I’m posting this so I’ll remember, and in case someone else is googling around for it.

I have a little editor I wrote in javascript for creating blogposts. When I’m done editing, it loads the transmogrified text into an iframe that contains the WordPress /wp-admin/post.php page (which is the one you create posts with). Except that it stopped working recently, giving me “X-FRAME-OPTIONS” errors.

A little research showed that x-frame-options are set at the server to prevent people from capturing your pages in their own evil iframes (e.g., inserting your blog posts into their spammy site), either by preventing anyone from doing so, or preventing anyone from inserting into a page that isn’t from the same site as the source page.

I couldn’t figure out how to unset those options. But Chason C., at MediaTemple.net — my hosting company — got back to me within 24 hours with the answer. It turns out that MediaTemple isn’t setting that option; WordPress is. The solution is explained in this blog post, which Chason found for me.

The irony is that the blogpost with the answer has actually captured and embedded the original blog post by Igor at KrazyWorks, which you can find here.

2 Comments »

If you insert a text overlay into a movie you’re editing with iMovie 09 and then want to move it so that it matches up better with what’s going on in the movie, go ahead. I dare you. Aarrrgggh.

When you try to grab the blue text box floating above the clip, iMovie will think you’re trying to move the cursor (the red line) that marks where you are in the clip. No matter how you try to grab the little bugger, it won’t work. (Well, occasionally it seems to, but I haven’t figured out why.)

The trick (which I keep forgetting, which is one reason I’m blogging this) is to click on a clip so that you get the thick yellow outline around it, and then click on the little gear button that appears at the bottom left of the clip, and choose “Precision Editor.”

Now you’ll be able to drag the text box to where you want.

Don’t forget to close the Precision Editor by clicking on the “Done” button that shows up at the top of the bottom window (well, unless you’ve switched the position of the windows) so that you can go back to normal editing of the clip.

2 Comments »

After literally decades of using Microsoft Word I just found out that it does regex!

I discovered this because I needed to delete comments inserted throughout my book manuscript, in the form . Hundreds of them. I was contemplating exporting to HTML so I could use a text editor that can handle this type of search and replace, but came across an article on how to use regular expressions in Word. Regexes let you use magical incantations that no one understands but that cause text to dance in little circles and transform themselves in puffs of smoke.

For example, to get rid of the pesky markup in my manuscript, I just had to tell the Replace dialogue to use wildcards, and then had it search for \<AU:?\>. The backslashes are necessary so that the angle brackets are not read as regex instructions. The question mark tells Word to find everything between <AU: and >. Simple! And it accepts far more complex regular expressions that. (Here’s a site that lets you test your regular expressions.)

Take a well deserved bow, Microsoft Word! (And then fix auto-numbers.)

1 Comment »

Full justification of a page — so the page margins are flush to both the left and right edges — sounds like what you want in a professional book, but when computers are laying out pages on the fly on small screens, and especially when they are under the constraints of having relatively few words per line to play with, it can result in ugliness.

When I first got my Kindle 1, it let you decide whether you wanted left justification (= “ragged right”) or full justification. Then Amazon upgraded the software and took away that option, which was not my favorite upgrade ever. (Maybe I just failed to find the hack to restore it.) I just got a Kindle 3, on the occasion of my Kindle 1’s screen losing a valiant battle against pressure in an over-stuffed backpack. There is a hack for the Kindle 3 that has restored the option, except where publishers have explicitly created fully justified texts. Go here and follow the advice in reply #1 scrupulously. (If you don’t know about UNIX line endings, you might not want to try this.)

I also altered one of the existing lines to “JUSTIFICATION=left”, which may be having the effect of setting the default to ragged right, but I’m not sure. At least it didn’t obviously break my Kindle. (Which reminds me: You’re responsible for whatever damage following the advice here may cause. What are you doing following advice in a blog, anyway?)

2 Comments »

Because I had to click around a few times, trying out instructions that did not work, here’s a link to instructions that actually do install LibreOffice on Uubuntu. The instructions that don’t work tell you to open a DEBS folder that does not exist. The instructions that do work have you use a PPA (Personal Package Archives), about which you need to know as little as I do (= nothing).

You do have to know how to type commands in a terminal window, however.

Also, this installation leaves your old copy of Open Office untouched. If you want to uninstall Open Office entirely, I am told you should type this into a terminal: sudo apt-get remove openoffice*.*

LibreOffice is the fork from Open Office now that Oracle has taken possession of the latter. Right now it’s almost exactly the same, but it’s where the interesting future developments will occur.

Be the first to comment »

Firefox is hyping/explaining Firefox 4 with a “web o’ wonder” site that features three demos. I found the HTML5 poster helpful.

On the other hand, the page does a lousy job of explaining what “The London Project” is demonstrating. (Plus, the video playback really needs some indication of how long it is.)

1 Comment »

I enjoyed this explanation of how Google updates Chrome faster than ever by cleverly only updating the elements that have changed. The problem is that software in executable form usually uses spots in memory that are hard-coded into it: Instead of saying “Take the number_of_miles_traveled and divide it by number_of_gallons_used…”, it says “Take the number stored at memory address #1876023…” (I’m obviously simplifying it.) If you insert or delete code from the program, the memory addresses will probably change, so that the program is now looking in the wrong spot for the numbers of miles traveled, and for instructions about what to do next. You can only hope that the crash will be fast and while in the presence of those who love you.

So, I enjoyed the Chrome article for a few reasons.

First, it was written clearly enough that even I could follow it, pretty much.

Second, the technique they use is not only clever, it bounces between levels of abstraction. The compiled code that runs on your computer generally is at a low level of abstraction: What the programmer thinks of as a symbol (a variable) such as number_of_miles_traveled gets turned into a memory address. The Chrome update system reintroduces a useful level of abstraction.

Third, I like what this says about the nature of information. I don’t think Courgette (the update system) counts as a compression algorithm, because it does not enable fewer bits to encode more information, but it does enable fewer bits to have more effect. Or maybe it does count as compression if we consider Chrome to be not a piece of software that runs on client computers but to be a system of clients connected to a central server that is spread out across both space and time. In either case, information is weird.

1 Comment »

I may come back to expand on this post, but for now: If you are looking for the 1.09 bios of the Shuttle XS35 so that you can get the !@#$-ing wifi to work, I’ve placed a putative copy here. There’s an explanation of how to install it here. Please note that I am still in the process of trying to get the bios installed, so I cannot vouch for the integrity of the bios or of the instructions. Proceed at your own risk.

(If it’s not clear from context: The Shuttle mini-computer claims to come with wifi, but it needs a bios update to v1.09 get it to work, and the only version on the Shuttle site is 1.08. There are a few copies of 1.09 strewn about the Web, but mainly at shady “free updates” and “free bios” sites that send you on a self-circling clickfest that may or many not have any exit. So I found a copy – which may or may not work – and have posted it.)

Later that night: It worked. The wifi is on. But it really shouldn’t be that hard, and Shuttle ought to ship it with a working bios, or at least give us the updated one and the instructions we need.

2 Comments »

Hal Roberts, Ethan Zuckerman [twitter:ethanz] , and Jillian York [twitter:jilliancyork] are doing a Berkman lunchtime talk on Distributed Denial of Service [DDoS] Attacks against Human Rights Sites, reporting on a paper they’ve posted.

A DDoS is an attack that consumes the resources of the target machine so that that machine is not able to respond, Hal says. It is an old problem: there was a CERT Advisory about an IP spoofing attack in 1996. A distributed DoS attack uses lots of machines to attack the host, typically via botnets (armies of infected machines). Hal gives an example in which infected machines check Twitter once a minute looking for encoded commands to do nefarious tasks. Gambling sites have often been targets, in part because they are reluctant to report attacks; they’ve also been known to attack each other. In one case, this resulted in the Net going down for 9 hours for most of China. Hal points out that botnets are not the only way DDoS attacks are carried out. In addition, there have been political uses. Botnets have been used to spy as well as bring down sites.

One monitor (Arbor Networks) notes 5-1500 DDoS attacks per day, globally. Hal thinks this number is too low, in part because there are many small attacks.

An application attack “crashes the box.” E.g., a slowloris attack slows down the host’s response time, reducing the number of available TCP connections. App attacks can be clever. E.g., simply reloading a homepage draws upon cached data, but doing searches on random words can be much more effective.

A network attack “clogs the pipe.” It floods the target with as much traffic as it can. This often will take down all the sites hosted by the ISP, not just the target site. The powerful network attacks are almost all “amplification” attacks. E.g., you request a big chunk of data: a little data in requests a massive amount of data back.

To defend against DDoS, you can optimize your server and harden it; you can build in over capacity; you can create a system that adds more resources as required; you can do packet filtering or rate limitation; you can scrub the attacking packets by “outsourcing” them to highly experience sys admins who look for signs in the packets that distinguish good from bad; if flooded, you can do source mitigation, asking routers routing the flood to you to block the packets; or, you can tell your ISP to dynamically reroute the packets. But, none of these technique work well enough or are too expensive.

The study by Hal, Ethan, Jillian, et al., asked a few key questions about how this affects human rights sites: How prevalent are DDoS attacks? What types are used? What’s the impact? How can sites defend against them? To answer these, they aggregated all the media reports, they surved human rights and media organizations. They interviewed respondents. And they hosted a meeting at Harvard. They learned:

• Attacks are common

• Sites on the edge of the Net, such as indie media, are particularly vulnerable

• It’s not just DDoS attacks

• There are some good answers for application attacks, but fewer for network attacks

• Network attacks may provoke a move to the core

• It helps to connect local geeks with core sysadmins

In their media research, they found lots of attacks, but not a strong correlation between the attacks and the politics of the attacked sites. The data are hampered, however, by the difficulty of gathering the info. Not all sites know they’ve been DDoS’ed. And the study had to use large boolean queries to try to find coverage in the media.

Even though there are many attacks, the core (Tier 1 providers, plus their direct customers) does well against DDoS attacks. Those Tier 1 sysadmins work closely together. But, as you get out further from the center — a customer of a customer of a customer of a Tier 1 operator — people have little recourse. “Being at the edge in terms of DDoS is a really bad thing,” says Ethan. The core has dedicated staff and a ton of bandwidth. They typically respond to a DDoS within an hour, and probably within 15 mins. So, if you’re Google, it’s not that much of a problem for you.

But, if you’re a small human rights site, it’s much harder to defend yourself. E.g., Viet Tan has been attacked repeatedly, probably by the Vietnamese government. Worse, they’re not just being DDoS’ed. 72% of those who said they’ve been DDoS’ed are filtered by their governments. 62% have experience ddos attacks. 39% have had an intrusion. 32% have been defaced. Viet Tan was being attacked not just by a botnet, but by the Vietnamese around the world by people who had downloaded a keyboard driver that logged keystrokes and could issue attacks. The people attacking them were the people they were trying to reach. “It’s an incredibly sophisticated way of doing things,” says Ethan.

Arbor Networks says 45% are flood-based, and 26% are app based. Hal et al. sent Arbor the list of attacks his research had uncovered, but Arbor had only known of a small percentage of them, which is some small evidence that Arbor is under-reported.

Of the sites that eperience a DDoS attack last year, 56% had their sites shut down by their ISP, while 36% report that their ISPs successfully defended them. E.g., there was an attack on the Burmese dissident site, irrawaddy.org. This knocked not just that site out, but all of Thailand. Thailand has its own national ISP, which is Tier 2 or 3; a 1gb/sec attack will take down an ISP of that size. Irrawaddy moved ISPs, got hit with a 4gb attack and could not afford to pay for the additional bandwidth.

Hal points to the consolidation of content through fewer and fewer ASNs. In 2007, thousands of ASN’s cotribted 50% of content. In 2009, 150 ASNs contributed 50% of all Net traffic. This may be in part due to the rise of high def video (coming through a few providers), but there’s also fewer on the long tail providing content (e.g., using gmail instead of your own mail server, blogging on a cloud service, etc.). Small sites, not in the core, are at risk.

Should you build dedicated hosting services for human rights sites? That puts all your most at-risk sites in one pool. How do you figure the risk and thus the price? One free host for human rights sites does it for free because they’re a research group and want to watch the DDoS attacks.

The paper Hal et al wrote suggests that human rights sites move into the cloud. E.g., Google’s Blogger offers world class DDoS protection. But, this would mean exchanging the control of the DDoS attackers for the control of proprietary companies that might decide to shut them down. E.g., WikiLeaks moved onto Amazon’s cloud services, and then Amazon caved to Joe Lieberman and shut WikiLeaks down. The right lesson is that whenever you let someone else host your content, you are subject to intermediary censorship. It is an Internet architecture problem. We can respond to it architecturally — e.g., serve off of peer-to-peer networks — or form a consumer movement to demand non-censorship by hosts.

(The attacks by Anonymous were successful mainly against marketing sites. They don’t work against large sites.)

Recommendations:

• Plan ahead

• Minimize dynamic pages

• Have robust monitoring, mirroring, and failover

• Strongly consider hosting on blogger or something similar

• Do not use the cheapest hosting provider or dns registrar

Bigger picture recommendations: In the most successful communities, there is an identifiable, embedded, technical experts who can get on the phone to highly-connected core systems. Many of these core entities — Yahoo, Google, etc. — want to help but don’t know how. In the meantime, more will move to cloud hosting, which means there’s a need for a policy, public pressure approach to ensure private companies do the right thing.

Q: Shaming as a technique?
A: We need to do this. But it doesn’t work if you’re, say, a large social media service with 500M users. Human rights orgs are a tin percentage of their users. They tend to make the easy decisions for them, and they’re not very transparent. (Tunisia may turn out to be turning point for Facebook, in part because FB was under attack there, and because it was heavily used by Tunisians.)

Q: Public hosting by the government for human rights groups?
A: Three worries. 1. It’s hard to imagine the intermediary censorship being less aggressive than from commercial companies. 2. It’d be a honeypot for attacks. 3. I’m not sure the US govt has the best geeks. Also, there’s a scaling problem. Akamai carries 2TB/sec of legit traffic. It can absorb an attack But the US would have to create a service that can handle 200gb/sec, which would be very expensive.

Q: What sort of tech expertise do you need to mount an attack?
A: The malware market is highly diversified and commodified. Almost all the botnets are mercenary. Some are hosted by countries that in exchange ask the botnets be turned on enemies now and then.

Q: Denial of payment?
A: We have a case in the study called “denial of service by bureaucracy.” E.g., a domain name was hijacked, and it took 6 wks to resolve. A denial of service attack doesn’t have to attack the server software.

Q: Can botnets be reverse engineered?
A: Yes. Arbor Net listens to the traffic to and from infected computers.
A: You either have to shift the responsibility to the PCs, or put it on the ISP. Some say it’s crazy that ISPs do nothing about subscribers whose computers are running continuously, etc.

[Fabulous presentation: Amazing compression of difficult material into a 1.5 hour totally understandable package. Go to the Berkman site to get the webcast when it’s ready.]

1 Comment »

Mainly because I wanted to futz around with the Google Maps API, I’ve created a mashup that pretends to lay out all the shelves in Harvard’s 73 libraries on a map.

You can choose your starting point — it defaults to Widener Library at Harvard — and choose whether you’d like to see a line of markers or concentric circles. It then pretends to map the shelves according to how many books there are in each subject.

Here’s where the pretending comes in. First, I have assumed that each book in the 12,000,000 volume collection is one inch thick. Second, I have used the Dewey Decimal system’s ten subject areas, even though Harvard doesn’t use Dewey. Third, I used an almost entirely arbitrary method to figure out how many books are in each subject: I did keyword subject searches. Sometimes, when the totals seemed way too low, I added in searches on sub-headings in Dewey. At the end, the total was probably closer to 4 million, which means my methodology was 300% unreliable. (Note: Math was never my strong suit.)

So, the actual data is bogus. For me, learning how to use the API was the real point. If you happen to have actual data for your local library, you can download the page and just plug them into the array at the beginning of the page. (All the code is in the .html file.)

4 Comments »