As a SysAdmin, people ask me how much they need to worry over the heartbleed vulnerability. Here’s my own take:
Google were known to be vulnerable. They co-discovered the vulnerability and deployed fixes quickly. I like to believe they are analyzing the scope and likelihood of user password compromise and will issue good advice on whether Gmail passwords should be updated.
For everything else, my small opinion is “don’t panic.” Not every web site would have been affected. The Ops folks at each site need to patch their systems and assess the extent to which credentials may have been compromised, then take appropriate steps to mitigate compromised data, which might include asking users to set new passwords. But if they’re still waiting on some patches, then submitting a new password could actually put both passwords at risk.
For other important passwords, like your bank, check up on what they’re recommending that you do. If a site is important to you and they offer two-factor auth, go for it: that typically means that if you log on from a new computer they’ll text a one-time pin code to your mobile phone to double-check that it’s you.
I started trying to use Fitbit to track calorie consumption again the other day. This gets frustrating pretty fast because unless you only eat processed food from packages of specific size you mostly have to accept that calorie counting is a wildly inaccurate guessing game.
I’m happy to embrace the mystery and accept approximate measurements for the most part, but I figured there was one thing I could tackle: breakfast! The most important meal of the day … and I tend to eat the same thing: a bowl of Trader Joe’s Raisin Bran with skim milk. (Trader Joe’s is the only raisin bran I can find any more where the raisins aren’t coated in sugar.)
In theory, this is trivial to figure out. The information is posted right on the side of the box:
So, how many calories am I eating, here?
Caveat: I eat cereal by the bowl, not by the cup! I also eat with some quantity of skim milk.
I whipped out my trusty digtal kitchen scale:
1) Switch scale back to metric
2) Place bowl on scale
4) Pour a bowl of cereal, note weight (129g)
6) Pour milk, note weight (331g)
7) Remove bowl from scale and enjoy breakfast before everything goes soggy
Cereal calories are easy to figure: 129/55 * 170 = 399 calories
Milk servings are measured in ml, though. The moment I started trying to look up the volume of a gram of milk, Google just gave me the answer: 113 calories
Here is a new phishing attack that made it through to Gmail about the domain name dispute around tjldme . . . ?!!
(If you are not the person who is in charge of this, please forward this to your CEO,Thanks)
We are a organization specializing in network consulting and registration in China. Here we have something to confirm with you. We just received an application sent from “Global Importing Co., Ltd” on 20/11/2013, requesting for applying the “tjldme” as the Internet Brand and the following domain names for their business running in China region:
Though our preliminary review and verification, we found that this name is currently being used by your company and is applied as your domain name. In order to avoid any potential risks in terms of domain name dispute and impact on your market businesses in China and Asia in future, we need to confirm with you whether “Global Importing Co., Ltd” is your own subsidiary or partner, whether the registration of the listed domains would bring any impact on you. If no impact on you, we will go on with the registration at once. If you have no relationship with “Global Importing Co., Ltd” and the registration would bring some impact on you, Please contact us immediately within 10 working days, otherwise, you will be deemed as waived by default. We will unconditionally finish the registration for “Global Importing Co., Ltd”
Please contact us in time in order that we can handle this issue better.
Registration Department Manager
4/F,No.9 XingHui West Street,
JinNiu ChenDu, China
Office: +86 2887662861
Fax: +86 2887783286
Please consider the environment before you print this e-mail.
I assume they’ll need a processing fee. I wonder if they munged toldme.com in an effort to avoid Phish filtering . . . ? The URL at the bottom is blocked by our firewall.
We were somewhere around Barstow on the edge of the desert when the drugs began to take hold. I remember saying something like “I feel a bit lightheaded; maybe you should drive….” And suddenly there was a terrible roar all around us and the sky was full of what looked like huge bats, all swooping and screeching and diving around the car, which was going about a hundred miles an hour with the top down to Las Vegas. And a voice was screaming “Holy Jesus! What are these goddamn animals?”
Then it was quiet again. My attorney had taken his shirt off and was pouring beer on his chest, to facilitate the tanning process. “What the hell are you yelling about?” he muttered, staring up at the sun with his eyes closed and covered with wraparound Spanish sunglasses. “Never mind,” I said. “It’s your turn to drive.” I hit the brakes and aimed the Great Red Shark toward the shoulder of the highway. No point mentioning those bats, I thought. The poor bastard will see them soon enough.
We were somewhere around Barstow on the edge of the desert with a drug against a cold. I remember saying something like “I feel a bit lightheaded maybe you should drive.” And suddenly there was a terrible rawr all around us in the sky was full of it look like you’re fat, also reach me on the car, which was going about a hundred miles an hour with the top down to Las Vegas. And waste of screaming “All ages! What are these god damn animals?”
It was quiet again. I turn into taking your shirt off was pouring beer ice chest, to the Celtic the tanning process. “What the hell are you yelling about?” he muttered, staring up at the Sun with his eyes closed and covered with wraparound Spanish sunglasses. “Nevermind,” I said. “It’s your turn to drive.” I hit the brakes and emigrate red truck with the shoulder of the highway. No point missing those bats, I thought. The poor bastard will see them soon enough.
I added the quotation marks manually, as well as the paragraph break. My phone, unlike others, does not seem to understand the “new paragraph” command. The original text, was stolen from http://www.galleries.com/jeff/gonzo.htm, which was stolen from Hunter S. Thompson, who is dead.
At long last, I retired my old T-Mobile G2. It was the last in a long line of phones I have owned for the past decade with a physical keyboard. (I think I owned every Sidekick up to the 3 before going Android with the G1 and the G2.) I like the ability to thumb type into my phone, but the G2′s old keyboard had long ago gone creaky, and it had lacked a dedicated number row besides.
Obligatory picture recently taken with my new computer telephone. Featuring a cat.
They don’t make nice smart phones with keyboards any more. Market research seems to indicate that the only remaining markets for keyboard phones are horny teenagers who need a cheap, hip Android-based Sidekick, and those legions of high powered business people who will never abandon their ancient Blackberries.
Anyway, the new Nexus 5 is here. The on-screen keyboard is okay slow and inaccurate. Like moving from a really fantastic sports car to a hovercraft piloted by a drunken monkey. I mean,the monkey-piloted hovercraft is undeniably cool technology, and I can eventually get where I need to go, but . . . its not the same, you see?
So, lets explore Voice dictation! It works . . . well, about as well as the monkey hovercraft, but with the added benefit that you don’t have to keep jiggling your thumb across the screen. But how do you do new lines and paragraphs? Where’s the command reference?
The other thing that excited me about the Nexus 5 was that on the home screen you can drag apps right up to “Uninstall” . . . unless they’re Google apps! “Way to not be evil,” I cried. Until a Google colleague pointed out that it was just a bit of UI funkiness on Google’s part, owing to the applications coming bolted into the UI, there is at least a method to disable them.
Anyway, this is useful knowledge that helped me to vanquish the Picasa sync thing that has been hiding images from the gallery for the past few years. I have another project where I’m testing out BitTorrent Sync to pull images off our phones and then sync a copy of the family photo archive back down to the phones. If that works out, I’ll write it up. I may pursue that further to see if I can’t replace Dropbox, which, unfortunately, does not (yet) offer any sort of a family plan. Also, if I can host my own data I needn’t share as much of it with the NSA.
Two weeks ago, I attended Atlassian Summit 2013 in San Francisco. This is an opportunity to train, network, and absorb propaganda about Atlassian products (JIRA, Greenhopper, Confluence, &c.) and ecosystem partners. I thought I would share a summary of some of the notes I took along the way, for anyone who might find interest:
At the Keynote, Atlassian launched some interesting products:
As time passes, the ticket gets crankier at you in real time about the SLA.
Jira Service Desk
Jira Service Desk is an extension to JIRA 6 oriented around IT needs. The interesting features include:
Customer Portal with integrated KB search
Real-time visibility of ticket SLA status
The first thing helps people get their work done, and the second is manager catnip.
Another feature for tight integration is Webhooks: you can configure JIRA so that certain issue actions trigger a hit to a remote URL. This is generally intended for building apps around JIRA. We might use this to implement Nagios ACKs.
I haven’t looked too deeply as this is a JIRA 6 feature, but Atlassian Connect promises to be a new method of building JIRA extensions that is lighter-weight than their traditional plugin method. (Plugins want you to set up Eclipse and build a Java Dev environment in your workstation… Connect sounds like just build something in your own technology stack around REST and Webhooks)
Cultivating Content: Designing Wiki Solutions that Scale
Rebecca Glassman, a tech writer at Opower, gave a really engaging talk that addresses a problem that seems commonplace: how to tame the wiki jungle! Her methodology went something like this:
Manage the wiki like it is a product: interview stakeholders, get some metrics, do UX testing
Metrics: Google Analytics, View Tracker Macro, Usage Macro
UX results at Opower revealed more reliance on Table of Contents vs Search (55%) and that users skip past top-level pages, so you don’t want to put content just on there
In search, users only look at the first 2-3 results before giving up
They engaged some users to track the questions they had and their success at getting answers from the wiki
The Docs people (2) built an “answer desk” situation where they took in Questions from across the company, and tracked their progress writing answers on a Kanban board
As they better learned user needs and what sort of knowledge there was, they built “The BOOK” (Body of Opower Knowledge) based on a National Parks model:
Most of the wiki is a vast wilderness, which you are free to explore
The BOOK is the nice, clean visitors center to help take care of most of your needs and help you prepare for your trek into the wilderness
The BOOK is a handbook, in its own space, with its own look-and-feel, and edits are welcome, but they are vetted by the Docs team via Ad Hoc Workflows
By having tracked Metrics from the get-go, they can quantify the utility of The BOOK …
(I have some more notes on how they built, launched, and promoted The BOOK. The problem they tackled sounds all to familiar and her approach is what I have always imagined as the sort of way to go.)
Ad Hoc Canvas
The Ad Hoc Canvas plugin for Confluence caught my eye. At first glance, it is like Trello, or Kanban, where you fill out little cards and drag them around to track things. But it has options to organize the information in different ways depending on the task at hand: wherever you are using a spreadsheet to track knowledge or work, Ad Hoc Canvas might be a much better solution. Just look at the videos and you get an idea . . .
The Dark Art of Performance Tuning
Adaptavist gave a presentation on performance analysis of JIRA and Confluence. It was fairly high-level but the gist of this is that you want to monitor and trend the state of the JVM: memory, heap, garbage collection, filehandles, database connections, &c. He had some cool graphs of stuff like garbage collection events versus latency that had helped them to analyze issues for clients. One consideration is that each plugin and each code revision to a plugin brings a bunch of new code into the pool with its own potential for issues. Ideally, you can set up a load testing environment for your staging system. Short of that, the more system metrics that you can track, you can upgrade plugins one at a time and watch for any effects. As an example, one plugin upgrade went from reserving 30 database connections to reserving 150 database connections, and that messed up performance because the rest of the system would become starved of available database connections. (So, they figured that out and increased that resource..)
tl;dr: JIRA Performance Tuning is a variation of managing other JVM Applications
Collaboration For Executives
I popped in on this session near the end, but the takeaway for anyone who wants to deliver effective presentations to upper management are:
Four score and seven years ago, our fathers set forth upon this continent a new nation. One conceived in Liberty and dedicated to the proposition that All Men are Created Equal.
My regular handwriting is pretty awful. But this font is somewhat more readable. The process is you pick out the characters you’ll want in your alphabet, download and print some templates, write in the squares on the templates, scan and upload and boom, you’ve got your font. Kind of fun.
Of course, nothing’s ever quite simple. I wrestled at first with the limitations of MyScriptFont.com and a ball-point pen. That first site doesn’t do “double-quotes”. To get the font as far as I have, I also needed to use a felt pen, which is weird for me, and then review the scanned pages in a paint program to eliminate stray marks and cut the bottom tail off my capital I.
I’m pretty pleased with the results thus far. I have to use a larger size for legibility. One nice feature about the PaintFont site is that you can later add characters to your existing font file. If I ever have occasion to employ this font for a “serious” endeavor, I may try to re-render some of the characters for better legibility.
In testing a handwritten font, I find that writing out a few addresses seems to be a good test. Not only do they have a good mixture of letter casing and numbers, but that’s pretty much all I have occasion to handwrite any more anyway:
Jake & Elwood Blues
1060 W Addison St.
Chicago, IL 60613
1600 Pennsylvania Ave NW
Washington, DC 20500
The Honorable Mike Honda
2001 Gateway Place
San Jose, CA 95110
I’m not sure when this will be useful, but it is nice to have your very own font around, and the process is kind of fun. :)
Honestly, that just feels slimy. They are my data. My data are not a premium feature. This restriction puts a bad taste in my mouth and that is a strong deterrent to purchasing further products from you folks. Which is too bad, since I otherwise like the hardware and I am ready to be upsold to an NFC device. But since my data are not my data … well, I’d rather just spend my money elsewhere.
If anyone has an activity tracker they particularly like, I am keen to hear about it.
A reaction I posted to a friend’s Facebook with regard to the present BART Strike:
I’m a pro-Union Liberal who thinks it is wrong to beat up on public-sector employees. I have heard that BART staff get 40 PTO days per year and there’s a scheme where you can take PTO, then take a shift, and get overtime for that. That’s something we can fix.
The train operators literally sit on their ass and watch the train drive itself. I talked to a guy who said that he did an important job of every once in a while mashing the buttons to fix something, and if he and his comrades weren’t there, BART would have to evacuate the passengers, shut the doors, and run the train empty to its terminal. Horrors!
In NYC, they’ve been laying off station agents where possible and using video cameras to aggregate agent services remotely.
I keep hoping that one of these days a labor action will be an excuse for BART to just fire the train operators and let the system run on automatic as it was designed to do. Spend the money on more frequent service so when a train occasionally has to be taken down, its replacement appears that much more quickly. Spread some of that money to the best station agents and start installing remote presence equipment to make the most of their labor.
. . . and if those train operators are even half as as good at mashing buttons in an emergency as they think they are, they can make the same salary as an entry-level SysAdmin.
Seriously, it is sad when your job is obsoleted by technology. It is even sadder when your job was obsoleted by technology before it even existed. Saddest when your skills are in extremely high demand at higher pay, but we keep paying you to do an obsolete job of extremely marginal public benefit.
I am hearing the following:
- you want the option to see Flickr in a “classic” view
- textual information around your photos (and sets in particular) is too hidden in the new design
- user’s organizational choices are limited and not surfaced enough, particularly with the Collections, Set, Photo hierarchy
- you want more customizability of content and layout in your photostream and home page
[ . . . ]
To put an end to speculation, and to hopefully give some people closure, the old site is not coming back. However, we will continue to improve upon the new pages . . .
[ . . . ]
We are focusing on making Justified view better and more performant, instead of supporting multiple different views.
So, basically, the full-screen view of photos without explanatory text is here to stay, and anyone who wants to view their photos in a different format should find an alternative photo sharing service.
You would think that turning a computer off would be a simple ask. But on my corporate laptop, Windows 7 is ever concerned that I am an idiot.
Me: Okay, we’re done. Shut down. Windows 7: Okay. Hey, wait, some programs are still running. Me: Kill them. Force shut down. Windows 7: Bu-bu-bu-bu-buuuut you could lose your work!! Are you sure you want to shut down? Me: Yes . . . I’m always sure . . . but thank you for your heartfelt concern.
So it goes.
(I do 98% of my work from Linux, which thinks shutting down is a grand idea.)
Earlier this week, Yahoo! unveiled a new and improved Flickr! !! A radical new redesign, which, while kind of slick to look at, totally steamrolls all the narrative features that many Flickr users like me love. Time will tell if Yahoo will backpedal enough to let us old-timers see our photos in the ways we like. Given that the new business model appears to be ditching the user subscription model for ads ads ads I am not optimistic.
Tommy smiles at his father photographer.
Enter Iperntity, a 7-person outfit in Cannes, FR which appears to have cloned the Flickr interface back in 2007 and have since moved in the direction of building it into a site where you not only manage and share your photos, but you can also write stories, and keep track of the friends you have on the site. Basically, a little outfit building something like Flickr into what Flickr might have become had Yahoo! not spent the past decade neglecting it. In a way, it is even giving us the core sharing features that people like about Facebook, without all the skeeviness. (Or … critical mass.)
I miss the nice drag-and-drop web uploader that flickr recently launched
The site feels a bit short of snappy … not dog slow, just not snappy … to be sure, they’re seeing a spike in load
The first thing that really makes me smile is that by default the photo lists the date taken, rather than date uploaded … that always frustrated me about Flickr
I of course opted for their 3-month paid service. Once the Collections feature comes online then I reckon there is a very good chance I’ll migrate my data from Flickr and sign up for their two year plan.
It is just nice to discover that there is new technology waiting in the wings when the big megacorp decides to shoot its product in the foot.
A test view of a plugin I wrote to view Flickr photos on a WordPress site.
Wow. It is hard even to add a post here.
I loved the old interface. I also loved that when you added new layout options to the old interface, they were OPTIONS that users could turn on or off.
I like that you could browse photos with annotations, click on a photo for a larger view, look over the metadata, &c . . . then click through the photostream or set.
Back when I joined in 2005 I was wary that Yahoo! might eventually do something stupid to what was really a very nice, well-designed interface for managing photos. My main assurance is that there would still be an API . . . I guess I will have to brush off the old API . . .
Really, you should give users the option to use the interface they like. This feels like instead of sitting down with users, seeing how they use the site, figuring out how to make it work better, you brought in some jackass designer who sighed that the site looks oh-so-2005, and decided to replace it with a mashup of Google Image Search (which is a terrible UI, by the way) and the Facebook header image (which wastes space at the top of screens which are getting shorter and wider but at least looks kind of neat.)
Please respect your existing users, many of us who have been paying you real, cash money for years now, and give us at least the option to enjoy the user interface we loved about your site.
How can I contemplate moving everything to the cloud, especially Google’s cloud, if services are going to flicker in and out of existence at the whim of Google’s management? That’s a non-starter. Google has scrapped services in the past, and though I’ve been sympathetic with the people who complained about the cancellation, they’ve been services that haven’t reached critical mass. You can’t say that about Google Reader. And if they’re willing to scrap Google Reader, why not Google Docs?
An excellent point.
I recall the first time I adopted a “cloud” service for my technology. It was Flickr. I had managed my photos with my own scripts for years. Others had installed Gallery, which always struck me as limited and ugly. Flickr was new at the time, and I really liked the aesthetic. But, upload all my photos there? They had just been bought by Yahoo. How long is Yahoo going to support the service? I still keep local archives of my photos, but I have thousands of photos shared on Flickr, and how do I know that all those captions, comments, geotags, annotations, sets and collections, that all that data might not one day go down with the slowly sinking-ship that is Yahoo?
What reassured me was the Flickr API. Worst case, I should be able to write a script to pull all that data to a local place somewhere and later reconstruct my online photo archive. If Flickr were going down, someone else would probably write that script better than I could. It is a grim thought, but at least when Flickr dies, there is an exit strategy.
It would be nice, though, if, when software was retired, especially cloud software, that it could be open sourced and available for the die-hard users to keep it running on their own servers somewhere. Admittedly, cloud services especially are vulnerable to further external dependencies . . .
You would think, though, that it shouldn’t take much effort on Google’s part to announce that a service has been retired, but they’ll keep it running indefinitely, at least until some point where the vast majority of the users had wandered on to more compelling alternatives. They still keep the Usenet archive around.
And, yes, I rely on Docs. This killing Reader fiasco sounds like an advertising ploy for Microsoft. I rely on Docs, but maybe Excel is a more trustworthy option for the long term . . . ?
If you are naming files on a computer, please use this format. The beauty is that if you list files in “alphabetical order” then these dates get listed in chronological order, because as far as a computer is concerned, the “0″ comes before “1″ and so forth. (And a year is more significant than a month is more significant than a day of the month . . .)
It is important to have that leading zero! Why? Because we have more than 10 months! Allow me to demonstrate:
If you are interacting with strftime() then what you want to remember is %F!
0-11:38 djh@noneedto ~$ date +%Y-%m-%d
0-11:38 djh@noneedto ~$ date +%F
0-11:38 djh@noneedto ~$ date +%Y%m%d%H%M # I sometimes use this for file timestamps but dont tell Randall Monroe
For my photographs, I have a directory hierarchy of %Y/%m-%B: