As you may have noticed, I don't really like just throwing up a few links and calling that a post, I prefer exposing some original thought and ideas. Unfortunately life has been rather lacking in the interest department, at least in what concerns this blog. Work has been ok but monotonous, cocktail-wise the winter takes away the joy of sipping concoctions on the balcony and my recent experiments have been into the classic cocktails, about which much has already been written. Finally, I have one book waiting to be read (Neal Stephenson's Quicksilver), but I'm saving it up for the winter holidays, so all I've been reading is newspapers and magazines.

In short, I've been intellectually bored. However, times are a-changing! I've been working on a site update for the main noaxs.net pages using all the latest techniques (CSS and stuff, not a <table> in site). My wife has also given me a digital camera (Sony DSC-P8) (w00t), so I'm going to take some serious time to update and expand the ferret galleries. If you don't know why I need time for this, you've obviously never tried to get a ferret to sit still for a photo :).

Finally, I have embarked on another blog, this time a thematic thing so updates are more frequent. But I'm keeping it anonymous, for no real reason. :) Hints: It's in spanish and has nothing to do with anything geeky.

So that's it really. I'll write up some of the geeky stuff soon, I promise.

I haven't updated my reading sidebar in quite a while. This is mostly laziness, but perhaps also due to the books I've been reading. They're good books, but there's really not much to say about them.

I finished Do Androids Dream of Electric Sheep? and I enjoyed it a lot. Much of Bladerunner makes much more sense after having read it. I then got through Martian Time-Slip, also by Philip K. Dick, Moving Pictures by Terry Pratchett and Snow Crash by Neal Stephenson. I also read a book on dog psychology (!) and I'm starting a book about Bull Terriers, since we're thinking of getting one at some stage to complement our ferrets.

Next on the list is Neal Stephenson's Quicksilver, which I'm also looking forward to. But it's thickness made me tackle 1984 first, since it looks a little more inviting...

The sidebar is thus updated, and if somebody out there comes out with an interesting album I'll even update the music part too!

First problem. if you use Linux or some other Open Source projects, you've probably had problems at something you want to do but isn't well explained in the documentation. So you go and look up the problem on Google, and get 350,000 results. Of these, most of the pages are from back in 2000 when everyone was coming across the issue and generating a lot of traffic on forums and mailing lists talking about how to fix the problem, what has to be implemented to get it to work, etc. This traffic is all very relevant to your search terms, but not very useful if all you want to know is how to do whatever it is. Usually, buried in the 32nd page of results is a page from a couple of months ago that answers your question in a concise way but, because of the way it is written, is not high up in the ranking.

This, in my eyes, is a major problem. Google doesn't seem to give much importance to how new a page is, and therefore the usefulness of the results is skewed in some cases. Ironically, the problem is worse when searching in Google Groups, but since it allows sorting of results by date, it can be overcome much more easily by just displaying the results in reverse chronological order.

Second problem. This isn't really a problem for me, but I was thinking about it as problem number one happened, and when I tried it my suspicions were confirmed.

Imagine yourself as a complete newbie. You've been told that the Internet is good for many things, and that everything you need can be found by searching Google. So far, so good, and many of us might actually give that kind of advice. Now, you've heard that the Internet can be used for sending email, so you search Google for "how to send email", or maybe just "sending email".

If you've clicked on the links above, you will have seen that there is absolutely nothing in that result list that might help you on your quest. To find some helpful results you'd need to search for something like "free email services" or "how to get an email account", search terms that betray decent knowledge about the subject area in the first place.

I think it's obvious from these examples that in order to find anything on Google, you need to have a fairly clear idea of what you're looking for, which defeats the point when you're looking something up because you have no idea what it's about. While not a bug per se, I think this is an unfortunate side-effect of the searching methods used.

These two issues can be serious hurdles standing in between you and the data you need. Basically, in order to narrow your search, you need to know more about what you're searching for. And you can't find out more until you've found what you're looking for. It's a vicious circle.

It just goes to show that Google is not the ultimate knowledge searching tool. And while this is unfortunate for you and me because sometimes we might not be able to find the data we need, it means that there is still room for improvement and maybe (gasp!) competition.

And given Google's recent spate of bad press, this may well be a Good Thing(tm).

This year, Mattel is upping the ante by making the B-Book into a full-fledged desktop replacement targeted specifically at toddler through preteen girls who are currently Windows users but may be seeking alternatives, possibly due to increasing licensing fees or out of a desire to break free of vendor lock-i

Brilliant stuff.

Actually I think the problem that programmers have with character sets are that 1. they use tools that don't understand them and therefore never learn about them (Joel mentions PHP), and 2. tools that do understand character sets but that don't make charset-related issues obvious. An example of this is Apache's Xerces. Anyone who has ever spent serious time researching a weird XML parse error only to find out that the XML document they were using had the wrong charset in the header knows what I mean.

Anyway, read the article, it's worth it.

It's a serious story, but I get annoyed at the way different media portray it. Today in the TV news and newspapers, TVE (Televisión Española, Spanish National Television) called the guy an attaché to the spanish embassy. TeleCinco (independent spanish TV) referred to him as a military something-or-other, and El Pais, a major newspaper, called him a spy.

I won't get into my own opinion, but the language used by each medium makes their bias quite clear. I found the government-backed TVE message to be the most disturbing, which maybe makes my bias quite clear. Either way, it annoys me.

Like Rage Against the Machine says, There's nothing proper 'bout your propaganda...

I do this every so often, you see. I move to a new desktop machine, reinstall or upgrade the operating system and suddenly I have a blank page to configure the desktop experience. Over the years, I've become used to setting up the basics automatically - development tools, browser/email/messengers/etc, office apps and other necessities, but there are always things to do which aren't automatic because they are not used as often, and crypto software is one of those things.

So every year or so I get to investigate anew, see all the available software and decide on what to install and how to make it work. As usual, every time I set these things up it's in a different environment - now I'm using Linux (RedHat 9, to be precise), and I recently switched to Mozilla Thunderbird for mail.

Thankfully, even Linux projects are quite professional these days, so installation was painless, everything from RPMs or, for Firebird, from .xpis. This is what I installed:

• GnuPG - (gnupg-1.2.1-4.rpm comes with RedHat 9)
• GnuPG Made Easy - from FreshRPMS
• KGPG - KDE GPG software that sits in your system tray and gives you a nifty GUI for most of your needs.
• Enigmail and Enigmime for Linux

Installing in that order should work fine. Run kgpg from the command line to create or import your keypairs, and you're done. Much simpler than when I first started experimenting with PGP back in '96 or so, back when using crypto software was more like a war (hence the title of this post).

This was all done from my work machine, so when I get home I'll replicate the process and then post my new collection of keys to gather dust for another year or so. :)

(via Jon Udell)

The idea that caught my eye is in the update to the article - the fraud-monitoring software. I'm thinking about how can traffic that isn't fake can seem like bad traffic to a monitoring algorithm?

My first thought is inspired by one of my minor annoyances in recent times - HTTP proxies.

It is conceivable that a certain number of people behind a proxy find an advertisement on a site interesting and click on it, all in a short length of time. If the algorithm isn't proxy-savvy (i.e. knows how to interpret X-Forwarded-For headers) or the proxy isn't compliant (not all of them are), then the monitoring software could be fooled by honest traffic.

This is not a far-fetched idea, most big ISPs use proxies, which they automatically configure from their install CDs. And some, in particular Telefonica here in Spain, give you no choice by installing a transparent proxy, which is the root of all evil. :) If the AdSense monitoring software is not proxy aware, then it would throw out sites like ADSLNet or BandaAncha because anyone in Spain using ADSL will appear to come from the proxy IP (currently 80.58.4.42, if you really want to know), even if the clicks were from many different people.

And of course, this causes other problems for me. I don't know how other people in Spain keep track of how many individual users use their site, but I can't do it since I use shared hosting and can't change the Apache config to log real IPs instead of proxy IPs. I get lots of hits in my logs from the proxy, but I am also behind that proxy and I use my domain for quite a few other things, so most of those hits are probably mine. :) Anyway, if you're in Spain and using ADSL, leave me a comment so I know you're there!

Actually, I speak like it's a Spain thing when it isn't. All newspapers have biases, most of them are political or religious, and you have to take everything they say with a grain of salt. Same thing for TV news. The great thing about Google News is that since it aggregates news from many different sources, you can be reasonably sure that you're getting a bias-free picture of the world, in that all the biases eventually cancel each other out. That's my theory anyway.

So it looks like I'll be getting my local news from Google now instead of, well, ignoring the news because I can't stand reading any single newspaper or watching any single TV channel. I've been getting most of my international news from Google News UK, since it's the closest I have to local and even though I don't often click through to the UK stories, I'm impressed that I have a much better picture of what's going on there than I've ever had since I moved away. I suppose it's just a great idea. Can you tell I love Google? ;)

Have americans not heard of bricks? Why do they build their houses out of plywood? Every time that something like this happens we are treated to footage of houses having their walls blown away, whole blocks lying in heaps of wood and plastic... Why don't they use durable materials to build their homes? This isn't Bangladesh, after all.

Still, I have no experience in the matter, so I can't give an informed opinion. I just think that if we had that kind of weather here in Europe, we could handle it by just bringing in anything that could fly away and covering the windows with something hurricane-proof. Minimal destruction, except maybe for tiled roofs (not a big issue in Madrid) ;).

It just seems odd...

(From Dan Gillmor's eJournal)

But seriously, I hope it's not like Visual Basic. The existence of VB is solely responsible for the huge amount of people who think they are computing professionals because they know how to put together simple apps, and nothing more.

Maybe I'm overreacting, but there are an awful lot of people like that in Spain. At least I keep on running into them. The other day at work, we were asked to install a webapp on a server we manage. The first thing that looked off was that the package was in a .jar, not a .war. Upon inspection of this .jar, we find a collection of classes - and nothing more. No WEB-INF, no web.xml, nothing. Thinking that this must be an oversight, we got in touch with the "coder" and asked for the web.xml file. No problem. Five minutes later we're staring at the following file:

<web-app>
</web-app>

Seriously. And the guy swore that it was correct. So the next few hours were spent reading the code and working out what servlet declarations had to be done (incidentally, the servlet-mappings were all the same as the class names).

Here is what I think happened: The guy started out writing VB programs, and thought he was good. Sometime during 1998-2000 he got a job in the computing industry, taking advantage of the dot-com boom. So that's how he got his job. Now one day he was asked to do something in Java. So he gets JBuilder (or something) and starts reading one of these cheap-ass (and crap) spanish computer books printed by these gentlemen. Armed with not nearly enough knowledge about computers in general and his chosen subject in particular, he starts doing stuff in JBuilder. He uses wizards, he copies public-domain code from the net, and in a couple of weeks has come up with a web application that seems to work. Great, except he doesn't know it's a web application, he doesn't know how it works internally, he doesn't know what an application server is, he doesn't know about .wars, etc, etc. And this is where we get a bunch of talented and qualified people wasting time arguing with this guy about his web.xml and then reverse-engineering his code to make it work. Thankfully we were charging by the hour for this.

And that is the danger of VB. It makes the novice think that what he sees in the IDE is all there is to his program, because in VB it *is* all. However when he has to use something a little more complex, he's not even lost because he's not aware that there is so much more to know. And he just goes merrily on his way, oblivious to all the problems his code may be causing, thinking that if it doesn't work it's someone else's fault for not knowing how to set it up. "They must be so dumb", he thinks. "It's so simple".

What does all this have to do with Project Rave, you ask? Well, imagine for a moment that it is "programming for retards", as I mentioned before. This would mean that suddenly a whole bunch of people who don't know Java would end up thinking that they do. A whole bunch of clueless managers would believe them.

Now, where is Java used that VB isn't? Think small unimportant places like financial institutions, insurance companies, etc. So the risk is that suddenly you're enabling this calibre of programmer to do some *real* damage instead of limiting it to some stupid little desktop apps.

Does nobody else find this scary?

There were a couple of extra issues. Firstly, the command takes arguments that had to be passed through the URL. Secondly, the command had to be run as a specific user. The first requirement is not so complicated, all web languages provide easy access to URL variables. However the second requirement was a little more puzzling.

My initial approach was to think of the problem as a regular Unix problem. If you have to execute a command or a series of commands, you write a shell script. So I thought about writing a CGI shell script. This is my reasoning:

• Maintanability - for a short system script, it's important that it be maintainable by the System Administrator, not a developer on a team. Sysadmins use Shell scripts daily, where PHP (for example) will probably not be as familiar.
• Testing - A little mojo at the beginning of the script (switch between command-line and URL arguments) allows you to test from the command line. Very handy.
• Flexibility - Since shell scripts are designed to run external programs, they allow a lot of flexibility in how commands are called, which commands are called, etc.
• Elegance - A shell script will be much more easy to read than a PHP file full of system() calls, for example, and is more appropriate to the problem being solved.

With the platform decided, I started by looking at how to get URL arguments into the script. Since I was a little short on time, I didn't want to start looking up how CGI worked, which environment variables were set, etc. A quick Google search turned up bashlib, a great little project designed to make using Bash as a CGI scripting tool easier, specifically by handling things like URL variables. This made the first point given above trivial.

Now on to the second point, running the command as another user. Now I like to think I know a fair bit about Unix, but I'm mainly a developer and not a sysadmin, so although I had heard about Sudo I had never used it. It turned out to be exactly what I needed. At first I had tried just using su, but apart from being horribly insecure, I couldn't find a way of using it non-interactively. When that approach failed, I looked up sudo. All I needed was a single line in /etc/sudoers with the command, the calling user and the user the command should be called as. It's important to include the directive NOPASSWD so that the command can be run in a script without expecting a password.

And that was it, problem solved! That's how I ended my work week. I like doing something different now and again, since it's easy to get burned out working week in week out on the same thing, especially in the "client is being a pain" phase. And it's the kind of task that allows you to learn new things in small steps and relatively stress-free.

Why have I called this post "Choosing the Right Tool"? I am referring to writing a CGI in Bash. When you have a problem like the one I have described, where I could have done it in PHP, Perl, Python or whatever, you have to look at the most elegant solution and that which satisfies the most "unnamed criteria" - things that don't usually go into a project description but are a given, like efficiency or maintainability, mentioned above. In this context, I think I made the right choice.

According to the story, the judge ruled that the CD she purchased, which would not work in her car CD player, was defective. This means that EMI have to provide her with a new CD that does work in all CD players (i.e. is NOT defective), or else refund the money. It also means that EMI are formally forbidden from selling defective CDs.

Of course, a CD is only considered defective as long as it can't be played in some devices, so if someone comes up with a "better" mechanism that does work well, then copy protecting is not in itself verboten.

Why do I find this interesting? Well, for one thing I live in Spain and I suspect that it would be possible to get a similar ruling here from the courts if it came to it. The government doesn't seem to be interested in helping the music industry, as can be appreciated by walking through anywhere in Madrid and watching all the illegal immigrants selling pirated CDs/DVDs/Video Games in front of the local police force.

The other reason I like this ruling is that at last someone seems to be talking sense. You see, I have a reasonable CD collection, nothing enormous, but well over 100. I think that that alone, and the fact that I keep on buying CDs even though I have a broadband connection at home and could easily never buy any music again, should be enough for the music industry to afford me some respect and not assume that I am a criminal.

Fortunately, I don't buy the kind of CDs that are usually copy protected, so it hasn't affected me much. But still, is a little respect too much to ask for? I think not. And if the situation gets really out of hand, I can always move to France... ;)