The latest oil spill, as reported at
the BBC

Contains the gem:

The department's spokesman added that it understood from Shell that there was a "finite amount of oil that can be dispersed"


I think we knew that already....

Images from Mull in a separate blog :

Mullpics blog

Some images from Mull, July 2011

My Photos from last Summer, Bilbao and The Pyrenees

Exams by computer

I'm waking up slowly the other day, and one of my pleasures is to listen to Radio4 before I drag myself out of bed to face the day. Isabel Nisbet, the outgoing chief of OfQual, was on. She has a lovely idea: the youth of tomorrow should do their examinations on computer.

Well, fine and dandy. Let's just imagine that we're a sixth form college or around 3000 students. We have two years, both of which do exams in the summer, and there is some overlap in the timetables.

Soooooo....we could have around 2000 students doing exams at the same time. Now, we need a bit of leeway, and we have a three year replacement cycle so...

• I need to build a network to manage 2000 computers
• I need to buy around 700 a year to replace old ones- that's a budget of around a quarter of a million a year on computers alone.
• I need, ooh, 40 computer rooms - which I don't need the rest of the year.
• Oh, and they need to be secure for exams.

If Ms Nisbet can tell me where that lot is coming from, I'm up for it.

Reporting SPAM...

I even had a reply from the nice lady at the SPAM reporting centre, apologising for the SPAM blocking stuff.

She suggested I sent my emails in by post.



AAAArghh.......

Yay! Someone, at last, has created a repository for fraudulent spam emails to be analysed and "dealt with".

It's http://www.actionfraud.org.uk/

and, lo and behold, they have created an email address to which we can all send fraudulent email, once only, so they have a record.

It's

email@actionfraud.org.uk


I sent a couple yesterday. I spend some time copying and pasting the full headers. I don't know if these guys knw something I don't, but I need the headers to work out what is going on. Just copying the email is a pure waste of time.

I tried to send a couple more today. Spent a few mins on the headers, as yesterday.

I get a 550 on the first one - it just said it was SPAM. Well, hey, I knew that already.

Here's the second:

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  actionfraud@attorneygeneral.gsi.gov.uk
    (ultimately generated from email@actionfraud.org.uk)
    SMTP error from remote mail server after end of data:
    host cluster.gsi.messagelabs.com [85.158.143.19]:
    553-Message filtered. Please see the FAQs section on spam
    553-at http://www.messagelabs.com/support/ for more
    553 information. (#5.7.1)

So, hang on a mo. They're asking me to send SPAM to this address, and messagelabs, bless 'em, are filtering it all out.

So, someone, somewhere hasn't really thought this out properly...?
Nothing new there.

Had a phone call from a very IT literate guy in another, similar school yesterday. His head is worried about security, and won't use the EMAIL system because he is convinced his email is being read by the network people.

Well, no surprise there then. As a protocol developed in the 1970s for email between friends on ARPANET, the whole thing is inherently insecure.  We use kludges to encrypt at various stages, but it's difficult to tell someone that an TLS SMTP transaction doesn't mean the email is secure on the IMAP server it ends up on.

Then, of course, there is the statement that it's all but impossible to secure files kept on a file server to which someone has physical root access.

Most of the articles on IMAP security consider only an encrypted exchange with the server.

So, the only way his emails are going to be secure is if he elects to use PK Encryption (or equivalent)  on his email client. But this is just far too unwieldy for the untechy types using email these days. The costs outweigh the benefits.

So one trots out the other line. Email is about as secure as stuff on the back of a postcard.

My PK is (0x) 35168699

The guy wasn't too pleased his email wouldn't arrive. He'd tried several times, so one of the support staff asked him to play our usual trick of emailing us and CC a gmail address so that we have a time fix, and a server name.

Only this time the gmail didn't arrive either- and the guy was clearly getting irate, so I got involved.

After an hour or two, the penny dropped. the outward facing email server at my end (exim - a truly wonderful piece of code) was checking the incoming HELO for syntax. His HELO had an underscore in. So the fix was delightfully simple:


helo_allow_chars = "_"

in the configure file and

killall -HUP exim

at the command prompt.

About 5 mins later, his message was accepted.
But why do I have to break my server from spec? Well, he's a potential customer, with an exchange server and MS trained guys who don't know anything much about the RFCs for hostnames not containing underscore characters

I did have what I think is an effusive email from him. I suspect he's not too chuffed with his techies.

http://en.wikipedia.org/wiki/Anti-spam_techniques

I've been fettling our email system at work - implementing a proper, locked down SPF, and DKIM signatures on all outgoing email.

SPF has been fantastic at cutting down the amount of SPAM coming in from forged domains - yahoo, in particular. So I have been looking round at how other domains implement SPF.

A lot of domain admins seem to misunderstand it. The presence of an SPF validated sending IP address is no statement of HAM-ness of the email. However, the absence of one in a domain locked down with -all most certainly is.

Enter a big UK bank - let's call them Hickleys. They have SPF set up on email.hickleys.co.uk, and it's -all too, meaning that it's definitive: if the IP address isn't in that definition, then it's a fake. Fantastic.

The only problem is that hickleys.co.uk doesn't have any SPF entry at all. So I can  go forge email from fraud@hickleys.co.uk and send it to the world with no SPF cover whatsoever. Which member of Joe Public is going to realise that all email from Hickleys has to come from email.hickleys.co.uk, not hickleys.co.uk. And blocking email from the TLD, and allowing it through from the email subdomain is interesting to say the least.

Then, of course, there are all the little players out there running with a +all SPF setting. There is a delightful little Canadian firm of Lawyers who's email domain is spammed a lot (by third parties, obviously) at work, because they have said "anyone, anywhere in the world can send email from us" in their SPF definition...

(That's SPFending with +all)

The Digital Economy Act

Is a cracking piece of legislation. Essentially, for private individuals, the ISP will be required to send you a letter telling you you're breaking copyright. they may even have to cut you off.

So, what if you share your connection? I work for a school, and have a 50MBps connection shared out amongst 700+ users. Well, that's easy. Under the act, we register as "Communication Providers".

The problem is that there's a Judicial Review. No-one knows what the rules are for Communication Providers. Our (new) ISP is sitting on the fence.

One thing is certain: if we aren't a "Communication Provider", we've got a problem. If we are, we have a huge cost - CPs have obligations under the act which are not particularly cheap to manage.

What a stunningly appalling piece of legislation.

swivel

I think the almost silent death of swivel, the flickr for data, if you see what I mean, has upset me almost more than any other cataclysm in the history of the web.

 

Here was a site which was full of fundamentally useful stuff, really well presented.

But, apparently, no business model. No-one was prepared to pay for the data. Course, I was also a no-one. I pay for flickr. Why not data? I guess I felt a lot of it was in the public domain already: why pay twice. But of course, you’re not paying for the data, you’re paying for the really really slick way swivel processed it for you.

Only got myself to blame.

SkyDrive?

For a variety of reasons (professional, largely) I run a Microsoft OS. I have been running Ubuntu at home for a few years as my main system, with XP sitting on a creaky old box. That box has all but died, so I replaced it, and set about exploring Windows 7

I’ve been using DropBox on all my PCs for ages. It’s delightful. It has a very small surface area, and it just works. I login, and it copies files from the cloud back into my dropbox folder. Anything I put into the dropbox folder gets copied up into the cloud. Because the files are local, I can work on them directly. The DropBox folder, on Linux, Mac or windows, works in exactly the same way.

 

I was quite excited when I saw skydrive. 25GB of space is a tasty amount (Blush- I am on the free dropbox, still). And there’s a 5GB “sync” folder, which sounds like DropBox, sitting in the wings. Or is that 5GB part of the 25. Anyway. I played.

The only way into this seems to be up and download. Once uploaded, I can’t find a way of moving the files around. Nor can I map it, reliably. I can map it using DAV, but the URL is horrible, and who’s to say it won’t change? And can I legally do it?

So I slowly shifted interest to the 5GB of “synced” storage. Only MS have discontinued Live Mesh, or whatever it’s called, for XP and, of course, there was never a product for Linux or anything else.

So, I have 25GB of “free” space which has such limited connectivity it’s useless, and 5GB of synced storage which will only sync with Windows 7 (and, presumably Vista). And, at the moment, I have a file in my synced folder which hasn’t appeared in the cloud. Who knows why?

Sorry Guys. DropBox wins hands down. It’s a simple idea, well executed which works on all platforms.

It’s been interesting coming back to look an Microsoft’s desktop products after a year or two in Linux land. The stuff that works for me is simple, orthogonal (works the same way on different platforms) and rock solid reliable. Products which are driven by sales and marketing just evolve in a different way. They have to be feature driven, and the features have to change. Most users I come across are in what I call the “One Micron club”. If their desktops change icons by more than one micron, they ring support.

 

Oh, and Windows 7 reports itself as Windows 6.1 internally. I guess the dreaded vista was 6.0

Clever SD cards

I'd been eyeing up those clever orange SD cards which advertise not only storage, but geotagging images in camera (very tasty) and wireless upload to the home network and to public sites like Flickr. It would have been nice.

So, I ordered a 2GB card and unwrapped it eagerly.

First, erm, moment was setting the card up. the management software appears to be online, somewhere in the cloud. So the home router has to be unwound to allow the package to act as a server. There is, no doubt, a perfectly reasonable reason for this - it allows the camera to upload when the computer with the management on it is turned off. The upload then occurs to the cloud. Turn your PC on and back come the images. But security issues aren't made clear, or even addressed in any transparent way. Of course, it has to connect to your WPA secured network, and it needs the WPA key. That isn't stored locally - it's stored "in the manager" - i.e., in the cloud, on the internet. So hang on a minute - I've just given my WPA key to someone I don't know on the internet?

Then I tried to use the card. I've tried it in two cameras - a G9, and a Panasonic G1. In neither case can I get the card to download. You're instructed to change the battery / power settings to prevent the camera turning off, but it still won't play. It's much quicker and less troublesome to take the card out and drop it in the SD slot on my laptop. Wirelessly, it gets about 1/4 the way through then drops out. I can't find a way of kicking it manually.

Then there's geotagging. I might have misunderstood this. I'd (fairly naturally) assumed GPS. But it isn't. It uses the Skyhook system - it locates using a combination of known MAC addresses of wireless networks, and telephone masts. Well, that might be as accurate as GPS, but I have no way of knowing. The Skyhook system, certainly in the UK is pretty patch, and since most of my images are taken in fairly remote locations - certainly well away from wireless networks and often out of cellphone coverage, I have yet to get an image geotagged. If you visit skyhook's coverage map it looks quite good to start with - but zoom in, and reach your own conclusions. I take photographs south west of Shrewsbury, largely....

And finally, flickr. Well, you can get them uploaded to flickr, but it's a subscription service. You have to pay the SD card people annually...

No thanks.

Ubuntu 'more secure' than Windows, says Dell • The Register

Ubuntu 'more secure' than Windows, says Dell • The Register

There's an interesting line in this article - about MS offering free AV software.

You've still got to run it, and you still have to offer it processor cycles.

Of course, that's not the complete story. You have to run AV software on Linux servers, to keep your Windows clients happy, so the argument isn't as clear cut as it might be.

But with Google Docs offering an equation editor and Google gears, it really doesn'tmatter what operating system you run. Increasingly, I can flit from Windows to Ubuntu to Mint to OSX, and my browers syncs. More inmportantly, I get the same documents on all the PCs I use without even trying, using a combination of DropBox and Google Docs. All my email is IMAP, so that moves around as well.

BBC News - In graphics: Supercomputing superpowers

BBC News - In graphics: Supercomputing superpowers

Not much choice of OS then?!

Bigot

Nasty word, isn't it.

Hmmm.

Mono

Yay! Got the debugger to work (this is 2.0).

This is a very nice development environment.

One of the guys in my department sent me an xlsx file today - 36MB, of staff with heavy disk space usage.

The shares are all on a Linux box.

du * -sh | sort -an


Produced a file under 5K in size with pretty much the same information in the same order.

So what was in the 36MB file (which, incidentally, crashed my version of Excel)?

The upgrade mess-up

WinZip did the right thing. I emailed them. Within a couple of hours I had my original WinZip9 key and a URL to download it.

Now that's neat. I might have been tempted to download winzip14, but

• There isn't much difference
• 14 is a LOT bigger than 9
• jZip and PeaZip and a lot of others work. And work well.
• 9 does it for me.

So there we are. Decent firm, did the biz.

But how many other utilities and software bits on my PC can't I upgrade? And how many can I? Textpad, a very fine utility, is still allowing me to upgrade and I'm several major versions down the line.