If you have an amex online account they limit your password to 8 characters and you can only use numbers and letters. That’s not very secure (I could write a program to guess every password in those restraints in a matter of minutes.). So someone complained. (Note: I’ve complained by phone myself and got no response.)

I wish that I could use a stronger password for this site. 8 characters are NOT enough.
Response (Gaurav Sharma) 02/06/2010 05:53 AM

And the response.

Thank you for your email regarding your online password.

I would like to inform you that our website has a 128 bit encryption. With this base, passwords that comprise only of letters and alphabets create an algorithm that is difficult to crack. We discourage the use of special characters because hacking softwares can recognize them very easily.

The length of the password is limited to 8 characters to reduce keyboard contact. Some softwares can decipher a password based on the information of “most common keys pressed”.

Therefore, lesser keys punched in a given frame of time lessen the possibility of the password being cracked.

Moreover, American Express is committed to protecting the privacy and security of all of our Cardmembers, both on-line and off-line. We believe that our current security measures, which include our sophisticated monitoring systems to detect unusual or fraudulent card activity, provide strong, ongoing protections for our Cardmembers.

Rest assured, I have forwarded your comments to our webmaster for review. During this review, we may contact you if additional information is required.

We value your membership and wish goodness and health to you and your family.
Sincerely,
Gaurav Sharma
Email Servicing Team
American Express Interactive Services

Eight characters makes a pretty weak password. The rationalization is twofold. First, when looking though a keylogger's output the password will be hard to identify, and if it was really long and random it would be easy to pick out. (Think the output of virus that is reporting back thousands of people's keystrokes.)

Secondly when a password is stolen or guessed that they can detect the fraud with their "special sauce" monitoring and take care of things after the fact.

I'll assume that the credit card companies want to protect themselves from losses of which fraudulent charges are a large part. I can attest to credit card companies alerting me my number was stolen way before I noticed it. (It's happened a couple times, I even had my card copied by a cashier once.) So I figure they must have run tests and figured out this was the best way to protect their money.

The problem is I think they're wrong and the limitation is part of a hold over from old computer systems. They wouldn't lie would they?

When I think of the Kindle, I think of an awesome device (the big one is wonderful to use) with a free data connection that needs to be hacked to be useful. Hacked to remove the ability to remove books. Hacked to allow browsing of the web. Hacked to allow my own content to be freely placed on the device. The hacking negates the free data plan because the device no longer functions along Amazon’s business model, but it’s your device – so you can use it how you like. You should be able to get your own data plan. ($20/month)

I don’t see why “E-Readers” would have to remove community behind books and libraries. I can argue that “social networks” could work around the devices and books. Especially around trading books – I’ll get into the legality of that–how authors could still get paid and the usefulness and harmfulness of DRM Encryption in that situation–some other time.

I can also argue that libraries are a place for more then retrieving books. You have librarians who are paid experts and curators of knowledge. A Kindle may have a library of books, but it doesn’t have librarians. On a side note, they don’t have quiet work areas or comfy chairs either.

But even though I have a library down the block from my house, I haven’t had the need to be in one for a long while. I have my own comfy chair, and don’t read books that often.

One thing the Kindle does facilitate that a library can’t is that I could write a book and publish it on the Kindle for free, and distribute it worldwide without cost and with an excellent margin. Sites like Lulu allow me to make print copies, but their costs are non-trivial (good rates, but not cheap). That kind of freedom is liberating. I wont argue that publishing companies are worthless, as they are not, but they’ve had a monopoly on publishing for a long time. Devices like the Kindle allowing for self-publishing make me very happy.

In my head, preferring a paper book over a kindle is akin to preferring a small black and white TV over a larger color one. I don’t see the technology being the problem; it’s a tool like any other, and it can be just as enabling for you and me as it can for companies like Amazon and BookSwim.

Comments?

Yesterday we reported that a provision in the revamped French “3 strikes” bill will allow for the punishment of ISP account holders for the copyright infringing actions of others. Now a group of hackers has set out to compromise WiFi routers en masse, in order to create an environment of plausible deniability.

I very much like this idea. It goes to show they're missing the point. They can't stop people from downloading movies and in trying to they're creating toothless laws, who will disproportionately hurt a small segment of offenders and be ineffective at stopping the behavior.

It's similar to clients asking me to lock down their computers so their kids can't get to porno websites or so they can limit their Facebook usage. I can do it, and have, but I tell them the kids will find a way around it, it's much better handled though social rather then technological methods. Educating the kids about the net is a far better method for keeping them honest, but happens to be a tall order when their parents often don't quite understand it themselves.

Recently I've found a rather effective web monitoring method that instead of blocking sites it just reports to the user how much time they spend on the site. It's meant for offices and is called webspy, and works on the theory that people don't want to spend all day at work browsing the web, they want to be "good" but just need to be kept in check. It follows the principal that when you know people are watching you'll do a better job.

I'm not going to touch on the internet piracy 3 strike laws, but I'm glad in France they're making sure a judge makes the decision to cut someone off the net and not the accuser. The overhead in that is so immense it probably wont happen. Who wants to jail their own community anyway? If everyone's committing the crime is it a crime? If it's "considered harmful" like crystal meth for example, what do you do then?

There's a big meth problem in a lot of towns and cities in the united states, I'm wondering if "Jail" is the answer. If you have a large community doing something harmful to itself, (that may actually be a crime as well) how do you recover from that? Obviously there needs to be a group effort, and some level of amnesty. I'm curious what kind of effort would be effective.

Going back to something a lot less "harmful", what about file sharing and copyright infringement? I don't consider it to be harmful to society, people are making other business models work in regards to music and movies, and there's a lot of room for growth and discovery in those directions. But lets for the sake of argument say that our current/old business models were the only ones that could work and if we want art we need to stop infringing on copyrights so artists can afford to be artists. Do we jail all offenders? Do we punish them and keep them from being able to communicate with society? Or do we find a way to convince our consitiutents that they need to come together to fix the problem?

I say constituents because it's our elected officials that pass these laws to police how we act. These are questions they should be asking, and that we should be making them ask.

And with that I'm lost in my own rant, so I'm done. Feels good to write even if it is dribble.

Method and means for creating anti-gravity illusion

No wires just shoes.

It's fascinating to watch these videos, but boy is he ever weird.

He strives to be a model for a way to have an industry that doesn't strip the earth of its resources but keeps control of the entire cycle of it's goods and byproducts. Of course he does a much better job explaining it. My favorite axiom from the speech is a simple one.

If it exists then it is possible.

Download mp4 in Standard Def (54MB) or HD 480p (195MB)

https://www124.americanexpress.com/cards/loyalty.do?page=expresspay

http://www.engadget.com/2008/03/19/rfid-credit-cards-easily-hacked-with-8-reader/

http://www.difrwear.com/

I own a dirfwear wallet, and while it isn't perfect at blocking rfid tags at close range (3–4 inches) its a dam good walet and will stop distance and opportunistic sniffing. Like near a turnstyle or door frame. I met one of the creators at the last hope and played with a machine he had there setup for reading rfid cards at a distance.

Nice right? Let me put it in perspective. The 700 meg file I can now download in a minute and a half, and when we move to the new hardware it could take 56 seconds. Saving me 59 minutes compared to the origional connection. In actuality we'll probably never hit full speed as most servers wont pump data at 100Mbit/s nor can you guarentee that you'll get routed though the net that fast. There's a noticable speed difference when I pull from california servers compared to new york servers compared to european servers.

My mind is blown. =)

–Francis

PS For the record DNS Made Easy is a good service I just don't need it.

I present to you for your viewing pleasure, my slider test! I couldn't help but use some of Sara's throwie pictures.

And let me tout the video anyway.

It went over well. (Photo Credit Jeanette Hayes)

Now two years later I'm faced with my approaching 25th birthday. This year I'd like to do "throwies year two". My only problem is that this year I don't have the funds to buy throwies for everybody again. So after talking it over with my friends and going over what it takes to get the parts for hundreds of throwies, I've decided to put throwies up for sale at cost. I'm still looking at suppliers but it seems that I should be able to get you about 25 throwies for $20. I'll know exactly how many after I see how many people get involved (you save in bulk of course).

My party this year will be on Friday the 20th and will have a $20 dollar cover which will include around 25 throwies. I'll order some pizza and soda. We'll meet at my place at 6:30pm to eat and build the throwies and then around 8pm leave for the east village tagging the city as go. Later in the night we will be stopping at a to be determined location to warm up and get something tasty. If you were there last time you might find this familiar.

So either pay me in person (please let me know if there's a problem before the party!) or just use the paypal form below.

Packs of throwies

~13 Throwies (econ pack - you'll want more!) $10.00

~25 Throwies $20.00

~40 Throwies $32.00

~50 Throwies (and godlike status among men) $40.00

This site demonstrates a point that I was talking about the other day. There is a lot fewer people in the "Bread Basket" then there are along the coasts (Including the Gulf of Mexico). I was relating the age of the civilization in the area of the country to it's tolerance for cultures and it's diversity. Notice I said relating, not correlating. I don't have any data for this theory yet, just some poor observations.

Election results by county.

Election results by country as an area cartogram based off of population of counties.

Cartograms are wonderfully powerful at conveying data (maybe not as wonderful at representing data). You should take a look at a few samples of them before you move on.

–Francis

So what's in my non roborooter history?

I had quite a few Windows XP instalations to do, with new employees soon to arrive at work, new laptops arriving with Vista, and some old desktops that needed 'decrufting' in their OSes. I have a slipstreamed windows xp cd with sp2 that I like to use. I haven't bothered updating it to sp3 because I haven't made the time and for a while I didn't think it was worth it. SP3 seems more for microsoft then it does for the users. I do have a new xp disk with ie7 and a few other updates, but I haven't tested it so much. So I tried it out and it seemed ok but I hit a problem.

Windows Update would fail to install every single update after sp3 was installed.

And once you hit Microsoft Update (which you should) it would fail to install the office updates too. No error codes, no event log messages (well maybe but I didn't look too closely) nothing useful. I figured it was my new disk so despite spending all the time reinstalling windows (my disk does make it easier, setup the partitions and walk away for 20 minutes and you have windows waiting for you when you get back) I tried with my older trusted disk. Same problems.

It took me a while to figure out it was sp3.

Well I have a fix. Run these commands.

::http://support.microsoft.com/kb/943144 for details use on 32bit winxp only
net stop wuauserv
regsvr32 %windir%\system32\wups2.dll
net start wuauserv

Put that in a batch file or just run it and it will re-register the new sp3 windows update dll file and all your problems will go away. So in an effort to take pride in my work I decided to fix it twice. Once for the problem and again for the cause of the problem. According to the knowledge base article I found to fix it, if you update windows update (which is common after a reinstall) and don't restart before installing sp3 then sp3 will ignore the updated windows update and there will be a version missmatch when you try to update. So restart early and often when installing updates. I haven't tested it but in the back of my head there's a voice saing "I think other updates might cause this problem too!" so maybe even something other then sp3 can cause this, but I don't feel like collecting proof.

That would involve "fixing it" 3 times and twice is enough for me today.

–Francis

UPDATE: So far this has only applied to new installs for me, but if you're worried you wont hurt anything by running those commands.

https://www.wizardcomputing.com/gpg/wizard-roborooter.com.asc

I've had a few others for my roborooter.com address over the years, but somehow I always loose them. The private key that is. It's usually because I don't use them that much. There are only a handful of people out there I communicate with that know what gpg is, know how to use it, want to use it, and most importantly need to use it. That's actually a tall order to fill.

So what happens to my keys that I loose? Well lets look for the public counterparts.

MIT PGP Public Key Server Search Results for wizard-roborooter.com

Public Key Server -- Index wizard at roborooter.com

Type bits /keyID Date User ID
pub 1024D/C556B1A8 2008/09/02 Francis Gulotta
pub 1024D/2B74810B 2005/01/27 Francis Gulotta
pub 1024D/C6677DA7 2002/01/08 Francis Gulotta

The first one I ever published was back in 2002 (Unless I submitted one earlier elsewhere, damed if I know — but a blog search tells me no different — I need a better search). And if I had the tools with me today I could tell you when it expires if at all. I was probably brash and didn't think I'd ever loose the private key. It's not that hard to make a new key so once a year if I'm going to use it, I can. I can even sign it with my old key (if I still have it) to keep the chain of trust.

–Francis

PS Looks like I've discovered a bug in how wordpress automatically makes email addresses hyper links

When I try to get into the office its a RFID swipe card that beeps me in. The server room has a regular key. My laptop has a long password and keeps all my files (not my music) encrypted when its off, my desktop has nothing, no private data, just some games and movies, so no password. It doesn't even stay logged into my email.

During my day I type probably 5–10 different passwords a combined total of a few hundred times. Maybe not that much. I've started using SuperGenPass for websites so even though its one password to me, its a different password for each website. Which is very very good. I do a similar thing with my shell and ftp accounts (of which there are many) I generate a random password (often using this handy site) and save it to my OSX keychain. I still use a text file for passwords sometimes and even though its locked behind filevault (the encryption on my laptop) it still leaves a sour taste in my mouth.

My mail has a long, annoying and different password then everything else. I change it from time to time too, its annoying. But since almost everything else I use a password for will use my email to verify me its important. I've known that for a long time, I've only stopped using my 'legacy' default password for everything (which has grown in length over time but still plastered on any site that would have it) about 2 or 3 months ago. It was a sad and sorry state of things, but I changed it before it bit me in the ass.

I do use openID (check the source of roborooter's home page and you can see my provider information) which let's me log into any site using only my url and let me log into only my provider for the password. (So I don't have to trust or use a different password for every other site.) So far I use it for only a few things, but more all the time. Stackoverflow, livejournal, sourceforge, roborooter.com itself, and a hodgepodge of other sites I can't remember. I could actually check and remove access to my openID for some of those sites if I cared to.

This is my context when I walked up to the turnstile this afternoon and pulled out my keys. Or yesterday when I walked into the turnstile's bar and smashed it against my groin with a loud thump. I had already logged into my network account, why did I need to log into the subway again? For most people a metrocard is money, I pay a lot for (and use it plenty) a monthly card. I have unlimited rides, not a dollar amount on a card. For me my metrocard is just another form of authentication. "Hi, It's me let me in, I'm good for this month. What? Oh OK I'll log in again."

–Francis

(Now with better spellings, more links, and a recovery from DreamHost's databases reverting.. even with review, writing a post on my blackberry has it's disadvantages.)

Me and Miracle Berry Tablets

Miracle fruit or berries makes sour things taste sweet. An effect that apparently is quite amazing.

From the supplier's website.
The active ingredient in the Miracle Berry Fruit, known as Miraclulin coats the tongue and blocks out the taste bud receptors which are responsible for sour, bitter and acidic flavours. The outcome is that all foods which taste sour, bitter or acidic miraculously come to taste sweet.

Once I was told you could solve the problem with transporting "Miracle" berries by freeze drying them (they spoil quickly) and that you could buy said berries online for $20 dollars, I immediately bought them.

It comes with 10 pills each formerly being 3 berries. Think geek says you should cut them in half for twenty servings. The official supplier claims that even fresh berries start loosing their effects due to age and that problem doesn't exist after it's been freeze dried.

I'm going to have to try it to find out =)

–Francis

If only I had the cash to burn…

This would have been the best website ever. But some squatter will pick it up no doubt.

To aid in my tagging I got a wordpress plugin called Simple Tags which lets me see all my previous used tags when choosing tags for a new post. (Which is genuinely useful!) It's also got a bunch of things I don't want or need. Like auto tagging, and suggesting tags. I thought I'd play with them though.

The suggested tags for my post on the Quick and the Dead were: Movies, gene hackman, story overview, life of crime, assassins, ill gotten gains, entertainment industry, and typos.

Fuck you yahoo!

Until it broke, and you had to hit the + to get a photo at all.

It was shitty hack. Code that was never planed.  I killed it this morning. I'm backing it up but.. you don't want to see its code. It was a mercy kill. It will be tough but.. the 16 people who were using it will have to move on.

I like to think that in a world of fb apps that include inviting friends to be zombies or go out on hot virtual dates with bumper stickers and snowball fights, my app was a little bit of hope. Hope for functionality without advertising or annoyance. Too bad it was broken.

I will miss you "Random Profile Image" but honestly.. not that much.

–Francis

_{If you really do want to see it's code let me know.}

Update: I had over 3.2k photos logged (I don't have the photos, I just knew about them so I could pick a random one.) that's an amazing amazing amount of photography to share.

And I'm even invited to a dinner tomorrow night, chemists make wonderful chefs.

–Francis

PS Oh and you better belive I've got a backlog of stuff to share.

Longest I've gotten on this laptop so far I think.

–Francis