Spamming, Phishing, Authentication, and Privacy: it's not 2004 Anymore

I was just reading the Inside Risks column in the December 2004 CACM, and was struck by the opening statement: "It isn't news to most readers that email is becoming almost unusable." This was largely because of spam and phishing.

Kids these days have no idea how good they have it [ insert emoticon ]. Spam and phishing are almost non-problems for me now that both my personal and work e-mail accounts are hosted by Google. Gmail's spam filtering is excellent and even on the off chance that I have a look at a spam message, Google is good about flagging e-mail as possible forgeries, possible phishing, etc. Just a year and a half ago thing were not so good, but that was largely because UMBC was hosting its own e-mail, and occasionally e-mail from legitimate UMBC users would be shuffled off to my spam folder by UMBC's spam filters.

There are two minor annoyances I still have with spam.

1. One is that there are a number of putative conferences that apparently send to mailing lists harvested from academic web sites. These tend to be in south or east Asia, and fall into two categories: outside my interests, or not prominent enough that I've ever heard of them. It's not that they are necessarily bad conferences, but if they were any good, why not get the word out through legitimate channels?
2. A former co-worker apparently shared his e-mail address book with a social networking site cum spammer [ yourfanbox.com ] that repeatedly reminds me that Tom U. wants to connect through that site. Or maybe someone broke into his account. Or possibly they are complete forgeries. Gmail categorizes them as spam, but still the first few times I saw the name of this former coworker, I looked at the e-mail. Of course, Gmail doesn't open remote images, so there should be no way for the spammer to know I looked.

Added 2011-10-13: the spam claims to be from yourfanbox.com, which claims to have offices at FanBox  113 West G St, STE 510, San Diego. There is a link to control future e-mails, but no way I'm visiting a spammer's web site. Not from my machine.

Tesla!

As a testament to the sorry state of science education in the US, a woman called in to the Diane Rehm Show Today, talked briefly to Jeremy Rifkin and Diane, and brought up the free energy source discovered by Tesla. No one pointed out to her that it doesn't work. She said she had recently read a book about it, which shouldn't be surprising since there are still creationists and people who believe global warming is a hoax, also in disappointingly large numbers in this country.

Suppose you do believe that Tesla discovered a source of free energy. Then explain this one thing:
Why isn't anyone getting rich selling energy from the device? Obviously there are scammers advertising generators in the hope that the naive and ignorant will buy them, but no one is attempting to sell electricity from one of these devices. Why not? Hint: it doesn't have anything to do with a big energy/government cover-up.

Biodiesel From Wendy's

I visited the drive-through at the Wendy's on West Nursery last week, and there were sizable tanks labeled RTI visible through the window. These were most likely part of the biodiesel fuel stream from Restaurant Technology Incorporated: http://biodieselmagazine.com/articles/4414/waste-oil%27s--new-world
Way cool. And I thought there was nothing good about Wendy's All-Salt Fries.

Ubuntu Unity: a Guide for the Perplexed

After a little time with Unity, I've decided it really is simple to work with. If you can figure out how to get to the command line (I had to Google it), start with the following two commands:

sudo apt-get install gnome  // kde is fine too
sudo apt-get remove unity

Log out, and then back in, and you should find a much more usable system.

LinkedIn Privacy Issue

Look in your LinkedIn account settings. Under Groups, Companies, and Applications there are two data sharing options, Turn on/off data sharing with 3rd party applications and Manage settings for LinkedIn plugins on third-party sites. These were enabled in my configuration, so very likely LinkedIn has decided to treat all users, by default, with little respect. This is an opt-out intrusion. I suggest people opt out.

Wait, I'm on LinkedIn and I'm talking about privacy?

Slash, Backslash, Whatever

Occasionally someone in the media will read a URL and say "backslash" for the path separator, which is obviously wrong. Tonight I was on the phone with a Discover Card operator, and she invited me to visit www.discovercard.com\giveaway. I told her she meant slash, not backslash. She assured me it was a backslash. So now we get to the whatever part of this posting. Discover.com is smart enough to replace backslashes in the path with slashes, so even if the operator gets it backwards, the customer gets to see the marketing materials.

OpenOffice: Disabling Useless Annoying Popups

OpenOffice has this annoying feature that when the mouse pointer is over a table or a list a popup pops up to obscure what you're working on. Today I had two documents open in side-by-side windows and the table popup obscured the other window. Popups are easy to disable in web browsers, so why not in office tools?

How to: whenever one of these popups appears, look at View|Toolbars and uncheck the offending tool bar.

USB Thumb Drive Energy Use

This morning, just before removing an old Imation 64MB thumb drive (the expendable one I take with me to class) I checked the run time left on my netbook's battery: 5:57. Then after removing the flash drive, on a whim, I checked the charge remaining: 6 hours even. So apparently the power taken by the device is small but nonzero. Off and on I've been a little curious about this because sometimes when I remove a thumb drive, the drive is very warm.

So, how much energy do thumb drives use? The Kingston web site and Amazon offer no help, but there is a paper that is very informative, "Power and Performance Characteristics of USB Flash Drives," Kyle O’Brien, David C. Salyers, Aaron D. Striegel, Christian Poellabauer, Department of Computer Science and Engineering, Notre Dame, IN 46556 USA. this apparently appeared in the 2008 International Symposium on a World of Wireless, Mobile and Multimedia Networks, which is an IEEE venue. The paper is available from CiteSeer.

It makes sense that wireless folks would be interested in power consumption since so many wireless devices are battery-powered.

They looked at USB 1.1 and 2.0 devices from a variety of manufacturers and of a variety of sizes up to 4 GB. 4 GB is small now, but this was a few years ago.

USB 2.0 energy consumption was very interesting, with the idle consumption being over twice that of the USB 1.1 device (for a Patriot 4 GB device). If thumb drives are idle most of the time, then one can suppose that the USB 2.0 devices take twice as much power overall as compared to USB 1.1. The differences were approximately 22.4 mA for an idle USB 1.1 device as opposed to approximately 50.9 mA for a USB 2.0 device. The disparity between current required while writing was larger, almost 3:1, at 34 mA vs. 105 mA. Presumably the USB 2.0 device is writing faster so it may spend less time writing.

For a USB 1.1 Kingston 4 GB idle power was around 23 mA and power writing or reading was around 34 mA.

One can multiply all the mA numbers above by 5V to get mW, so even idle a thumb drive consumes a significant fraction of a watt. As a fraction of the power used by a typical PC, this is small, as one would expect.

A group in Vasser's Physics Department also studied this issue, with interesting results. They are not very specific about what hardware they are testing, though do note that they see little difference between different flash memories. Rather than measuring the amperage used by the flash drive itself, they measure the wattage used by the laptop to which the flash drive is attached.

It appears their laptop consumes about 11.7 W solo, or 13.4 W with a 4 GB flash drive plugged in, which seems low. I wonder if they were measuring the current from the wall socket or the current coming out of the power brick, which would be lower, or something else, like maybe power from the battery. I believe this is what they referred to as "the laptop at rest."

Though the power requirements for their laptop seem low, the extra power required by the thumb drive seems high. An extra 1.7 W? Are we to believe that the thumb drive tested burned 340 mW, which is much higher than the measurements provided by O'Brien, et al. One possible difference is the USB interface within the laptop. Perhaps the internal USB hub is in a low power state when nothing is plugged in.

Interestingly, as the thumb drive is unmounted, the power usage rises to around 20 W. The thumb drive will require additional power when write buffers are being flushed to it. Also, this would require the UI to be active (probably no screen dimming) and might bring the CPU briefly to full speed. I would be interested in the difference seen when ejecting a thumb drive if the CPU is already performing a compute-bound task.

Unsurprisingly, it took an extra fraction of a watt to play a file from hard drive as opposed to from their 4 GB flash drive. The flash drive has no moving parts. However, it's not clear whether the flash drive is plugged in when playing from disk.

Something else to look into: power consumption by SDHC cards as used in digital cameras. Battery life is important for digital cameras.

One caution: the numbers above all appear to be from a small sample of USB drives, which may or may not be representative.

I Applaud UPS

Here's a tracking summary from UPS:

My respect for UPS is increased, not because of the Incorrect routing at UPS facility, but because they openly admit it.

Gnome 2.32.1 Missing Scrollbars

Gnome 2.32.1, as delivered in Ubuntu 11.04, is missing full scrollbar functionality in some applications.  Instead of a scrollbar, on the right edge of the window is a small target that, when the mouse is over it, creates a dragging tool for scrolling up and down. This is okay so far as it goes, and does save some screen real estate, which is great. However, the ability to click within the scrollbar to move up or down a screenfull is gone.

I see nothing in the options to return full scrollbar functionality, and it is vexing that many applications do have regular scrollbars, and some, or at least Nautilus 2.32.2.1, do not. So how do we fix it. There was a brief discussion at superuser.com in which one person totally missed the point regarding why this is a problem and a couple suggestions were given, neither of which seemed complete. This is how I restored scrollbar functionality, based on the guidance at superuser:


        sudo apt-get remove overlay-scrollbar
        sudo apt-get autoremove --purge liboverlay-scrollbar-*
        sudo su
        echo "export LIBOVERLAY_SCROLLBAR=0" > /etc/X11/Xsession.d/80overlayscrollbars

People trying to do this will likely want to escape the asterisk in the second line. It is not clear to me whether one really needs the first line given the second, but this worked.

My remaining question is why would the Gnome team reduce the scrollbar functionality without providing users with a clear-cut way to revert to full scrollbar functionality? If some prefer this behavior, which seems reasonable, then there should be an option somewhere within Gnome or within individual applications.

I've Found Religion: Google Voice!

I take Spanish and occasionally other stuff at the local community college and have signed up for their alert system. I get the alerts in e-mail and to  my cell phone, which turns out to be inconvenient since, for example, this morning they called at 5:45 (this is voice, not text). By changing the number they have for me from my cell to my Google Voice number I am easily able to tell GVoice to send anything from their number directly to voice mail.  It worked this afternoon:

Ain't technology grand? As usual the audio is easier to decipher than the text, but they don't do that bad with the text: "done dot" is Dundalk, "s 6" is Essex, and "K this bill" is Catonsville.

Pointy-Headed Boss Loses Again!

I just saw a LinkedIn update where a boss and a worker disagreed on the utility of LinkedIn. The boss said he would give the employee $1 for each "like" he received. Here's the current tally:

So the boss owes over $16k and counting. I'm not sure what the number of "likes" has to do with the utility of LinkedIn, but it was amusing enough to click "like." I wonder how much Ben Lugavere will end up collecting.

Mild Surprise: Deleted Picasa Photos Show up in Google Docs Trash

I was looking at my Google Docs trash and noticed a number of images. They appear to be images deleted from Picasa. Picasa's delete dialog still uses the term 'delete' rather than 'trash', but it no longer warns that the action is irreversible.

Chrome: Blocking HTML Referer [sic]

It's easy to block HTML referrers in  Firefox: visit about:config and set network.http.sendRefererHeader to zero.

It's easy to block referrers in Opera: Make sure "Send Referrer Information" is unchecked at Opera | Settings | Quick Preferences

So how about Chrome? The man page is incomplete, not saying how to do this.

Googling sent me to a a Chrome extension. I have no reason to trust the author of that extension, so I looked a little more.

The answer is, surprise, in the Chrome help forum,  http://www.google.com/support/forum/p/Chrome/thread?tid=63a866565ba8664f&hl=en

The thing is, I don't usually start Chrome from the command line, and I don't recommend doing so. If Chrome (or Firefox, or Evince, etc.) are given a command shell, they dump gobs of junk to, probably, stderr. So it's necessary to change the shortcut from which Chrome starts. Gnome instructions follow; Windows instructions, untested, are here. [ Note added 2012-09-10: I think the following is incorrect and that Firefox does require an extension to block referers. Bad Firefox, bad. Original text: I do not endorse their method of blocking referrers in Firefox, as it is simply not necessary to install an extension to do this. ]

In System | Preferences | Main Menu | Internet (your system may vary) right-click on Google Chrome. Add --no-referrers to the end of the command line. Kill Chrome. Restart Chrome through the updated shortcut.

On referrers: this is from a time when the Internet was a less dangerous place. I have trouble seeing how this was ever a good idea, but now it is simply an invasion of privacy. It isn't likely that any subsequent version of HTML will drop this, but it would be nice if browsers would default to not sending referrer information.

A note on the misspelling 'referer': the word was misspelled in RFC 1945 (!996 Berners-Lee, Fielding, Frystyk), which is a bit odd since they spelled 'referred' correctly. Wikipedia says the misspelling originated in a different document, by a different author. Fielding says that neither 'referer' nor 'referrer' were in the UNIX spell program at the time. I thought by 1990 everyone was using ispell or aspell; okay I never actually thought that. Paper dictionaries weren't available at the time? I'm just happy to not have my name as prominently associated with a dumb little mistake like this. Of course, it is just a dumb little mistake.

Considering Dropping My ACM Membership

Over the past few weeks I have occasionally pondered whether I should let my ACM membership expire this fall. I would continue my IEEE-CS and CCSC memberships. I really like ACM Computing Surveys, but IEEE Computer is consistently more interesting than CACM, and by a wide margin. I was reminded of this today walking through the CS department and stumbling across the 3/1976 issue of the CACM on a table. Here is the beginning of the table of contents from that issue:

Yes, kiddies, once upon a time CACM published real research. Now it's mostly fluff, mostly not from CS departments. This change occurred around 1990 or thereabouts. At the time I had a brief dialog with Stu Zweben about this, and he said the change in focus from CS was in order to appeal to a wider audience. Stu was faculty at Ohio State, where I was a grad student, and soon thereafter he became ACM president. Around the same time a letter to the CACM forum  referred to the CACM as having become P.A.M., pabulum for all members. IMHO pabulum is a reasonable description, and a sticking point is that CACM is still required for ACM membership.

With the decline of the CACM, the ACM gradually ceased to provide a general overview of computing research. Fortunately, IEEE Computer continues to fill that niche. So I maintain my ACM membership to receive Computing Reviews and out of a likely outdated notion that a computer scientist should belong to the ACM. UMBC does not reimburse me for the membership, but it is tax deductible, and there is a sister-society discount for belonging to both the ACM and the IEEE-CS. Still I do not get much for my membership dollar from the ACM.

I will have to verify that it is still not possible to belong to the ACM and yet not receive CACM, and also to see if I can get Computing Surveys at a reasonable price (or electronically gratis as UMBC faculty) before making my final decision.