Heartbleed: For want of one nail, the kingdom is lost

The Heartbleed OpenSSL problem is big news ( http://heartbleed.com if you’ve been under a rock ). What’s wrong?

In short, Heartbeat allows one endpoint to go “I’m sending you some data, echo it back to me”. It supports up to 64 KiB. You send both a length figure and the data itself. Unfortunately, if you use the length figure to claim “I’m sending 64 KiB of data” (for example) and then only actually send, say, one byte, OpenSSL would send you back your one byte — plus 64 KiB minus one byte of other data from RAM.

Whoops!

Matt Nordhoff from, How exactly does the OpenSSL TLS heartbeat (Heartbleed) exploit work?

So this one, tiny-looking problem brings our entire sand-castle Internet kingdom down. “Secure” web sites turn out aren’t necessarily secure. Worse, they haven’t been secure for some uncertain amount of time. So, anything communicated insecurely, during some uncertain time-frame… is, uh, possibly snooped, stolen, etc. The system admins have to patch the fix in, then redo site certificates, then everything everyone has put to/from those sites, (your login and password for example!) has to all be considered stolen/tainted and has to be reentered.

Bonus: it’s even worse than I’m making it sound: Try this on…

http://security.stackexchange.com/questions/55116/how-exactly-does-the-openssl-tls-heartbeat-heartbleed-exploit-work

http://security.stackexchange.com/questions/55097/can-heartbleed-be-used-to-obtain-memory-from-other-processes

ɕ


My dad’s 1957 Austin Healey

This was my dad’s 1957 Austin Healey.

(These slides are from 1968.)

ɕ


Also, people didn’t know to click on images

I distinctly remember:

  1. When inlining of images happened; The first time it was possible to put an image directly INTO the page. And JPEGs man. JPEGs where coooooooooool.
  2. Also, tables. Today, everyone loves to whine about how bad it is to use tables to layout pages. NOT having tables was much, much worse.
  3. And image-maps; The idea that WHERE exactly you clicked on an image, could take you to different content. I won’t even get into what we had to do to make it work… (but it involved: convex polygon mathematics, C code, a compiler, and a DEC Alpha work station.)
  4. …and we had to TELL people, “A lot of images in Skew are links… Click at will!” when we started e-publishing a magazine in December 1994.

So yeah, back in the day we had Mosaic. Then these guys hit it out of the park with:

Navigator was the way millions of people around the world were introduced to the web. Many web technologies and standards, such as as SSL, Java, Javascript, open APIs and support for online media, were innovations that Navigator made mainstream.

Brian McCullough from, On the 20th Anniversary

slip:4uieoe1.

ɕ


Play a poor hand well

Life is not always a matter of holding good cards,
but sometimes, playing a poor hand well.

~ Jack London

slip:4a62.


Vault box build

These plans are for building a vault box. This is not easy. You’ll need some good circular saw skills, patience and a lot of labor. Read on!

The original, in case you have a hardcopy, is online at
http://constantine.name/vault-box-build/

Drop me an email: Comments, questions, and suggestions for improvements are welcome. Best of all would be if you sent me some photos of what you built, preferably a big group photo of you on them, or using them or whatever. My email is my first name, craig, at this domain. (Yes, this is a “.name” domain.)

(The original design of this project is still available at, How NOT to build a vault box.)

(more…)

Energy and economic models

We live in an economic world. Economic models that were developed years ago were created based on observations of how the economy seemed to work at the time. As time goes on, it is becoming clear that early economists missed important connections. The most important of these is the role of energy and its connection to the economy. It takes energy to make anything, from a piece of steel to a loaf of bread. It takes energy to transport anything. Humans need energy in the form of food to continue to live. Clearly, energy should have a place in economic models.

Gail Tverberg from, Energy and the Economy

slip:4uouee1.

I find this stuff fascinating; It’s this giant, emergent phenomenon. Billions of individual people going about their daily lives create such a whirl of activity and action. But the ultimate result is what… an “economy”? A path to “enlightenment” for humankind? Meaningless in total, but meaningful at the individual’s level of experience? Perhaps it’s simply [on the whole] incomprehensible. If you study a little chaos theory, you learn: The butterfly’s beating wings have ZERO affect on the weather. Instead, the fully understood system, (“stochastic”) is truly unpredictable.

ɕ


How NOT to build a vault box

Don’t

I do NOT recommend using these plans to build a vault box. I’m putting this up for a historical record of what we did (so I don’t have to remember.) I’m already writing another article explaining a better way to build a vault box.

Really. Don’t build vault boxes using these plans.

Here’s the other design: LVPK vault box – second design.

Cut to the chase

Here’s the PDF: LVPK vault box – first design PDF.

We, (Lehigh Valley Parkour) built 8 of these vault boxes. They are rock-solid, portable, stackable, etc. They’re great! …but you can do better. So I’m creating another set of plans from a slightly modified second design.

What we did that went right

You can get the materials for less than $100 per finished box. We collected $100 from everyone, up front and bought everything together in one go.

We built 8 of these. We started by building one box from start to finish. It was the worst box, but we learned a lot. Most importantly, you need one person who understands how the whole box should go together so you can make sure it goes correctly.

We had so much material, we rented a cargo van, (it was winter and we didn’t want to deal with unexpected bad weather messing up our scheduled “buy everything” date) to haul the 1,000+ pounds of lumber and plywood to where we were going to build. We had four people on the “buying night”, and then several 6-hour DAYS of 4, 6 and even 8 (on one day) people working on building these.

We had all the right tools. This is a lot of cutting and screw driving… circular saws are dangerous, second only to chain saws. We had people with safety glasses, ear plugs, work gloves. One guy working the circular saw with two helpers moving plywood. Other people with a battery drill to drill pilot holes, another person with a corded drill driving deck screws. People with orbital sanders and files, someone drilling the large holes and cutting the hand-hold slots. It was crazy.

What goes wrong

The root of the problem is that the design is sloped in both directions; There is a 15° lean from vertical on the “fronts”, (the bigger faces you’ll approach most often) and 7.5° on the “sides”, (the more narrow faces where the hand-holes for lifting are located.) This is simply too difficult to get it to work out correctly with rough lumber and basic building skills.

The biggest problem is that the corners are compound miters. In each corner there is a piece of 2×4. When you put a 90° angle (the corner of a 2×4) into the compound miter at the 15°/7.5° corner, you find out that you really need about a 93° corner on the 2×4. It almost works. The 2×4 goes in, but when you screw the faces together, it “pulls” the big face inward, making the plywood bow concave. That messes up the bottom of the box’s fit onto the next box below. I ended up adding some additional 2×4 strips near the bottom of the box front to straighten the faces… but it’s fiddly to get it to come out right.

When I was coming up with this design, I tried combinations of different angles and eventually settled on 15°/7.5° because:

  1. These angles make the finished boxes nest when you stack them in reverse order.
  2. When you stack them up, you won’t knock the pile over using the box.
  3. 15° and 7.5° are reasonable bevels to cut on plywood edges with a circular saw.
  4. You can measure convenient lengths of “2 inches” and “4 inches” and cut diagonally across the plywood strips for the box faces to get almost exactly the angles you need.

I also spent a lot of time adjusting dimensions to make the box as large as possible from only two sheets of plywood. There is very little scrap material left over.

When building, getting the box to work out right is difficult; If anything is off by even ONE-QUARTER of an inch, then the box isn’t perfect. If anything is off by HALF an inch, you may not be able to get the box together at all. Every cut on the plywood has to be perfectly straight, which means you have to use a clamped straight edge to guide the saw on every cut and you must always get the bevel correctly arranged. So sometimes you have to cut “backwards”, (the opposite way from the normal, safe way you’d cut with a circular saw.)

Also, near the end of the plans it describes a little about how to put the top-piece of plywood on each box. It works fine for the top/smallest box. But for the middle and bottom, the way to do it is: measure the opening of the box above, then cut the plywood sheet and screw it to the box. It might not look perfect, but if you put the plywood on so it fits nice, the box above isn’t likely to fit correctly over it.

Finally, the plans, (in the notes near the back of the PDF) show how to figure out how much paint you need to paint them. We used a grey outdoor deck/porch paint, and we mixed in fine sand to give the box some traction. If you’re making artificial obstacles, may as well make them friendly too.

Specific notes

The PDF document above has notes added in red pencil:

Pages 1 and 2:

  1. We added hand-holes for lifting. They’re not shown on these sketches.
  2. “Bevel” means set the bevel angle on the circular saw, i.e., make the saw blade lean. Saws only bevel in one direction, so every cut in the plans has an arrow on end showing you which way to cut; This determines the orientation of the “under bite” made by the saw.
    The saw we used is “right handed”, (as are most saws) the blade tips to the right, and the blade bites under to the left. Some of the cuts are difficult because the “easy” cut direction, (with the saw on the bigger part of the piece, dropping the cutoff away to the right) would produce the wrong bevel on the work. }
  3. For cuts number ‘2’, ‘3’ (which you do twice) and ‘4’: The arrows point the wrong way; They should point to the right on the diagram so you have 3 cuts that are easy/the-right-way, and just the last one is “in the wrong direction”, against normal saw usage.
  4. This column shows you the materials you’re using up as you go along. It just helps you keep track of everything.

Page 2:

  1. Don’t bother stacking. Just measure, mark and cut each (‘A’, ‘B’ and then ‘C’) strip as shown.
  2. Yes, all the strips’ edges have a 7.5° bevel on them. Yes, it really does not matter which way you have the bevel when you cut the end-angles.

Page 3:

  1. Cut ALL of these cuts the other way. It’s easier. Cut ‘1’ just trims the sheet to put the bevel on, cut ‘2’ (5 times) drops strips off neatly. Then you turn the piece around and cut it the “wrong way”; “wrong” in terms of how you normally rest the saw and cut “off” the smaller part.
  2. Nothing to see here.

Page 4:

  1. This is the view of the end of the 2×4. Just run the saw along the right edge of the 2×4 steering generally straight.

Page 5:

  1. At least 3/4″, more is fine.

Pages 10 etc:

These are just some notes from figuring out how many boxes of screws we needed. (We didn’t put the exact number of screws in. We just went with “that’s probably enough”. And we ended up using only half the deck screws.) Also some calculations of how much paint we needed to buy.

Copyright

"Vault box design 1, sloped sides"
Copyright (C) 2014 Craig J Constantine

This information is free; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version
2 of the License, or (at your option) any later version.

This work is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty
of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
the GNU General Public License for more details.

You should have received a copy of the GNU General Public
License along with this work; if not, write to the Free
Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
Boston, MA 02110-1301, USA.

ɕ


Slide scanning

…2,600, (give or take a few hundred) mounted slides scanned!

Recently, I’ve been talking about my slide scanning project. I’ve been pouring hours and hours into feeding the slide scanner… it was like Little Shop of Horrors, “feed me Scan-more!!” for days on end. Except for a short stack of problem slides, I’ve completed the heavy lifting.

I’ve found hundreds of slides that I want to share. Stay tuned!

Aside: Where am I putting the digital files? My little Mac file server has a two drive RAID. On that Mac I run Arq, (which I highly recommend.) Arq backs-up all my stuff into Amazon’s Glacier. Glacier is dirt cheap storage; I mean dirt. cheap. They charge you a reasonable fee if you ever retrieve data from the storage service. (Get it? “glacier”. Frozen in ice, never to be used again. Unless you have a disaster, then you won’t care about a few hundred to defrost your data.)

ɕ


Protest Against Idleness

It is not necessary for a man to be actively bad in order to make a failure in life; simple inaction will accomplish it. Nature has everywhere written her protest against idleness; that which remains inactive, rapidly deteriorates. It is the struggle toward an ideal, the constant effort to get higher and further, which develops manhood and character.

~ James Terry White

slip:4a158.


Do elephants call, “human!”

The new research, recently reported in PLOS ONE, builds on previous Oxford University research showing that elephants call ‘bee-ware’ and run away from the sound of angry bees. Whilst the ‘bee’ and ‘human’ rumbling alarm calls might sound similar to our ears there are important differences at low (infrasonic) frequencies that elephants can hear but humans can’t.

~ from, Do elephants call ”human!”?

slip:4upyne4.

Seems pretty logical to me that elephants would have different sounds for alerting to different threats. The big question, for me, is how much of a threat do they perceive humans to be; Do they actually understand how dangerous humans are/can-be?

Update:

And someone emailed me to point out, that yes, elephants can distinguish a lot about humans; from, Elephants recognise human voices.

ɕ