How to clean the goo dot gl virus when you run it?

The worm spreads on Twitter as a link. Careful with this.

Computer Viruses: View the question and associated answers on Quora.

Random number generators: The devil is in the details

How to generate random numbers from spam

I found this the other day, via WPRandom:

Generating random numbers is pretty complicated if you need them for cryptographic algorithms. This software generates them based on spam comments…

It caught my eye as a sort of “spinning spam into RNG gold”, or more likely, PRNG (pseudo-random number generated) gold. Many WordPress blogs, whether self-hosted on WordPress.org or not, effectively use Akismet as a comment spam sieve. As I’ve learned during my time with WordPress, and with spam comments, Akismet will not publish comments that it identifies as probable spam. This provides a possibly crucial aspect of SecurityDump’s application:

no one will be able to see the source of your numbers, unless they hack into your database

All the details are available on the Google project site for WPRandom, Problems and Attack Vectors wiki. I have no idea if SecurityDump worked the bugs out of this yet or not. I found it an amusing idea, though, to squeeze some genuine value from the efforts of spammers.

The other Defcon

I never attended DEFCON, though it remains a dream I hope to realize one day, soon. It may soon become too logistically awkward due to increasing numbers of attendees.

Shodan is a remarkable search engine. Traditional search engines use “spiders” to crawl websites. Shodan culls data from ports. It was created by John Matherly in 2007. He continues to develop it.

Shodan is helpful for locating web server vulnerabilities. It is available as a free service, for up to 50 searches. Query syntax includes searches by country, host name, operating system and port. Shodan can search for software AND hardware. It has been acknowledged by mainstream media. The most prominent coverage was in early June, via The Washington Post, when Stuxnet received so much press attention.

Me and Shodan

Next is my Scribd infosec collection. It isn’t exclusively Shodan-related. This is why. I first noticed that Michael Schearer wrote excellent PowerPoint presentations, and kindly posted them on Scribd. I was curious, searched for more. This led me to Shodan HQ.

Shodan is NOT an acronym for Sentient Hyper Optimized Data Access Network. John Matherly kindly confirmed this, in response to my recent inquiry.

@ellieaskswhy nope not an acronym for my project, but it’s the acronym for the videogame character the name is based off of

— John Matherly (@achillean) August 19, 2012

Human knowledge belongs to the world, after all, and information ALWAYS wants to be free.

I wrote an information security and data privacy post, on my Tumblr blog. The (inline) PDF document from hal.inria.fr is the highlight. Along the way, I learned about quines! They are a cute construct, like palindromes, or self-replication, or polyglot programs; fun, maybe useful.

There was a somewhat satisfactory resolution to the ongoing matter of what I think of as Bobby Table’s Google-compromised web malware repository. The Web Malware Collection Project is:

A collection of web application back doors and malware, in PHP, JSP, ASP, etc.

DEFCON 13 badge

Let’s conclude with a video, Hackers vs. Disasters Large and Small. The venue was DEFCON 13. Introductory remarks were by Michael Schearer, which is where this all began. Be forewarned, duration is 1 hour, 45 minutes:

Most often we’re “on the grid” and close to our precious electronics and high-speed internet. What would happen if you find yourself stranded in the middle of nowhere or in the midst of a natural disaster? This presentation will show you that your hacker ingenuity can help you survive the worst.

Related

• Using Shodan and FeedBurner to keep an eye on your hosts

Two new elements, flerovium and livermoreium, also known as Fl and Lv, and formerly known by the much blander names of ununquadium and ununhexium, have been approved for entry[1] into the Periodic Table of the Elements!

The Periodic Tattoo of Elements

In honor of the event, I assembled a minor gallery of favorite periodic tables.

The children’s Periodic Table on the U.S. EIA site provides the basics. Better yet, it links to the Los Alamos National Lab (LANL) Periodic Table, which is just as impressive and complete as I would expect.

Celebrating the 175th birthday of Mendeleev’s Periodic Table

While viewing, consider a recent post by senior LANL employee David Hobart, Actinide Analytical Chemistry, History of the periodic table…and my history with it, which was charming, as well as educational.

There is an “evolution of the table” section, facts about the table’s inventor, Dmitri Mendeleev, born 175 years ago[2], and this:

As the legendary physicist Richard Feynman put it, “If some universal catastrophe was to engulf the world and humankind could retain only one scientific concept to rebuild civilization, what would it be? The chemist’s answer is almost invariably the Periodic Table of the Elements.“

Memorable periodic tables

1. The periodic table in 200+ languages, including dead languages
2. a spectacular interactive periodic table, in Latin
3. Josh Duck’s charming, functional Periodic Table of HTML
4. A rare earth element-centric periodic table that I am especially fond of

Chemical Philately: An IYC Stamp Odyssey

In the course of researching this article, I learned that 2011 was designated The International Year of Chemistry. Many countries chose to commemorate IYC 2011 with a memorial postage stamp. The United States did not participate, well, not with a postage stamp issuance, and several European countries focused only on the 100th anniversary of Madame Curie’s award of the Nobel Prize in Chemistry in 1911.

Macedonia

I followed along with IUPAC member Daniel Rabinovich in his own year of discovery, as he documented chemistry-related philatelic activities around the globe. Do read his narrative. View the beautiful stamps! He did an excellent job, conveying the excitement as each new stamp was issued.

Virtue was rewarded. Daniel Rabinovich will be a featured presenter on March 25, 2012, a few days from now, at the 2012 American Chemical Society meeting in San Diego. I wish I could be there too, to listen to his lecture, IYC 2011 Stamp Odyssey, HIST Tutorial and General Papers session.

[1] IUPAC made the announcement on Dec 1, 2011. The new names are currently nearing the end of a five-month public comment period. After that, the official paperwork will be processed, and they will show up in the table.

[2] Mendeleev’s Periodic Table was presented in public 142 years (and a few days) ago, on March 18, 1869 to the Russian Chemical Society.

EDIT
Some may find this online exchange that followed this post from the American Chemical Society: Lifetime Fan (An Undergrad Gets Inked) to be of interest. I refer to the comment section. It eventually led to a response by the CEO of the American Chemical Society, Madeleine Jacobs, which I enjoyed.

I found an old sentiment analysis application. It has very unglamorous packaging but a  good algorithm under the hood. I ran the Twitter user id’s of the brightest people I know. well, know of, who are active Twitter users. The assessment of “bright” was subjective by me.  All are acknowledged experts or advanced degree holders. Maybe half speak English as a second language, but are sufficiently articulate that their “essence”, well, intelligence shines through.

Guess what: It worked! I don’t know if anyone cares about this sort of thing, that really sharp successful people score well on this sentiment analysis indicator. That doesn’t necessarily mean it would have any predictive value. And no one seems to care much about this anyway. But what I’m saying is that most of these people only have okay-ish Klout scores e.g. 40′s. But they’re not trying to use Twitter for any particular social media purpose. Well, I don’t know that with certainty.

Visualization of Edward Tufte visualizing data

Visualizing Edward Tufte’s thought processes?

I found this while surfing Flickr. Austin Kleon of Austin, Texas is the artist. The image represents the cognitive process by which Edward Tufte transformed raw data into digestible information while writing Envisioning Information, one of his many follow-on publications to Visual Display. It is a mind map.

Tufte-isms

IEEE Spectrum’s Innovation blog featured the topic of data visualization, profiling Edward Tufte as a practitioner. The emphasis was unusual for IEEE. Use of words like “doyen” was too. I’m enjoying IEEE Spectrum more and more these days! If only I could become a member…

Tufte-isms explores how Tufte’s ideas have influenced language:

Tufte, it turns out, is not only a doyen of data visualization but also a neologist par excellence. His most famous [term] might be chartjunk, which refers to chart elements that not only serve no purpose but may in fact hinder understanding. In Tuftese, when chartjunk takes a cartoonish form…the result is a chartoon. One of the key principles in good information design is to shoot for a high data-ink ratio, which is the ratio of data-ink (the elements that convey the actual data) to the total ink used in the graphic. To calculate this, first distinguish the data-ink from the redundant data-ink (data elements repeated unnecessarily) and the non-data-ink (data support, such as grid lines, axes, labels, and legends, or as decoration, such as background colors, data markers, and of course, chartjunk). “Ink” here refers to both text and graphical elements.

SAS surprise*

SAS’s official conference reviewer attended a prior year’s SXSW event. She posted the focal image of the event’s opening presentation, the mind map reproduced below, as part of her review. I will include the relevant URL if I can ever find it again. Much of the SAS Ephemera blog has been archived so thoroughly that it has in effect, vanished. But the name did give fair warning.

Sweet dreams

A bullet point slide might be more meaningful for a keynote address than a mind map. But one page of Times Roman typeface on a white background is not nearly as compelling.

I did not have a high opinion of mind maps, but my mind is open

Mind maps first appeared several decades ago. Obviously, they are in vogue again. Mind maps could be described as visualization-lite. At best mind maps capture epistemological concepts. The viewer is prompted to synthesize information and learn. At worst, they are harmless, because they don’t attempt to quantify information.

The two mind maps above appeal to me as art, what I consider Chart Art. Chart Art is not meant in a pejorative way. Mind mappers don’t refer to their work as a form of “data visualization”. I think that is quite wise. We have designers who are interested in data, and analysts who are interested in design. Both can produce good work (we also have data scientists, but they are another matter entirely)!

This was Part 1, use of visualization. Part 2 will focus on abuse of data visualization. It will include a scaling criteria that I drafted, modified, pondered and put aside nearly two years ago, until I had some meaningful examples. Finally, I am ready!

Data scientists: Where are they?

Data scientists are a rare breed. The good ones have graduate-level degrees, or equivalent experience, in statistics and applied mathematics. Equally important is that they are decent programmers, and don’t consider applications development a tiresome chore.

All work by Austin Kleon is reproduced under Creative Commons License 2.0/by-nc-nd.

* The SAS Institute of Carey, North Carolina sells high quality statistical software and data management applications. SAS remains a privately held company, founded by Duke University professors from days past. If only IBM had acquired SAS instead of SPSS! I used SAS for many years. As I re-read this, I caught an amusing typo “high quality satirical software”. Who is the market leader in satirical software, I wonder?

The original Black Swan

Last night I read about The Black Swan a.k.a. Nassim Taleb on EL&U SE (English Language and Usage StackExchange website). Apparently Professor Taleb wants to introduce a new word to the vocabulary of global financial collapse, antifragility:

So let us coin the appellation “antifragile” for anything that, on average, (i.e. in expectation) benefits from variability.

Consensus on EL&U was that this was blatant tub-thumping by Taleb.

The original Black Swan

I agree with my EL&U comrades-in-arms: Antifragility will cause obfuscation. There are many adequate, extant words*that Taleb could use. Instead, he is intent on creating a term that will be uniquely associated with him. I am not convinced that there ARE any entities that benefit from variability. A delta hedge that is long volatility is the only construct that I can think of off-hand, and I don’t think something that contrived was what Taleb had in mind.

Nassim Taleb already co-opted “Black Swan”. If Thomas Mann were still alive, I think he would have a decent case for plagiarism or even theft of intellectual property. Couldn’t Taleb have thought of an expression that wasn’t previously used by someone who won a Nobel Prize in Literature, who wrote a book with the same title, and pertaining to an anomalous event, also known as a statistical outlier?

Anyway, after the briefest of browsing on a search engine or two for antifragility, antonyms and humor, I found Fragile Web Development with SQL on Rails. 

SQL on Rails, a humorous digression

Rails gives you a pure-SQL development environment. Finally!

Fragile, breakneck collaboration

Who’s using SQL on Rails?

Everyone from startups to non-profits to tyrannical governments are using Rails. Rails is all about RDBMSs so it’s a perfect fit for absolutely every type of web application, be it software for organized crime collusion, pornographic content distribution, torrent tracking, or even social networking.

What else do I need?

MySQL is the only stable option for SQL on Rails at the moment–the development team decided to tackle the gold standard first. However, work is underway to add support for a few more databases: Oracle™, DB2™, Fox Pro™, FileMaker Pro™, Lotus Approach™, Ingres, Sybase™, Oracle Berkeley DB™, and Microsoft Excel™. Just about any operating system will do, but we recommend one with Minesweeper.

If you need hosting, ask around.

That was followed by COBOL on Cogs.

Audio-cassettes and binders full of printouts: Re-live Y2K today

Modern browsers tolerated but unnecessary to view site in full green screen glory.  Click on image to view full-sized.

* Anti-fragility makes me feel exasperated. Robust, durable, survivable as in “survival of the fittest”, flexible, having high tensile strength, adaptable or tempered like Damascus steel… any would be adequate.

Or, as others said on EL&U,

I don’t think there really is a single word term for something that breaks or dies or whatever when stress is removed from it. (Phoenix)

and

Taleb means resilient, but he’s confusing survival of the species/system with survival of the individual. In the end I see an almost wanton muddying of the difference between individual and “group” survival – where “group” could be any level from small partnerships to global corporations to capitalism to humanity itself. The higher levels effectively require potentially fatal changes to happen at lower levels – survival of the fittest is what drives evolution in the first place. (FumbleFingers)

I found an excellent review of The Black Swan: The Impact of the Highly Improbable, with a new section “On Robustness and Fragility”, on the Amazon website. Wading through Mediocristan is amusing, sarcastic, yet acknowledges the merits of Professor Taleb’s work.

instead of producing 70-80 million coins per president, the Mint will now only produce as many as collectors order.

2010 Native American $1 Coin reverse

Forty percent of $1 coins were returned, unwanted, to the Federal Reserve Bank each year.

Circulating demand for $1 coins will be met through the Federal Reserve’s existing stockpile, which will be drawn down over time.

My favorite $1 coin featured Sacagawea, guide to Lewis & Clark. This is the 2010 Native American $1 coin, reverse side. It is beautiful. Click through for full details from the U.S. Mint.

Even though the $1 coins would have saved billions over time (they are more durable than paper money), they were never popular with the American public. Not all of the American public feels similarly. Those participating in this discussion on Reddit seemed saddened by the news. Others raised the point that the U.S. Mint remains committed to production of the penny. Despite my fondness for copper, and loyalty to the Arizona as The Copper State, one wonders at the sense of this. Both Canada and many European countries have already discontinued small denomination paper bank notes, and replaced them with larger denomination coins.

I liked $1 coins, as they were useful for buying commuter train tickets. I’ll miss them.

This very user-centric approach for identity resolution leverages the many open API’s now available for web services. Feel free to select your user name-of-choice!

• @Twitter user name
• Facebook.com/user name
• user name@gmail.com
• YouTube.com/user name
• user name.wordpress.com or user name.wordpress.org blog URL
• Flickr.com/user name
• user name@yahoo.com
• Open ID provider URL
• more?

In his identity resolution related post, developer Luis Farzati emphasizes that:

the objective is to allow the user to input whatever wanted [in order] to login… If it exists as a valid username out here, we’ll find it and suggest it!

Casual testing

Luis Farzati’s Smart Identity Resolver Widget is on Github. A demo is included. I tried it. The widget easily found my Twitter and YouTube user names. It did not work with my Open ID URL. That was not surprising, as Open ID requires a bit of fussing, the first time I use it in a slightly different context.

Assortment of user profiles returned for sign on

I had a look around on Github. My impression was that Luis is using REST with OAuth to Open ID providers, or calls to APIs depending on the service. This enables the universal sign in to return the powerful visual cue of one’s own avatar. There are two forks, Master and G-H. The latter includes an implementation of the universal sign on for FriendFeed. The G-H branch might be interesting to someone who could understand it! Otherwise, it was straightforward, decently commented JavaScript that even I could almost understand.

Proof-of-concept

The Smart Identity effort was intended as proof-of-concept ONLY. Luis makes that very clear in the README. I think the motivation may have been to ease user transition to, and increase comfort with the URL-based format of Open ID.

I felt a little sad when I noticed that the repository had no commits since April 2011. The idea clearly generated some interest, though. It is quite appealing. Something may come of it eventually, as Luis’s Smart Identity Widget repository still has 17 followers on Github. Licensing is under CreativeCommons/by-sa/3.0/.

Minor disclaimer

Do be aware that I found this via Chris Messina‘s Friend Feed stream several months ago. Chris is an open social advocate and Google employee. That is of some reassurance. This should be secure, though one must always exercise caution if asked for a password!

New tag proposal.  Not really.

The nice thing about standards is that there are so many to choose from

I was waiting to post this until the debate between W3C and WHATWG about the status of HTML5 scope was resolved. However, I have waited since February 2011. Consensus is that HTML5 is being inappropriately used as a catch-all for every standard supported by modern browsers. Modern browsers actually include much more: CSS3 styling, WOFF (web fonts), semantic web elements such as microformats, 3-D graphics including SVG, and performance enhancements. HTML5 tags are merely one part of semantic web support. As a result, terminology was modified by WHATWG. HTML is the new HTML5. 

HTML5

What does that imply for the HTML5 logos and imagery introduced by W3C in January 2011? That is unclear. While still available, get your official HTML5-related logos. Here is the full-featured badge, on the right. Have a look at the official W3C HTML5 logo FAQ for an explanation.

Curious about the origins of the HTML5 logo, regardless of its future? I was. It was commissioned work by design studio Ocupop.

What now?

As best I can tell, HTML is now version-less. It is a living standard and maintained by WHATWG. A snapshot version of HTML5, updated on 14 November 2011, is approaching “last call” status. HTML5 documentation is a joint project of the W3C and WHATWG.

HTML remains in flux, as befitting a living standard. The most recent issue is <time>. HTML5 Dr. Bruce Lawson provides motivation and use cases for this element. Evolution of <time> is captured best by comments after the post. The rogue entry by a W3C impersonator was most exciting! It was masterfully dispatched by HTML5 Dr. Oli Studholme. Further discussion of the meaning of <time> was recently initiated by a WHATWG project leader.

Stray thoughts

Josh Duck’s delightful Periodic Table of the HTML5 Elements remains valid, after a name change to HTML. The <time> tag links to a pleasant web applications development company, Kaazing. The Kaazing pumpkin carving template for an HTML5 Halloween is available for download[PDF]. Although too late for 2011, the template will not be  deprecated, and is portable through the year 2012 and beyond.

Earlier this month, Adobe Systems announced that it will no longer support Flash for mobile devices, with browsers to follow. This reinforces the importance of HTML as a web browser standard, due to its support of video. YouTube and Vimeo already offer HTML5 beta versions, which work nicely.