Hey, what do you remember about student A?" and the answer is, "he won the award for most swearing in assignment 3 and then whined through the second half of term." Seriously, we gossip about you within the school, and a recommendation from a TA can decide whether you get the honours project supervisor you wanted, or potentially even the job you wanted.

What's better? Being professional and being polite. You don't have to be absurdly formal all the time, and you can express your displeasure regarding the course if you need to, but if you can't read your assignment to someone else's grandparents or a potential employer, you're probably doing something wrong.

Edit: See the comments below (click the dreamwidth link on lj) for more excellent tips provided by others!
me
I never knew it was possible to feel both so energized and so exhausted from a single day conference. TEDx was amazing, and I've got about a billion ideas firing in my head about teaching, communicating, passion, music, and great ideas. But I can barely look at a light without wincing, so although I feel guilty for missing the after party, I think I'm going to grab a light late dinner then curl up in bed early tonight.

Here's something unusual about the conference to get your brains going while mine sleeps, though. We were asked not only to turn off all our beeping devices during the lectures, but also asked specifically not to tweet about the event until a break happened.

As an attendee, I loved the visual quiet of not having people constantly opening phones around me. It helped me be that much more engaged in the talks. I actually like turning off my phone, and I had just watched Renny Gleeson's talk on antisocial phone tricks, so this rule seemed like a pretty neat idea. (PS - watch that video, it's 3 minutes of cell phone behavioural hilarity.)

However, while I'm willing to give up tweeting during a conference, I also know that tweets from my friends are a large part of the way that I engage with conferences I'm not attending. Knowing this, I guess, there was a designated tweeter who put stuff on the TEDxOttawa twitter stream but... well, go take a look at it. I'm too tired to articulate why, but I look at those tweets and feel like some of the magic, the passion, the enthusiasm just isn't shining through there. And if you look at the tweets using the #TEDxOttawa hashtag now you'll note that they're all like "woo, it was awesome, thanks!" which is nice, but again not particularly engaging to outsiders.

So while I actually liked putting away my cell phone, I'm also bit sad that I couldn't bring a piece of TEDxOttawa to my friends and followers while I was there, and I feel like TEDxOttawa missed out on a lot of potential buzz they could have gotten from excited attendees.

If you were organizing a conference, would you suggest this to attendees? Would you like this policy if it had been imposed upon you as an attendee?

And I'll leave you with one more thought: Ironically, one of the talks was about learning, and the presenter specifically suggested that we'd remember more of TEDxOttawa if we wrote about it. If only we could have tweeted! ;)
me
This post was originally written for my local Women in Science and Engineering chapter's blog. I'm afraid it's not my best writing, as I found the experience a more upsetting than I'd hoped, but I think the day we were marking is of particular interest to folk who read my blog, and not all of you may be aware of it.

TRIGGER WARNING: this post discusses actual violence against women, specifically the story of the École Polytechnique Massacre. There's little graphic detail here, but several of the links in this post contain fairly disturbing information.

In Canada, December 6th is the National Day of Remembrance and Action on Violence Against Women. The day was chosen as a memorial to those killed in the École Polytechnique Massacre, which happened on December 6, 1989. On that day, a lone gunman walked into the school and killed 14 people, injuring more, before turning the gun on himself. He claimed that feminists had ruined his life and that the young women engineers he targeted must be feminists because of their non-traditional career choice.




Members of CU-WISE, GSA, IEEE WIE, Womyn's Center, Foot Patrol, and MEN were out in the unicentre on Dec 3rd to raise awareness of the issues, and to raise money for a pair of women's shelters in the area which burned down. At 1pm, we held a candlelight ceremony in the unicentre:




After the ceremony, we showed the new film, Polytechnique. I made the mistake of staying to watch part of it. Not that it is a poorly done film, but I found it quite deeply disturbing. Mark Lepine's suicide note actually sounds too much like the death threats I, and many other women involved in the open source community, have received from another deranged individual (trigger warning: the link is to a post which discusses some of the vile stuff he says). And after watching part of the film, I then had to walk through Carleton's halls, which share some of the same institutional feel to the hallways of École Polytechnique. I will caution that this film can be highly disturbing, and note that I will likely never watch the rest of it.

However, despite my misgivings with the film, and the unpleasant feelings that come with marking the date of the Montréal Massacre, I think it was a great opportunity to talk to some of our wider university community about the history and the issues.
me
A couple of my friends have gotten hit with stuff that's hijacking their accounts as a way to send spam to Facebook. The latest one sent something about www,ArticleBooks,cn which looks like a standard scam (although if I were you, I wouldn't load that -- I'm just putting it here in case someone searches for it).

As a web security researcher, I'd like to offer some advice. The safest advice would probably be either "don't use any Facebook apps" or "don't use Facebook" but we all know you're not going to do that just because someone sent spam in your name.

So here's a few more reasonable tips that might keep you and your friends spam-free:

1. The problem probably won't be caught by your virus scanner. Do a scan -- it won't hurt -- but if it comes up negative don't assume you're safe.

2. My personal bet is that the Facebook stuff is caused by a rogue app. Uninstall ALL applications you are not using to be more safe. This may be a legitimate application which was hijacked, so you're safest uninstalling as much as possible.

3. Do NOT install any applications used by friends who have sent spam messages. Especially if you get a message like "$infected_friend has send you a gift!" or something: these are common ways for Facebook "viruses" to spread.

4. Consider installing an ad-blocker. Advertisements could also have been used to hijack your Facebook. I highly recommend you use AdBlock Plus on Mozilla Firefox, as some other ad blocking software is sketchy.

5. They may not have stolen your password, but it can't hurt to change your password after you have uninstalled all your apps.

6. If you were hit on twitter, or even Facebook, it could also be some site you visited that hijacked your browser. Check your history and try to warn others if you figure out which site it was!

Profile

me
terriko

February 2010

S M T W T F S
 123456
78910111213
14151617181920
21222324252627
28      

Syndicate

RSS Atom

Layout Credit

Layout:
Yvonne