State Farm Encourages Living Dangerously

State Farm is another company that is trying to get customers to ignore TLS (or SSL for my fellow old-timers) by encouraging customers to log in from an apparently insecure page:

The form action for password submission is https://online.statefarm.com/apps/sessionmgmt/LoginService.asp? and that very well may be secure, but the fact remains that they are training their users to submit insecurely.

Cell Phone Risks

Last month I posted a pointer to Michael Blastland's recent column on statistics regarding cell phone usage and cancer. Yesterday, XKCD also had a thoughtful treatment of cell phone risks:

Really, it doesn't seem so surprising to think that cancer may cause cell phones.

OCR in Linux: First Impression

Tonight I was cleaning up and found a couple C programs from 1987. These were on paper, and I've been scanning and then recycling paper lately, and considered doing that here. I didn't want to take the time to type the code, though the programs were short. They were interesting enough that I might want to play with them in the future--one logs a Unix user out, killing all his processes, and the other returns the file name part of a path (dropping the path string before and the file extension). Okay, I'm not sure why that's interesting.

Besides, how many sheets of paper do you have laying around with 1987 dates marked "**** HONEYWELL FEDERAL SYSTEMS INC. CONFIDENTIAL and PROPRIETARY ****"? This dates to when I was on the SCOMP team, though has nothing SCOMP-related or even remotely confidential or proprietary. What was SCOMP? See http://en.wikipedia.org/wiki/Multilevel_security

So I scanned the code with xsane and noticed, as I had before, the option to save as text. As before, it didn't work, but this time I paid attention to the error message, gocr not found. So I googled and then install gocr (see http://jocr.sourceforge.net/) .

gocr does a respectable job, but not great. However, it's better than typing from scratch. Here are some  lines from the scanned text:


-    l2   jnclude stdio.h>
l3   include <signal.h>
l4
15   #define ALL_USEn_PROCS  -l
l6
l7   void main()
18
l9      int     kill();
20      jnt     process_id;
21      int     signal;
22
23      process  id = ALL USR PROCS;
24      signa! =- SIGKTL ;    -
25       void   rintf(''\nkil1ing all  rocesses...\n'');
26       void   ill(prOcess_id,  signa );

So it's missing underscores, curly brackets, and various other things. It looks like it added line numbers, but that's from the paper listing. Not great, but it beats typing that code from scratch, I guess.  There may be some options that help it do a better job, so if this becomes important I'll have a look.

How Many Things can Credo Do Wrong in One Billing Cycle Without Actually Phishing?

My latest cell phone bill is here. Yippee. But these folks did so many things wrong that I think I just have to say something. If I call them, they won't listen (actually, Credo might), so I'll write it up here where they almost certainly won't listen.

First, this is from the e-mail informing me that my bill is ready:

Nothing strange here, except when I click on the "sign in" link (something to be done only with care), it didn't take me to Credo Mobile:

Note the URL. Who the heck is credobilling.com? I know who it sounds like, and I strongly suspect it's really Credo, but they think it's a good idea for me to click on a link that takes me to a web site I have never before seen, and then provide my login credentials? Credo is training users to fall for phishing attacks.

Not comfortable with that, I type the correct address into my browser, credomobile.com. This is the page I get:

Note the Member Sign-In box at the lower right, and also note that there is no indication in the address bar of HTTPS in use. This amateur behavior is not new to Credo. At least one other outfit that I do online transactions with does this same thing; I'll post on that later. Sites that try to get users to submit passwords seemingly in the clear often have a more secure failure-mode. For example, if I provide my cell number but omit the password, I get here:

That's not really my phone number. Every month I get to see the same error message, but it's worth it to see the green https:// in the address bar before proceeding.

Printing to PDF, Firefox, Ubuntu

Off and on I've been irritated that Firefox print-to-file functionality defaults to postscript with the filename before the .ps extension blank. What's up with that? This is more of an issue now that I have a Kindle, and thus print to PDF much more often than to paper, so tonight I poked through about:config, shrugged, and turned to Google. I found one useful page, http://ubuntuforums.org/showpost.php?p=7890849&postcount=7, but prefer "my" way to his, simply because my filter places exactly the right configuration lines on the screen, leaving nothing to manual hunting.

1) Enter about:config.
2) Type print_to_filename in the filter bar.
3) Place exactly the same path, file name, and extension in each setting.

This is what mine now looks like:

Needless (I hope) to say, different folks will have different printers, and so my entry for an HL-2040 will be atypical and most other people will have printers not shown here.

There is no generally-useful file name, so indicating the application that generated the PDF seems a reasonable choice. IMHO, /tmp is the only reasonable directory to use so that the user's home directory isn't littered. Littering $HOME is an unfortunate tendency of Linux developers.

Mobile Phone Use May Not Cause Cancer!

Yet another good article by numerically-sensible BBC reporter Michael Blastland: http://www.bbc.co.uk/news/magazine-13886254

Sound Juicer on Ubuntu Broken

Sound Juicer now has trouble interacting with MusicBrainz to download CD names, track listings, etc. Googling led to J.P. Stacey's blog: http://www.jpstacey.info/blog/2011/06/13/sound-juicer-no-longer-retrieves-track-names-when-you-extract-audio-cds
Apparently CD Juicer has been using a deprecated feature at MusicBrainz and, as could be expected, MusicBrainz dropped support for the feature. Fortunately they still offer such a service, but CD Juicer has to be fixed to do it right.

My experience fixing this (Ubuntu 10.04) was to issue the add-apt-repository that Stacey suggests, but that gave me a 404 not found. I thought about editing config files, but decided to instead follow a link at Stacey's page to launchpad.net, or, specifically, to Philipp Wolfer: https://launchpad.net/~phw/+archive/musicbrainz
Wolfer has it right.

They'll be Sorry

CCBC is switching from WebCT to Blackboard 9.1. I know nothing about WebCT, but it is nearly inconceivable that it's worse than Blackboard 9.

Analogy: I've chosen an integer, 1. Then we generate a uniform discrete random integer in the range 0 to 32767.  What is the probability the random integer is less than one? Approximately the same probability that an unknown course management tool is worse than Blackboard?

Impressive Fireball at UMBC

Yesterday I was close enough to an explosion to feel the heat on
my face, 40m or so away. It was at the electrical substation just north
of the campus police station.  Not very loud, but an impressive
fireball. I have to start carrying a camera.

As a result, UMBC is closed today for lack of electricity. New media reports:

• Transformer Explosion Knocks Out UMBC Power, http://columbia.patch.com/articles/transformer-explosion-knocks-umbc-power
• Baltimore Sun apparently has no idea of or maybe no interest in what actually happened:   http://www.baltimoresun.com/news/education/bal-umbc-power-outage-0603,0,573995.story

Google Search for MyLife.com

A sampling:

• Complaintsboard.com has many people complaining that MyLife is a scam, uses false advertising, etc. I concur.
• Just say 'no' to mylife.com, http://techpaul.wordpress.com/2009/03/06/just-say-no-to-mylifecom/ . It appears that the author gave MyLife access to his e-mail accounts, and regretted it.
• Wikipedia has an article. Highlights: lawsuits against the company for e-mail spoofing. Parent reunion.com rated F by the LA BBB.
• "Mylife.com: A new tool for bargain-seeking stalkers" at http://www.socialmeteor.com/2009/02/28/mylifecom-a-new-tool-for-bargain-seeking-stalkers/ . This article goes into some detail about how MyLife is gathering and abusing PII. Recommended.
• "MyLife.com Accused of Running 'Spam-and-Scam' Scheme" http://www.walletpop.com/2011/03/02/mylife-com-accused-of-running-spam-and-scam-scheme/ discusses a lawsuit against these slimeballs (and I'm being completely objective here) in US District Court in Oakland, CA. Links are provided.
• TechCrunch talks about the birth of MyLife as a merger of reunion.com and wink.com. This corroborates much of what's in the Wikipedia article.

People Search, Phishing, MyLife, and All That

I recently wrote about getting information from the naive, though I phrased more harshly. This was at  http://martesmartes.blogspot.com/2011/04/how-to-get-personal-information-from.html. Then last week I saw a TV ad for mylife.com, offering to show a person who is searching for him or her.

First, I don't know how they can do this without the cooperation of Google or some of the alternative search engines. MyLife seems to be the same as the previously-discussed phishing sites. It asks for personal information, shows a picture of the user's neighborhood from Google Streetview, and then offers to to take a credit card number for outrageous ($13 per month and up) fees to provide results.

There is, however, an inconspicuous little link in the upper right to continue with free, limited access. I clicked. First, it took me to my profile--my fault, I entered personal info. How do I delete it? However, the page was surprising, with links to a couple family members and my ex-wife. I seriously dislike this site.

There was a link to my profile, but no option to delete. However, I was able to edit my profile, but the only meaningful field worth changing was my birthdate, which I changed to a wildly inaccurate value.

This site goes into my hosts file mapped to 127.0.0.1.

My best guess is that it the for-pay tell me who is searching for me feature, is simply internal: a record of people who have searched for me from within mylife.com. So, ultimately, it's a phishing site that thinks it's yet another redundant social media site.

Personal Data in Amazon MP3s

In December I discussed the buyer ID data that Amazon is placing in MP3 files, noted that the standard tools seem to not notice these IDs, and expressed a desire to write a script to display these IDs. See http://martesmartes.blogspot.com/2010/12/need-to-write-my-own.html and http://martesmartes.blogspot.com/2010/12/personal-information-in-amazon-mp3.html.

First, the script:

// Time-stamp: <2011-05-27 22:23:37 jdm>

// JFlex script to look for UID tags in an MP3 received from Amazon. If
// such a tag is encountered, it is displayed. Otherwise, there is no
// output.

// Compiling (assuming JFlex is installed)
//
// jflex findUID.lex
// javac Yylex.java

// Running:
//
// java Yylex <MP3 file name>

// Bugs:
//
// A left angle bracket, <, within the UID will cause the tag to not be
// displayed.
// Even though the MP3s that I have seen with UID tags have the tags
// near the beginning of the file and only one UID tag per file, this
// searches the entire (possibly long) file and will display multiple
// UIDs if found. Though this is probably not a bug, it does cause a
// perceptible delay.

%%

%standalone

%unicode
%int

openAngle  = <
uid        = UID
stuff      = [^<]+
tagEnd     = "</UID"
closeAngle = >
tag        = {openAngle}{uid}{stuff}{tagEnd}{closeAngle}

%%

{tag} { System.out.println(yytext()); return 0; }

.     { return 0; }

\n     { return 0; }

\r     { return 0; }

As mentioned in the comments, this is a JFlex script. JFlex's lineage dates back to the standard Unix lexical analyzer-building tool, lex, which was superseded by flex. JLex has been well-known in the Java community for awhile, but work on it seems to have ceased. JFlex, however, appears to be an active project (and an Ubuntu package). Of course, it works on Windows, too.  See http://jflex.de/

It turns out that Amazon informs the consumer when an MP3 will contain identifying information. I did not notice this before Michael D. pointed it out to me in January. The Amazon notice is in the product details and says "Record Company Required Metadata: Music file contains unique purchase identifier." Then they have a "Learn More" link. This is what Amazon has to say:

Record Company Required Metadata

The record company that supplies this song or album requires all companies that sell its downloadable music to include identifiers with the downloads.  Embedded in the metadata of each purchased MP3 from this record company are a random number Amazon assigns to your order, the Amazon store name, the purchase date and time, codes that identify the album and song (the UPC and ISRC), Amazon's digital signature, and an identifier that can be used to determine whether the audio has been modified.  In addition, Amazon inserts the first part of the email address associated with your Amazon.com account, so that you know these files are unique to you. Songs that include these identifiers are marked on their product detail page on Amazon.com.  These identifiers do not affect the playback experience in any way.

The idea seems to be that the record companies are requiring Amazon to put the information in, and Amazon is being honest about what's in there, though most consumers likely never see this information and never notice the link to it.

A few comments are in order.

• My script displays the UID tag and contents, but does not modify or remove it. I have no intention of providing such a script.
• People share MP3s at their own risk. As someone who has made good money developing software, I understand their need to earn a living. I even understand, though am less sympathetic toward, the RIAA's outrageous damage claims in suits. Any individual's decision to share, or not, is between him, his conscience, and the RIAA.
• The UID is the user's Amazon user ID. On the MP3s containing the UID that I have, my script displays this:  <UID version="1">martensjd</UID>. That's me. 
• Amazon says there is other identifying information embedded in the MP3. Read the statement above. So stripping this out will not be sufficient to hide the original buyer.
• I would rather not have this in my media files, but I don't object strongly enough to go through the files stripping it all out.

4G In Catonsville

I used to be a Xohm customer, and then Xohm switched to Clear. In time I was unhappy enough with Clear's service that it became time to switch myself, to Verizon FiOS. Xohm and Clear offered 802.16 (WiMAX) to home and mobile users at around, optimistically, 4Mb/s. FiOS is faster, typically 15Mb/s at my tier.

Clear (http://www.clear.com/) is now marketing their wireless Internet vaguely as 4G. They are also advertising lower speeds than before, which makes it unclear what technology they are using. 4G is a marketing term, and from an engineering or technical perspective, meaningless. Granted, WiMAX is also a marketing term (IEEE originally referred to 802.16 as Wireless MAN), but at least WiMAX actually means something.

Xohm marketed their service as WiMAX, and reading the fine print it was clearly 802.16. Clear has dummied their web site down to the extent that there is nary a clue what technology they are using. Actually, a bit more digging leads to a release at http://corporate.clearwire.com/releasedetail.cfm?ReleaseID=570046 that mentions legacy and mobile WiMAX, but also mentions partners using other technologies. Perhaps Clear is still predominantly 802.16, but advertised at a lower rate, which is consistent with what I was seeing when I canceled my Clear service. It may be that they are simply provisioning their towers at a lower rate per customer. The dumbing down of their web site is unfortunate.

Of course, Verizon is vague at their web site about what FiOS is, and I think there is an intentional effort on the parts of corporations in general to make it difficult for consumers to compare what different vendors are actually providing.

Why do I care? I just got my latest Verizon FiOS bill. It was $55, which is a lot for Internet service. Clear is $35, which is high for the poor performance they offer. So it was time to look around. Also time to reevaluate whether I really need Internet access at home.

One of the appealing things about Xohm when they came to Baltimore was the promise of $35 per month  for Internet access for life. But then Clear came in and reduce the service level. So it goes.

Of course, Judgment Day is today so maybe this is the beginning of my five months of torment.

Catonsville Nine Commemoration

Some of the real heroes of the Vietnam era anti-war movement are being commemorated Saturday 5/21. From the Indypendent Reader at   http://www.indyreader.org/content/catonsville-nine-commemoration:


CATONSVILLE NINE COMMEMORATION


May 21, 2011 - 12:00 - 14:00
CATONSVILLE NINE COMMEMORATION SATURDAY 21 MAY, 12N



The Baltimore Phil Berrigan Memorial Chapter of Veterans For Peace on Saturday 21 May
at 12 noon will commemorate the Catonsville Nine Viet Nam draft file burning action taken
by the chapter's namesake Phil Berrigan and 8 others.  Forty three years ago on May 17th
9 peace activists took draft files from the Catonsville Draft Board office and burned them
with homemade napalm in a Catonsville parking lot, and were eventually sentenced to jail
for their action.


At noon Baltimore VFP will gather at the Catonsville Post Office at Frederick Road and
Beaumont across from the Catonsville Public Library to vigil and hand out flyers, and will
later adjourn to the Knights of Columbus parking lot across the street for recollections
and fellowship. Please join us. Bring banners and posters. For information call Ellen
Barfield at 410-243-5876, or e-mail ellene4pj@yahoo.com.


Location


Catonsville Post Office
Frederick Road and
Baltimore, MD
United States
39° 36' 32.3712" N, 77° 42' 18.1764" W

How to get Personal Information from Morons, Part II

Saturday I spent a few minutes messing with a phishing site that was trying to mess with me, webspyapp.com. I stopped at the point that it wanted a cell number, and rejected made-up ones. I didn't have a number I was willing to give them in order to receive their texts. This morning a colleague donated his recently-disused number, so I gave it another shot.

I ended up at http://gtoffers.com/coreg/entry.php?p=bg266533g6&sid=p1&limit=2&phone=7178914944&redirect=http%3A%2F%2Fofferlabs.com%2Fc.php%3Fa%3D119%26o%3D183%26sid%3Dp1&head=http://d18j1d26sau8be.cloudfront.net/user_images/13016043631131154035370.png, which tried to install a browser extension.

At this point I stopped.