Keeping Work and Personal E-mail Separated

A group in Michigan has submitted a Freedom off Information Act
request for all e-mail from University of Michigan, Michigan State,
and Wayne State faculty mentioning the labor brouhaha in Wisconsin.
Similarly, but less broadly, the Wisconsin Republican Party requested records from a University of Wisconsin History
professor. The Michigan request seems very broad, asking for all
e-mails mentioning “Scott Walker,” “Madison,” “Wisconsin” or “Rachel
Maddow.” I can imagine this request would net much mail not related to
labor issues.

I think this should serve as a reminder, especially to state
employees, to keep personal and work e-mail separate.

Source: http://www.nytimes.com/2011/03/30/education/30professors.html

Using the Hosts File to Block Advertising

A small chunk of my linkedin page is to the right. My machine doesn't look up the IP address for doubleclick, and so I never see their content. A drawback is that it also thwarts any attempt I make to click on a targeted advertising link from Google within Gmail. That's okay.

Here's my /etc/hosts file:

127.0.0.1       localhost
127.0.1.1       asusCG

127.0.0.1       ad.doubleclick.com
127.0.0.1       ad.doubleclick.net
127.0.0.1       ad2.netshelter.net
127.0.0.1       adbrite.com
127.0.0.1       ads.adsonar.com
127.0.0.1       ads.vrx.adbrite.com
127.0.0.1       an.tacoda.net
127.0.0.1       assets.bizjournals.com
127.0.0.1       b.scorecardresearch.com
127.0.0.1       itemnotfound.com
127.0.0.1       netshelter.net
127.0.0.1       pagead2.googlesyndication.com
127.0.0.1       s24.sitemeter.com
127.0.0.1       scorecardresearch.com
127.0.0.1       sitemeter.com
127.0.0.1       sitemeter.com
127.0.0.1       static.2mdn.net
127.0.0.1       stimpy.musicbrainz.com
127.0.0.1       stimpy.musicbrainz.org
127.0.0.1       tacoda.net
127.0.0.1       vrx.adbrite.com
127.0.0.1       www.itemnotfound.com
127.0.0.1       www.sitemeter.com
127.0.0.1       www.spoke.com
127.0.0.1       www.tacoda.net
127.0.0.1       wwwv.itemnotfound.com
127.0.0.1       wwwwv.itemnotfound.com


# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts

You can edit your /etc/hosts, but I'd suggest leaving the stuff at the top of the file (above the doubleclick entries) and the bottom (below wwwwv.itemnotfound.com) alone.

The way this works is as a shortcut to name resolution, e.g., I can place an IP address and a domain name on a line in this file and rather than going out to the DNS to look up the name, it uses the IP address in the first column of the line. So, any lookup to tacoda.net
resolves to the IP loop-back address, which is my machine. I don't have a web server at that port, so the connection attempt fails.

This is a very common technique, and one can google to find other people's hosts files with lists of sites they block.

For simplicity of adding entries, I place my hosts file in a subdirectory writable by my account, and then place a soft link from /etc/hosts there.

For Windows people, the file is (as of a few years ago) hosts.txt, and I think it was buried somewhere in the system32 subdirectory. Of course, Windows doesn't support links, soft links, or anything like that. Windows does support shortcuts, but these aren't within the file system, and so are much less generally useful.

Some question the ethics of freeloading on advertiser-supplied content by blocking the ads. I have three responses:
(1) Advertising often contains scripting which threatens the safety and stability of my system. If they stop using insecure scripting languages, I might revisit this issue.
(2) Advertising sometimes starts unwelcome sound or video content, including animated gifs. This is intrusive and disruptive. Advertising scripts also often eat up many CPU cycles. If advertisers start treating users with more respect, I might revisit this issue.
(3) The above two points greatly reduce the value of the content presented along with the advertising, to the point that I would be less likely to visit any particular page. They cannot argue in the general case that they are losing revenue due to my blocking advertisements, because in many cases I simply would not visit the page.

I endorse a multilayered approach against intrusive advertisement: Adblock Plus, NoScript, and the hosts file. IMHO if a machine has private data on it, e.g., student grades, then the owner has a responsibility to block scripts from questionable source, e.g., advertisers. With personal information, e.g., financial information, it is foolish to not block these things.

Blocking myUMBC Alerts

I suggest AdBlock Plus for disabling myUMBC alerts. I find it distracting to see that I have alerts. What if it's something worth looking at? It's never happened, but there could be a first time. Today I received two "personalized" alerts telling me it's windy outside. How much time is wasted campus-wide by these things?

I realize the country has been quaking in its collective boots since fall 2001, and campuses fall victim to fear mongers, like E2Campus, who have been profiting off the Virginia Tech shootings, but this whole notion that UMBC needs an alert system is silly, and the way it is currently misused is strong evidence of that fact.

Will I get an alert that it's dark outside tonight? Nope, I know how to use Adblock Plus.

My Recent Trip to Greece

The pictures are here:

• Athens Day One
• Diakofto and Kalavryta
• Archaeology Museum and Filopappou Hill
• Cape Sounion and the Acropolis Museum
• Delphi
• The Peloponnese
• The Saronic Gulf

Google Attempting to Coerce Picasa Users

For the past few weeks I have been prompted by Picasa to link my photos to my Google profile. This nagware appears every time I visit Picasa. It also appears I cannot comment on even my own photos without linking my Picasa account with my Google profile. I got rid of the nagging (or so it seems) by deleting my Google profile. It seems I've done this before.

Google has no regard whatsoever for its users' privacy.

The Value Added by Radio Shack

Why do people pay a premium to buy from Radio Shack rather from other, less expensive, sources? Is it the expertise of their sales people? Probably not.

Today I was in need of an SD card for a digital camera, and the camera is a few years old, so it had to be SD, and not SDHC. I wanted the card today, and the HH Gregg web site wouldn't tell me clearly whether the local store had SD in stock, but both of the closest Radio Shacks did. So I went to the Radio Shack on Wilkins Ave. I guess immediate acquisition and convenience are two reasons to go to Radio Shack.

At Radio Shack, I found the SD/SDHC/USB Flash display, but the SD items were empty. So I went to the register and asked if they had SD in stock. The salesperson proceeded to show me an SDHC card. I told him that was SDHC and I needed SD. He said "same thing." I told him no, and he came up with a 2 GB SD card.

The reason people go to Radio Shack certainly can't be the helpful, knowledgeable salespeople.

Amazon MP3 Downloader

I get the feeling that
(a) Amazon cares little about Linux, and
(b) the Amazon MP3 downloader was done by very inexperienced or very poor developers.

Linux is a very small sliver of the market, so (a) is unsurprising.

My reason for casting stones at their developer is that the downloader does not work with 64b CPUs and now when I try to install it on a 32b Ubuntu 10.10 I get the message Dependency is not satisfiable: libboost-filesystem1.34.1. After installing version 1.42.0 of the libboost filesystem, I still get the error message. This strongly suggests that someone coded the dependency checks for only one version of the library, or wrote the code not considering the possibility that newer versions would be backward compatible.

I like Amazon, though I am done dealing with Amazon Sellers. Tonight Amazon had me thinking I might have to go elsewhere for MP3 downloads. However, a little googling and then a moment in the Ubuntu Software Center led to clamz. It appears there are a few other tools to do this, but clamz is the only one I see as an officially-supported Ubuntu package. And it works (or at least on the one album I pointed it at tonight).

I prefer using clamz over the Amazon downloader, because it's less closed software on my machine. Clamz likely does it's job, and nothing more. The Amazon downloader, for those lucky enough to have a system it works on, has always been an unknown factor--it downloads MP3s, but does it do something else? Probably not, but one never knows.

As an aside, the MP3s that I downloaded tonight do not have the same identifying information as the ones I wrote about last week. It may be obfuscated, encrypted, or just not present.

Personal Information in Amazon MP3 Files

A few days ago I wrote about Amazon placing personally-identifiable information within MP3 files. Here is an example, from near the beginning of an MP3 downloaded recently.

<?xml version="1.0" encoding="UTF-8"?>
<uits:UITS xmlns:uits="http://www.udirector.net/schemas/2009/uits/1.1" 
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <metadata>
    <nonce>Yvjd12Il</nonce>
    <Distributor>Amazon.com</Distributor>
    <Time>2010-10-24T04:41:17Z</Time>
    <ProductID 
       type="UPC" 
       completed="true">
      10731458698620
    </ProductID>
    <AssetID 
       type="ISRC">GBAAN0200016
    </AssetID>
    <TID version="1">
      plaIo2V1UdVjRvVYo2vBICme1kF4PYav
    </TID>
    <UID version="1"> MY USERID HERE </UID>
    <Media algorithm="SHA256">
      4fda5179408e867619d5321b804fd1d16cb1ffd4f3d3485b48c241f803444897
    </Media>
  </metadata>
  <signature 
     algorithm="DSA2048" 
     canonicalization="none" 
     keyID="9b3a698acfcfea37b486aba46bdfb50c92b8f7fe">MC4CFQCLUjy5GJIaXROMGuef/iTBI3ADngIVAI1ZVWo9+IA6FAVXQ5feBVbi3yH6
  </signature>
</uits:UITS>

I've done a little reformatting, replaced my user I.D. with a placeholder, and modified some hashes and keys, but you can easily get the basic idea. My advice is to be reluctant to share these files, or to strip the XML at the beginning.

This is a fairly recent change for Amazon. This information is not present in a song I downloaded from Amazon in August.

Migrating UMBC E-mail to Gmail

Some months ago UMBC began migrating e-mail to the Google cloud. This migration has been voluntary, but everyone will be moved over in January. I like Gmail, and considered moving some months ago, but decided not to because it was unclear whether there would be a solid wall (psychologically as well as logically) between my personal Gmail account and my UMBC Gmail account. This will not be an issue for a number of reasons:

(1) The accounts are separate, one reached via mail.google.com and the other via gmail.umbc.edu. I can reach both via the traditional mail.google.com URL, but with two different user names. I plan to explicitly go via (and link to) the gmail.umbc.edu address.

(2) I usually use Chrome for Gmail, but use Firefox for UMBC (myUMBC) services. Firefox add-ons allow me to selectively turn off undesired scripting within myUMBC and Chrome does not display PeopleSoft slop properly (I suspect it really does, however, and that PeopleSoft is simply not following web standards, but this is something for future investigation). So I will continue to use Chrome for personal Gmail, and will use Firefox for UMBC mail.

(3) I use different themes for the two Gmail services, and so my work and my personal screens look very different.

(4) The UMBC Gmail has "myUMBC" prominently displayed in the upper left.

(5) If all of that is not enough, I can simply return to an IMAP client for UMBC e-mail and continue to use the browser for personal Gmail.

The one drawback I have seen in my initial look is that Google says it may take several days for my old e-mail to migrate to Google. Since I have switched, I can no longer access UMBC Squirrel mail, and so none of my old e-mail folders are currently available via the web. Since grades are due in a couple weeks, this could become sufficient motivation to temporarily configure an IMAP client on my laptop. However, I do not foresee much inconvenience here except possibly delaying my grading of assignments submitted via e-mail.

I do suspect there is still a way into squirrel mail, but do not plan to spend any time finding the way.

Need to Write My Own

MP3 files purchased from Amazon have identifying information within them, likely to catch, if not to actually deter, file sharing. At the beginning of the file is some XML including time and date downloaded, the Amazon user ID, a nonce, the distributer (Amazon.com in this case), and a digital signature (presumably so modification will be detected). Easytag does not display any of this XML data.

My intention was to place an excerpt here, but formatting XML within Blogger is more trouble than it's worth. Just view an MP3 from Amazon within an editor, e.g., emacs.

The upshot is that, since easytag doesn't display these tags, I'll have to write my own filter to do such.

Alta Vista to Shut Down, but Apparently not Babel Fish

PC World has a brief article announcing the end of Alta Vista, the best search engine before Google, and in the author's opinion (and mine) the second best search engine to date. I would let this pass without comment, as one of the last vestiges of DEC going away, but I read a (likely false) report that Yahoo will also be shutting down Babel Fish, which is a fairly good, convenient, translation service. I guess would be partly to blame here: just as I stopped using Alta Vista when Google came along, I've been gravitating toward Google Language Tools rather than Babel Fish lately.

However, the second page a Google news search led me to as I tried to ascertain the fate of Babel Fish says it has been spared for now.

Google Web History: Beware

I deleted and paused my Google Web History some time back, thinking that meant Google would stop collecting "my" web history. This morning I was changing some Google account settings and clicked on Web History. They had started maintaining web history for me again. So I again had to delete everything and "pause" my web history. Apparently pause does mean pause, and Google pops the account off pause willy-nilly, or by some algorithm known to them, but not to their users.

The thing to do is to remove the web history. From Google Account Help:

Using Web History: Deleting
You can delete Web History from your Google Account at any time. Just follow these steps:

Click the My Account link from the Google homepage.
Click Edit next to 'My products.'
Click Delete Web History. Make sure you're signed in to your Google Account to see the My Account link.
Note: Deleting Web History from your Google Account will erase all items from your Web History and stop your Web History from being recorded in the future. You can also remove individual items without deleting all of your Web History.

Xfce? No, I don't Think So

I just checked the xfce site to see if their documentation situation has improved. They seem to be preparing the 4.8 release, with 4.6 in use, but the documentation is 4.2,. No way I'm going back to that--it appears to be run by a bunch of coders with no interest in the user. Thus, xfce developers, IMHO, are developing for themselves, but not for the wider Linux community. There's nothing wrong with that, but I think things like Xubuntu should be discontinued until someone thinks xfce is worth documenting.

Quick Note on Address Bar Auto-Completion

Firefox and Opera, by default, have a search field (it's a text field but Firefox calls it the search bar) to the right of the address bar. I've removed mine--it's redundant and cumbersome (or so I thought, but see point 3 below), and an information leak.

I often have students in my office for advising and typically go over their online records. This means they look at my web browser. This also means they can read titles of tabs (fine, so be it) and contents of the search bar. I'd hate to have a student read too much into the fact that I've recently searched for Shaun Cassidy. So in my office I removed the search bar and just open a new tab (^t) and hit the g key. This takes me immediately to Google.

(1) Most of my searches are Google searches. I played with Bing when it first came out, but Bing's results don't seems as good, and Bing seems to use a fair amount of client-side scripting, which I'd rather avoid. Google does too, but they already know everything about me.

(2) I may sometimes prefer a Wikipedia search or some such, but very often the appropriate Wikipedia page is near the top of the search results, so Wikipedia search is redundant.

(3) Doing a quick lookup for this posting led me to http://www.mozilla.com/en-US/firefox/search.html, which points out that one can select text and drag it to the search bar, which seems to work well. So my search bar is, at least temporarily, back in my Firefox window on most of my machines--just not the one in my office.

Arvind Goes to Washington

Arvind Narayanan (no, not that Arvind) just served on a 'Do Not Track' panel in DC, and writes intelligently about his experiences, e.g., on how the system in DC is not as effective as one might hope. Rather than paraphrase or summarize, I'll just point to the original article.