Notable Reads

 

 

 


WNDR3700 meets DD-WRT

Many wireless access points have a “convenience” setup feature called WPS. Unfortunately WPS introduces a security weakness that allows an attacker to recover the WPA/WPA2 passphrase in a few hours[1, 2].

I have a Netgear WNDR3700 dual-band wireless access point, which includes the WPS feature. Prompted by the disclosures, mentioned above, I had a closer look at how WPS worked on the Netgear AP. WPS seems to be permanently enabled. The AP has an option to allow the router to disable WPS for a time, if there are too many connections attempts. This seemed like an unnecessary risk, so I decided to change the firmware to something without this vulnerability: dd-wrt.

The installation process has a reputation of being quite touchy and prone to bricking the router. Installation is set out on the WNDR3700 wiki page. Currently you need to install build r16785 on the router, then once the installation is complete and the NVRAM rebuilt, use the dd-wrt web admin interface to upgrade the firmware to a more recent version. I used webflash build r17201. I also tried a more recent build, r18024, but the 5GHz radio didn’t work properly. If you brick the router, use the recovery procedure here.

Finally, to ensure the clients can connect at the full 300Mbps, you need to configure the wireless settings from the advice in the Atheros wiki page.


Christmas Mince Pies

Christmas Mince Pies

The fruit mixture is the key to a good Christmas mince pie. Here’s our recipe:

  • 900 g currants
  • 300 g raisins
  • 300 g dark brown sugar
  • 225 g mixed crystallised peel
  • 2 lemons, zest and juice
  • 2 t cinnamon
  • 2 t ground cloves
  • 2 t all spice
  • 1 t nutmeg
  • 1 t ginger
  • ¼ c brandy

Roughly chop the currants and raisins. Grinding the spices gives better flavour than pre-ground spices. Lemon juice balances the sweetness, so check the flavour. Should be quite sharp as well as sweet. Ideally the mince should be stored in sterilised jars for a few weeks before use.

We use mini-muffin tins and frozen commercial short pastry. Assemble and cook at 180C until golden. About 20 mins.

 


Notable Reads

Notable reads:

Big Biometric Database – what could possibly go wrong?
http://www.fastcompany.com/1790444/the-downside-of-biometrics-9-million-israelis-records-hacked

What would Socrates Say? Technology and Learning.
http://www.ascd.org/publications/educational-leadership/sept09/vol67/num01/What-Would-Socrates-Say%C2%A2.aspx

Why Science Museums are Failing Adults
http://boingboing.net/2011/09/23/science-museums-are-failing-grown-ups.html

Neal Stephenson, Innovation Starvation
http://www.worldpolicy.org/journal/fall2011/innovation-starvation

Stephen Fry on Steve Jobs
http://www.stephenfry.com/2011/10/06/steve-jobs/single-page/
http://www.bbc.co.uk/news/14664694

Stephen Wolfrom remembers Steve Jobs
http://blog.stephenwolfram.com/2011/10/steve-jobs-a-few-memories/

David Frum, Why I am a Republican
http://www.frumforum.com/why-i-am-a-republican


MapToaster Topo/NZ v5.6

Shipping party! A new version of our MapToaster Topo/NZ topo maps of NZ is going out the door.


Notable Reads

This week’s notable reads.

“The arrogance of Web evangelists is staggering.” Joe Hewitt on the Web as a platform.

Christopher Hitchens on the death penalty.

Costs of poverty – Canada’s experiment.

Reflections of a former GOP operative.

The net is a waste of time” William Gibson

Don Norman “”Google doesn’t understand people,” he said. “Have you ever spoken to a Google support person on the phone? They don’t have them. Sure, they’ll direct you to their blogs — where you’ll be lucky if you can find the answer you’re looking for — or they’ll let you give feedback. But do they ever give you feedback on your feedback?”

Evgeny Morozov – the Internet and political repression.


Lion and WiFi

OSX Lion includes a nice WiFi diagnostic tool. Start it from a shell like this

  open  '/System/Library/CoreServices/Wi-Fi Diagnostics.app'


Notable Reads

Marc Andreesson on the disruptive nature of software. Argument to a degree undermined by some of the examples not being real businesses

John Young writes on, US Education Secretary, Arne Duncan’s epiphany.

12 Nasa Blueprints – selected engineering drawings for the US space program.

In the Financial Times: ”A failure of economic strategy and leadership lies behind the near simultaneous collapse of market confidence in the eurozone and US economies.”  Tripped up by globalisation.

Data is hard. In the Guardian, headlines that spring from faulty analysis.

Interview with Gorbachev.

“The companies who we appear loyal to are those that best help us define, refine, and express who WE are. “Your customer wont take a bullet for you – Kathy Sierra.


OSX Lion and PostgreSQL

After upgrading to OSX Lion, one of the few things that was broken was PostgreSQL. Apple have replaced MySQL with PostgreSQL in their server product and the upgrade on a standard Mac includes the Postgres client library. It seems the that upgrade deletes the postgres user and replaces it with a _postgres user. If you look at the Postgres files, they longer have their user and the server no longer starts.

 
(default)magellan:desktop jdm$ sudo ls -l /usr/local/pgsql/data
-rw-------   1 103  postgres      4  9 Nov  2009 PG_VERSION
drwx------  15 103  postgres    510 14 May 15:02 base
drwx------  45 103  postgres   1530 22 Jul 14:19 global
drwx------   3 103  postgres    102  9 Nov  2009 pg_clog
etc...

Happily, this is easily fixed. First update the UserName setting in /Library/LaunchDaemons/org.postgresql.postgres.plist to _postgres. Then change the ownership of the affected files

 
sudo chown -R _postgres:_postgres /usr/local/pgsql/data
sudo chown -R _postgres:admin /usr/local/pgsql/var

Then delete the postgres group as it’s no longer needed

 
sudo dscl . -delete /Groups/postgres

Finally start the server

 
sudo launchctl unload /Library/LaunchDaemons/org.postgresql.postgres.plist
sudo launchctl load /Library/LaunchDaemons/org.postgresql.postgres.plist

Notable reads

Notable reads from the last few days:

Minority rules: Scientists discover tipping point for the spread of ideas

‘The Objective of Education Is Learning, Not Teaching’


Tarte Tatin

Some foods are greater then the sum of the parts. Tarte tatin is such a food.

You need an oven-proof heavy-bottomed frypan. For two to four people, I use a 160 mm cast iron omlette pan. Add 70g sugar, 35g unsalted butter and a generous squeeze of lemon. Cook over a medium heat, stirring constantly, until the sauce just begins to colour. If the sauce caramalises too much at this point, the final sauce will be dark and too strongly flavoured.

Peel, core and slice two apples. Arrange the slices in the pan, packing firmly. Cook over a medium heat. The apples will release juice into the sauce. Continue cooking until the sauce darkens and thickens.

Now place a circle on puff pastry on top of the apples. Cut a vent in the centre of the pastry to let steam out as it cooks.

Cook in the oven at 200C until the pastry is nicely coloured. Remove from the oven and allow to cool for a couple of minutes. Cover the pan with a plate and invert. If you don’t let it cool enough the sauce will run out on the bench when you turn it over. If you let it cool too long, the apples will stick to the pan.

Finally allow the tarte to cool some more before serving. Cream or ice cream are optional. Can be served warm or cold.


Mail Reading Software

Prompted by Lance Wiggs’ post on which email clients were most popular I had a look at the stats for three newsletters, run from Campaign Monitor, that I have access to. The first set of figures is for a newsletter sent by a Christchurch business to its customers. The second two are from a social development NGO. The recipients for all three newsletters are largely in New Zealand.

The dominance of Outlook no doubt reflects its position as the the default mail client for Windows, especially in businesses. Yahoo! Mail’s popularity is probably the result of Yahoo’s relationship with the large New Zealand ISP, Xtra.

These results reported by Campaign Monitor are a bit muddled – a mixture of ISP and mail client data. Yahoo, GMail and Hotmail should be aggregated as “Web-based client”.

Outlook 49.6%
Web-based 15.6%
Apple Mail 8.8%
iOS 8.6%
Others 17.4%

Thermograph

Writeup and source code for simple Arduino-based thermograph posted on our Chaos blog.


Christchurch CDB Visualised in Data

Since the Feb 22nd earthquake, the centre of Christchurch has been cordoned off, empty and without power. This image shows the quiescent CDB, visualised using WiFi packets as a proxy for human activity.

Christchurch CBD visualised in WiFi packets

And for comparison, here’s the same area visualised with data from my iPhone WiFi geo-location database, from before Feb 22. The data and the collection methods are different, but you get the idea.


Arduino GLCD font for KS0108 LCD’s

Have added a repo to github with two fonts for use with the Arduino GLCD library. The repo is at https://github.com/johnmccombs/calfonts . Add the *.h files to the fonts folder in the GLCD library folder.

GLCD Fonts


Apple and Location Tracking

There’s been a lot of controversy around a blog post on O’Reilly Radar that claims Apple is recording user’s location data, for unknown purposes. I pulled the data from my phone and mapped six months of it.

iPhone location data

The red points are from the cellphone table and the blue dots are from the WiFi table. The first thing I noticed is that the data look nothing like my regular spatial pattern, see below. These maps are not the same scale and time period, but you get the general idea. Look for the empty park in the centre of the top map and in the centre, near the top of the bottom map. The map below was recorded with a real GPS.

Here’s another map from a trip to Auckland. My actual location was Auckland Airport, upper-left, where I scampered from the domestic terminal to an international connection. Note the points all over South Auckland.

The timestamps in the database are curious. There are typically dozens or hundreds of records all with the same timestamp. There are a few unique timestamps per day, but there are many days with no data.

So what is this data? While the names of the database fields suggest that this data is a recording of the phone’s position, the authors of the blog post offer no evidence that this is actually the case.

The map from my phone has thousands of WiFi points at locations that I haven’t been near to and the gross pattern of recorded points doesn’t match my travel especially well. Your phone might be able to connect with distant cell towers, and I guess it’s possible that the phone has seen brief scraps of data from all these access points.

I’m wondering if this database is something else. Perhaps it’s a cache of data from a geolocation webservice that the phone can use to determine its position? If it is tracking my location, the positions are wildly inaccurate. You certainly couldn’t determine where I live or work from the data.

Update: Looks like this data is the devices radio logs and geolocation data.

Update: turns out Android phones keep this type of data too.

Update: Apple speaks.

From a privacy point of view, it’s not great that this file is lying around unencrypted. But in terms of disclosing your location, it’s not doing much better than “I was in Christchurch”. My online calendar and emails would be a much more accurate source of this information.

Perhaps the most striking part of this story is the hysterical storm that has swept across the news and social media. Come on, these things are location enabled devices. What did you expect?


Garmin GPSMAP 62s Review

Just added a review of the Garmin GPSMAP 62s to the MapToaster website.


SSL is not end-to-end security

Peter Gutmann’s Engineering Security has more on the subject.


Tools I liked – 2010

Here are the things I used a lot, this last year, and found to be invaluable:

Hardware

  • 17″ MacBook Pro – light, thin, cool, quiet, wonderful keyboard, nicely engineered and stays out of your way.
  • iPhone 4 – this is one of the best computers I have ever owned.  Had an Android phone for a while, but found it a bit ghetto in comparison.
  • iPad – much better than expected.  I use it constantly for email, IM and reading books and the web. There’s a popular meme that the iPad is only for consuming content.  I can only assume the advocates of this view have never used the device. In our household it gets used for writing, communicating, drawing and making music. For travelling, add a bluetooth keyboard and it’s good enough to replace a laptop for email, and remote admin (RDP and SSH).
  • Nokia N900 – this is an unfinished work with lots of rough edges, but like an Italian car, you’re willing to ignore the faults because it’s a fun ride. The device is fully hackable and most of the software is Open Source.  It has a more or less complete Debian software stack, so more of a pocket computer with a phone application. If Nokia can pull it off with Meego, they’ll really have something.
  • Arduino platform. The Arduino and associated ecosystem provide access to physical computing without the pain of starting with a bare microcontroller.  Honourable mentions to Adafruit and Sparkfun for great products and service.

Software Development

Essential iPhone & iPad Software:  Official Twitter app, One Team XMPP messaging, Skype, StarMap Pro, 360 Panorama, Google Earth/Maps, Reeder, Instapaper, Read It Later, Kindle, iBooks, Wolfram Alpha, Flipboard, Numbers, iCircuit, iElectribe, iMS-20, Sketchbook, Colloquy, iTap RDP, iSSH

eBooks – special mention for Packt Publishing and O’Reilly for publishing DRM-free eBooks. I bought a number of theirs this year and DRM-free a) convenient and b) you feel like you own the books. I also bought a couple of novels from the Apple iBook store. Constrained by DRM, they feel more like rentals than purchases, which would be ok, if they were priced at $5-$10.

Cloud Service

  • Google Apps – it’s putting your email in the hands of another company, probably being stored in another country, but the payback is convenience and near perfect spam filtering.
  • Google Reader,  Webmaster and Analytics.
  • DropBox – making files accessible between computers and sharing data
  • Flickr.
  • delicious – unloved by Yahoo, but quite serviceable.  The rumours that it was being shutdown highlighted an obvious weakness in the cloud computing model.
  • NZ Met Service.

Changes

A summary of how some things changed in the last decase by Stephanie Fox of io9.com.

 


Follow

Get every new post delivered to your Inbox.