Cyde Weys Musings

It’s July 4, which means holiday! (Well, not in Britain; they’re still kind of resentful over the whole thing.) So I will be celebrating by going to the beach, where there will be no computers. See y’all again on Monday.

If you can’t think of anything to do over this holiday weekend, go to a local lake and just relax by its shore. You’ll enjoy it, and I guarantee it’s a good suggestion, because far too many people go to lakes far too rarely.

Don’t mind me; I’m just trying out the Syntax Highlighter WordPress Plugin. It’s pretty awesome, huh?

public void HelloWorld() {
	String txt = "Hello, World!";
	System.out.println(txt);
	return;
}

Ever since I upgraded to WordPress 2.5, I’ve been unable to successfully load images. The Upload Image page would come up just fine, I would select the image file, the progress bar would advance all the way to the finish, then I’d get kicked out to a WordPress login screen, with the image not having made it. I didn’t have the time to fix it for awhile, so I simply uploaded images to my webhost using SCP and linked to them manually, but that was a huge drain of time. So I finally sat down to fix it once and for all.

I tried all of the official WordPress fixes, to no avail. There’s something up with my shared hosting provider’s (HostMonster’s) configuration that doesn’t respond to any of the standard fixes. So I finally gave up and installed the No Flash Uploader plugin. It does exactly what it says: revert to the pre-Flash uploader days of WordPress 2.3. You may not get all of the “latest and greatest” features of the WordPress 2.5 uploader, but then again, I’d say an uploader that actually works is far superior than one that doesn’t.

So if you’re experiencing image uploading problems in WordPress 2.5, try out this plugin before you give up all hope. It’s just like uploading images in WordPress 2.3, which wasn’t bad at all. This whole Flash uploader mess — is Flash really even necessary, considering it’s not well supported on GNU/Linux? — along with the lack of password salting security hole pre-2.5 has really shaken my confidence in the WordPress developers. I’ll take basic functionality over flashy functionality any day of the week. And I wish they had followed this mantra a little more closely, as a simple Google search will reveal that I’m far from the only person having problems with WordPress 2.5.

I’m just about ready to end my former blog, Supreme Commander Talk. It focused exclusively on the PC game Supreme Commander (don’t get bent out of shape if you have never heard of it; the game didn’t become nearly as popular as we had hoped it would). I stopped updating the blog about a year ago when I stopped playing the game. Since then, I managed to get a few other players in for short writing stints, but none of them stayed very long, and the blog has now lapsed after several months of inactivity. And given the game’s gradual loss of popularity since its release, even largely unstemmed by the release of its expansion pack, I think it’s about time to end the blog.

But ending a blog is hard. I, along with my friend Grokmoo, put a lot of effort into that blog. We were writing substantive entries in it every day. I would find myself playing multiplayer games just for the sake of having something to write about. I checked the forums and the other fansites constantly, so that even if I missed being the first to report to report on something, I would still be far from the last. It was damn fun, and it’s a real rush to grow a community around you. Oh yes, the relative “fame” was addictive. At its peak, SupComTalk was getting thrice as many daily visits as this blog currently gets. And on the aggregate, I’ve put a lot more time into this blog as well.

Ending a blog is hard, but sometimes, necessary. I don’t want to leave those loose ends hanging around perpetually, and getting overrun with spam is always a problem on a comment-enabled site that is no longer actively moderated. Of course, I’m not simply going to take the blog offline; that would be a terrible fate for something we spent so much time on (and I do despise linkrot). The simplest amenable way to end it would be to turn off commenting across the whole site, effectively rendering it static. There must be a WordPress plugin out there somewhere to mothball a blog. I’ll have to put up one final, melancholic post, allow a few final days for comments on it, and then lock it all down permanently. “This is the blog that was.”

I will miss SupComTalk a lot; don’t think this will be easy for me. I really enjoyed the experience, and I would love to do it again with some other game. Writing that blog was the closest taste of Internet fame I’ve ever had (admittedly, just a taste; not even close to a mouthful). And there was a lesson there that I quickly learned, yet have still failed to follow: single-topic blogs that focus on specific subjects are, on the average, far more successful than personal blogs that focus on whatever smattering of topics the writer happens to be interested in. Some day yet I might finally apply that knowledge to this blog — or perhaps create a new one. I’m still thinking about it. But as I draw close to finally pulling the plug on SupComTalk, it weighs heavier and heavier still on my mind.

As the more astute readers may have noticed, I’ve increasingly been having spam problems on this site. More and more garbage comments and pingbacks were getting through my spam filter, Spam Karma. Unfortunately, the sole developer of that WordPress plugin stopped working on it more than a year ago, while the spammers haven’t stopped improving their techniques. So I’m switching over to Akismet, WordPress’s own anti-spam plugin, which is still actively supported. I’ll report on how well it’s doing after I’ve seen it in use for a couple weeks, but after one day of usage, I can at least guarantee that it doesn’t totally suck, as it’s stopped dozens of spam comments without letting a single one through.

Those of you who aren’t bloggers, consider yourselves lucky that you don’t have to deal with the messy issue of blog spam. I’ve found it to be a lot worse than tackling email spam. For starters, I get a lot more of it, and I also have to deal with it, as any spam that gets through makes your site look really trashy and could potentially damage your search engine rankings (Google punishes sites that link to spammy havens of the Internet). When you get a spam email, you can just ignore it and nothing bad happens; when you get a spam comment on your blog, you have to delete it, and that’s a fair bit more effort.

In my time off from fighting against spam, I amuse myself by thinking of all sorts of creative punishments for blog spammers. For instance, I’m a fan of Medieval-style hanging, drawing, and quartering, but that doesn’t quite satisfy me. I’d prefer hanged, drawn, and fractally quartered. Cut into four pieces, then cut each remaining piece into four pieces, ad infinitum …

That’s an appropriate punishment for spammers, and it satisfies my fascination with mathematics to boot.

So I bungled the WordPress upgrade to 2.5.1 badly (let’s just say it’s not good that WordPress names all of its downloads latest.zip). I’ve attempted to redo the WordPress 2.5.1 upgrade repeatedly, restoring from a site backup multiple times and even restoring from a database backup once (sorry if I lost any comments, though I don’t think I did), to no avail. So I’m temporarily giving up while the site still appears to be in working order.

If you notice anything wrong on the site, please tell me! My contact information is on the About page, or, assuming comments are still working (:-P), you can leave one below.

I’m traveling up to Massachusetts tomorrow for a week for my job. I don’t know the status of Internet access in the hotel I’ll be staying in. I suspect it might be costly, in which case I’ll just refuse to pay. So you probably won’t see me writing anything for this blog until Friday at the earliest.

But that’s okay. In anticipation of not having Internet access for the duration, I’ve written and queued up a few blog posts to appear while I’m away. Just don’t expect any coverage of breaking news or timely responses to your comments. If this starts becoming a regular occurrence it may get to be a bit tiresome, because writing lots of blog posts in one day is kind of exhausting.

One thing I’ve come to learn over the years that I’ve been writing is that the more passionate you are about a subject, the easier it is to write about it. Ditto for being more knowledgeable about a subject (but that is perhaps trivial). My favorite posts are those about the subjects I am most passionate about. And not only is the resultant work better, but it takes less time to write as well. I’ve spent hours laboring over works that didn’t turn out very satisfyingly, whereas for other works I sat down, wrote at a break-neck speed, and within ten minutes had something I was really proud of.

For instance, look at the post I wrote the recent death of my great-aunt Muriel. It was an obituary of sorts, covering salient points of her life, explaining why the unknowledgeable reader should care that she died. It also expressed my innermost feelings on expected deaths. I think it came out really well, and I can tell it resonated with others by the comments that were left. Yet it was incredibly easy to write, probably taking a total of less than half an hour (and it was written within a few hours of hearing of her death). I didn’t even have the time to go research how old she was, leaving a perhaps too gruff proclamation to set the tone at the beginning of the post, but I shan’t go back and edit it. That post is from-the-heart, brutally honest, and essentially unedited, yet since it was something I felt passionate about, it just flowed from my mind, through my fingers and the keyboard, and onto the screen. I swear the number of typos I was making was lower than average, even though the typing speed was higher.

My first column for University of Maryland’s student newspaper The Diamondback was on a topic I am very passionate about, evolution. I’m very happy with the way that one turned out. It did take awhile to write, but only because I was completely unfamiliar with writing for the newspaper business. My later columns on similar subject matters were dashed off very quickly, yet with good results, because I am passionate about and intimately familiar with the material.

Now compare that to my column on bike theft on campus, which, frankly, was a waste of newspaper space. Being a columnist for the Diamondback was kind of limiting. We had to write about topics relevant to students and the school, and even though my column was only published twice a month, I couldn’t always find anything interesting to me to write about. Hence the column about bike theft. I’ll be honest: I don’t give a damn about bike theft. I don’t own a bike, it’s a boring topic, and nobody really cares. Yet it took me longer to write that column (over three hours, I think) than any other one I ever wrote. Why? Because I was reaching so hard just to find something to say about it. The thrust of the column boils down to one sentence: “Bike theft is bad and security measures on campus should be better,” gaining nothing in the expansion to a whopping full page of newspaper column. Yet I couldn’t come close to distilling my blog post about my great-aunt down into a smaller number of words without vastly affecting its quality.

Read the rest of this entry »

One of the problems I frequently have when writing (for this blog or otherwise) is my wish to convey perhaps too much information. Sometimes interesting tidbits don’t really fit in with the flow of my writing, so I add them as parenthetical asides (like this right here). In many circumstances, I guess it’s just me being lazy and avoiding somewhat extensive rewriting to get everything to fit together just so. Other times, there really is no other way to do it. Or is there?

Are footnotes the correct way to do it? Justine Larbalestier seems to think so. Just look at her recent blog post on her travels in Italy. She’s using footnotes for all of the asides that I would be using parenthetical phrases for. Does it work?

I’m not sure it does (and here’s where I contradict the title of my blog post). Writing is very much a linear medium. I don’t like jumping around to and fro between the main body of a work and appendices. I just want to go from start to finish and be done with it. So I don’t click on footnotes because they interrupt the flow of my reading, whereas I do read all parenthetical asides because they are embedded in the text. Sometimes I try reading all the footnotes after finishing up the main text, but then they often don’t make much sense out of context, and I’m too lazy to go back up and figure out what they refer to. Long story short, I don’t bother reading footnotes anymore.

Just as an aside (the non-parenthetical variety, thankfully), is there anyone out there who actually skips parenthetical asides? I know parentheses theoretically mean “optional”, but all they really mean to me is “this content could be excised without affecting the flow of the rest of the sentence, but you know you’re going to read it anyway”. Literature would be so much duller without all of those intriguing tidbits enclosed between those lovely curvy punctuation marks; how could anyone possibly skip them? (Or is there anyone who only reads the parenthetical asides and nothing else? Try it!)

WordPress 2.5 is out today and it looks mighty impressive. I’m going to wait a few days for reports of compatibility with the plugins I’m using before I upgrade, but after that, expect to see WordPress 2.5 on this blog soon.

Looking through the changes list, I did notice one odd thing. WordPress 2.5 finally adds salt to stored password hashes. It’s nearly inconceivable to me that WordPress went so long without salted passwords — it’s an incredibly important security technique that essentially has zero implementation cost. When I was helping to design the software infrastructure that powers Veropedia, I made sure that password hash salting was in our alpha. And yet it takes the fine folks over at WordPress until version 2.5 to implement it? Did they not realize how important it is to security?

Here’s why password salting is so important. The naive algorithm for storing login passwords in a database is to store them as plaintext. User tries to login, the inputted password is matched against the password field under their username in the database, and if it matches, the login is successful. The reason this is terrible security practice is because if the database is compromised (which is surprisingly easy to accomplish even remotely using SQL injection) the entire list of passwords can be revealed, compromising the entire site and everyone who is registered to use it.

So the next step in the evolution of login security (and this happened decades ago) was to use a one-way function called a hash function to store the password in the database. I won’t go into the details of how a hash function works, but the key point to know is that it is one way: given an input, you can quickly calculate the output, but given the output, you cannot calculate what the input was. So, now password hashes are stored in the database instead of the raw password, and when a user goes to log in, their input is hashed and compared against the value in the database. This is what WordPress used up until version 2.5.

There’s just one major flaw with this seemingly secure system. There are only a few widely-used hash algorithms, and they all necessarily run quickly on small inputs, so it’s trivial to pre-compute a huge list of potential passwords and their associated hash values. This is called a rainbow table, and larger rainbow tables have trillions of entries in them, pretty much guaranteeing a successful attack against less secure passwords (short ones, ones that don’t use numbers and punctuation, etc.). So we’re pretty much back to square one: database is compromised, the hashed passwords are compared with the rainbow table nearly instantaneously, and lots of accounts can be compromised.

Read the rest of this entry »