Off-Topic: appartment rental scammers

November 18th, 2007

Internet is full of scammers. Here is the mail I got as a request for more information regarding an apartment to rent:

Thanks for your email and it is my gladness to hearing from you.I am
jim.bukner,the owner of the house you are making enquiry of.Actually I
resided in the house with my family,such as my husband and my only daugther
before and presently we had packed due to my transfer from my working place
and now situated in the west africa (Nigeria)and presently my house is
still available for rent for 600euro including the utilities like
hydro,washer and security,it is furnished.Moreso Now, i went for a Crusade
in the West Africa and i will like you to get in touch with me for more
discussion as i am with the keys and the document to the house.Pls i want
you to note that,i am a kind and honest man and also i spent alot on my
property that i want to give you for rent,so i will solicit for
your
absolute mentenance of this house and want you to treat it as your own,is
that taken,it is not the money the main problem but want you to keep it
tidy allthe time so that i will be glad to see
 it neat when i came for a check up.i do that oncein a while.I also want
you to let me have trust in you as i always stand on my word.if you are
interested in renting this flat i will like you to fill out this form
below....

If I summarize: a Gay (with a daughter adopted or from a previous marriage) on a Crusade in Nigeria

then

RENT APPLICATION FORM
Also,Pls let me get this answer.
1)Your Full Name
2)Your Full Address & Phone Number
3)How old are you?
4)Are you married?
5)How many people will be living in the house?
6)Do you have a pet?
7)Do you have a car?
8)Occupation?
9)What is your religion?
10)Do you believe in god?
please i will like you to know that everything will based on trust,because without it this transaction can not hold.
please i will like you to get back to me as soon as possible so that i
can let you to knoe the next procedure.
Thanks and you are welcome
Regards.

you can call me on my mobile +2348030538934

Should I answer/call ? Mmmmm

Fireman job

November 18th, 2007

If a project has not been correctly managed for a while, a team will need to perform a fireman job. When this happens, make sure someone (in particular someone with decision and organizational power, like the project manager) keeps the head out of the smoke and control even more the direction of the project. Otherwise all is going to burn down.

DSL book in the works by Martin Fowler

November 18th, 2007

I was telling some friends a month ago that MF was unusually silent. I suspected a book in the works, and yes, I was right and it will be on DSLs. So far, just the Intro is available, and starts with a basic state machine DSL.

In the same topic, go and look at quaere, a Java DSL to solve the same problem space addressed by Microsoft LINK.

update: this page was linked from here which looks like a autogenerated linkform. Strange. Wonder what the real purpose is. Whois data hidden behind privacyprotect.org.

CITCon Europe 2007: today’s agenda

October 20th, 2007

2007-10-19-21-12-09

CITConF Brussels

October 20th, 2007

Some quick notes:

  • Many companies, many from London (where CITConF 2006 was hold). I was surprised by the number of independent consultants. Some companies strongly hinting they are here to recruit (e.g. Google)
  • I lost my mobile phone… Gosh
  • Wide range of topics was selected yesterday. I will
  • (phone followup) I tried to call my phone it and it is off… It’s probably not lost after all. And I didn’t move from the hotel. I checked my phone bill and it’s not been used. Maybe it’s without battery. Let’s hope so.
  • The paying Internet access is 20€ a day… We’ve set up a shared access using a spare laptop and a wifi router. Part of the credit to BT for unknowingly serving as encrypted SOCKS proxy for the few users of this hotspot. Simply bridging the connection wasn’t sufficient: the ISP was blocking all 200 traffic not targeted to the machine registered with the external access point. Everything else was working (other ports and even more surprisingly other return codes ! e.g. 404). I wonder what they do.
  • (phone followup) I tried to order some credits on Skype, but my #/#”¤( bank requires me to enter my one time password, which I don’t have on me of course… Thank you Postbanken/VISA/EDB

Loyalty to your project manager

October 20th, 2007

Are there any situations where not being 100% loyal to your project manager is acceptable ? if you take initiative without approval from your hierarchy, are the benefits you potentially bring to a project necessarily out weighted by the potential anarchy you introduce ?

A solder shouldn’t reconsider his orders, right?

And when the conflict is unveiled, both parties should try to avoid getting emotional, should focus on whether the initiative really brought good to the project, and more especially try to understand why do people end up taking initiative. The path to disobedience is not a simple one and soldiers don’t (usually) take it without thinking twice.

A somewhat related entry.

(I am an external consultant, but I think the problem is the same as if I was an employee. At least I think I would react in the same way).

TestDirector and Jira

October 20th, 2007

If you ever wanted to use both Jira and TestDirector on a projet, or migrate from TD to Jira, have a look at td2jira. Subtitled “Quick’n'Dirty Way to Share The Issues With Your QA Team” it works OK for us !

Vladimir graciously gave me commit access and I added some new features. Interested, don’t let you get fooled by the front page, and go and grab the latest from subversion.

Talking about Jira and continuous integration, I have a patch waiting for publishing build failures from CruiseControl to Jira. Hopefully it will make it into the upcoming 2.7.2 !

CITConF since yesterday

October 20th, 2007

I arrived in Brussels yesterday for CITConf Europe 2007. The conference, organized by Paul Julius and Jeffrey Fredrick (both of CruiseControl fame), will be held today following an open space style.

We spent part of the evening presenting ourselves, defining an agenda and drinking some beers :)

More related news soon.

Brief Continuous Integration news

September 4th, 2007

For all those interested in Continuous Integration and Testing, don’t forget about CITCon Europe, hold the 19th and 20th of October in Brussels. Yes it’s on a Friday/Saturday, but hey, you’re passionate or not! Hope to see you there :)

Second, CruiseControl 2.7.1 was just released. Go and download it, and try the improved dashboard !

Finally for anyone using the Mercurial distributed source control with or without Java, give a try to the latest CruiseControl trunk. Support was added this week-end and should be in the next release.

Semantic web: adding functionality to finn.no using greasemonkey and microformats

August 2nd, 2007

This article gives a rough introduction to the semantic web, microformats and how to extend a site functionality using greasemonkey, a Firefox browser extension and a custom program called a user script.

The limited Web

First generation web sites tend to be pretty closed by nature. They display information in a particular way, do not often let you access the underlying data in an easy to parse format (such as XML), and rarely let you interact with the data using APIs. The functionality is limited by what the designers of the site thought of. That sometimes become frustrating.

Sending emails to sites with proposed improvements rarely get you an answer, let alone a change that matches your request.

Let’s take an example

Finn.no is (today) such a first generation web site. Let’s look at its real estate part. As finn.no is a proeminent medium for publishing real estate listings in Norway, it contains a lot of entries, which is good for the purpose of this articles (and for the users of the site). When you load a page, e.g. this one, you get a 2 column page with formated information about the apartment or house to buy, including the address, the contact information. The page also sometimes the date and time for the various showings, called visning is Norwegian:

Extract of original page

If you are interested by the housing, you might want to take note of the showings into your calendar. If you are like me, your calendar is on the web, and is just one tab away. But entering the information in the calendar is error prone, time consuming and not necessarily consistent every time you do it. You might forget some data, or make a mistake. There has to be a better way.

User scripts

Not all is lost! As the information is publicized over the Net, if you have the will, you can find a way to interact with that data and extend the original functionality of the web site.

One of the easiest and most user friendly way is to extend your browser with an extension that lets you use something called user scripts. User scripts are programs written in javascript, the language supported by most browsers that allow you to dynamically modify the DOM, the data representation of web pages. If a user script is run by one such particular browser extension, it will then have a chance to interact with the page, modify it and even interact with other pages to retrieve or combine information.

On the Firefox web browser, an increasingly popular web browser for which thousands of extensions exist, there are at least 2 extensions that allow you to use and manage user scripts: operator and greasemonkey. This article makes use of the latter and assumes your have it installed in your browser.

Microformats

If you know about the web, you may have heard about the semantic web. The w3c defines it as a common framework that allows data to be shared and reused across application, enterprise, and community boundaries. Part of this effort are microformats, which allow you to use markup data to tag reusable information inside a web page.

Such an example of microformat is hcalendar which allow you to embed an event info a page. There already exist user scripts that can detect hcalendar entries in a web page and allow you to publish them on your calendar. If you use Google Calendar, you can already find a Greasemonkey user script that adds button(s) to the current page that allow you to easily register using a simple click the hcalendar events into your Google calendar.

Finn.no realestate hcalendar events

Unfortunately not many sites use microformat yet, and finn.no does not. But if I create a small user script that formats the showings as a hcalendar events, I can then reuse the more generic publish hcalendar to Google Calendar script.

So here we go. Provided that you have installed the Firefox greasemonkey extension (I used 0.7), install the finn.no user script, then install the modified hcalendar publishing script. Then surf on finn.no/realestate.

After the run of the finn.no user script

After the run of the finn.no user script

After the run of the hcalendar publisher user script

After the run of the hcalendar publisher user script

Now just press the button corresponding to your event! Finn.no now integrates easily with Google Calendar, provided you use greasemonkey and install the appropriate user scripts.

Bonus: as Google Map now covers Norway, you can also place the address on the map (provided that the address information published in the originating site is recognized by Google).

Notes

  • I’ve had to modify the original hcalendar publisher script as I had problems with timezones.
  • There are modified/improved version of the original hcalendar publisher script on the web, in particular from Patrick Chanezon of Google (and ossgtp) fame. I’ve chosen to use the original user script.
  • I’ve also had encoding issues in the add event page to google calendar. The problem may come from the button url generated publishing script instead, but I’ve chosen to to keep the differences minimal with the original script. Thus the generated hcalendar contains encoded data…

Feel free to report any issues.

Conclusion

This article introduced the passioning future of the web, the Semantic web and web sites integration.

Although the technique used is not perfect, in particular it isn’t necessarily very stable (if the targeted site changes, your script might be broken), it is a very efficient way to create a prototype for changing or integration one or more sites.

Note: as of this writing, I have no relation with the site used for this article, apart from being a more or less happy user (happier now that I have this script).

Tales of good & bad management

July 1st, 2007

I’ve never blogged much about management. I guess it’s time to add en new category.

Here are 5 stories one might reflect on.

Shit management

Years ago, one of my clients had to deal with many problems: third party suppliers being late, client not sending the required information on time, etc… You know the drill. I recognize now that I’ve been completely shielded from the problems. Although this created a lot of stress for the 2 persons above me, my productivity was never affected by these external events, as the shit never went down. So kudos to them. The way they handled it was a key factor in the success of their project.

Share the benefits, share the blame

Sometimes sales do not have a stake in the outcome of the project. For example, if the market is good, you get many sales, but maybe no way to find people to do the work, and basically an almost impossible task for operations to fulfill your objectives. Then the implementing team cannot reach the deadline.

But who gets the blame? Certainly not the implementation team alone !

Operations should not have to face the client alone. Sales should. And part of their job should be to ensure the smoothness of the operations, both pro actively (make sure the company can deliver) and afterwards, doing the shit management. Sales should get most of their bonuses at project completion, not just after the sale.

Exactly like in a restaurant. That’s why waiters get the tips. That’s also why the waiter get the tips after the delivery.

Chicken race management

I was talking to a manager some weeks ago who had to deal with impossible deadlines (partly because of sales…). Releases were delayed often if not always. Sometimes for a few weeks, sometimes for several months. I asked what they did to warn the client. Answer: “we warn them t - 2h, because most of the time they are also delayed. They never know.”

The minute I heard this I pictured 2 cars racing against each other. In the best scenario: only one crashes.

Of course this isn’t the right way to solve the problem: no-one wants to learn of a problem so late in the process. So: have regular contacts with your client, and update each other often. And fix your delivery problem issue: be more productive but refuse impossible deadlines.

Resource management and scarcity

When resources are scarce, like in these days for IT, you have to manage them with care. That reminds me of a tale from the end of the 90s where the situation was similar. A friend of mine was being contracted by a company on a project that was critical to the company. His contract was initially for only half of the work and they had to renew it to finish the work. The thing is that the managers in the company assumed that my friend would stay. So the contract ended, and he left without having the opportunity to negotiate the renewal. Both of them lost: he lost a client, they got in trouble and increased their costs.

One advice: be proactive in your resources management ! Don’t take everything for granted !

He’s mine

This friend of mine had a long temporary contract with a company. He wasn’t happy. His relationship with his manager wasn’t particular good as both had different expectations from each other. The manager expected the worker to identify tasks on his own, the employee expected the manager to involve him more in the team and to do regular team meetings. He needed a sense of belonging and some top to bottom management. After a year and 2 meetings, the employee completely lost his motivation and the manager probably lost his confidence in the delivering ability of the employee. The employee tried to raise the issue several times but there probably was some lack of understanding between them.

Before the end of his contract, the employee tried to rebound. He searched for a new position in a different department, in a place where he knew things were done differently and probably would fit him better. He contacted a manager who had an opening matching his skills.

Initially interested, the other manager never came back to him. In fact, the last month, the other manager just avoided giving him any kind of answer. My friend eventually got an offer, but from his current department, which he obviously refused. Not getting an answer from the other manager, my friend got disappointed and in the end took a job in another company.

What he learned afterwards that the other manager was barred from making him an offer as the current department still wanted my friend to work for them.

Worse: this was some kind of non-official but very active rule in the company: if I want him and can’t have him, no-one will !

Gosh….

gmail loosing unread mail status in threaded mails ?

February 10th, 2007

I have been using gmail for a while now, and am mostly satisfied with it. The threaded system it is based on has some good points and bad points, but so far nothing that required me to reconsider changing my setup. Things have changed.

I missed an important mail part of a ongoing thread on Thursday. The person who wrote me that mail resent me a mail on Friday. That mail ended up in the same ‘conversation’. When I read that second mail I discovered the previous mail, strangely marked with a read status. I am pretty sure I didn’t read that mail. I am sure I didn’t see that conversation marked as read in my Inbox. I am sure I didn’t click on update this conversation and read that mail afterwards.

Now this is at least the second time this happens to me in the past 2 months. First time, the mail wasn’t that important and I assumed an user error. Now this time I have big doubts.

Could there be a bug in gmail’s mail read status in connection to threaded conversations. Maybe some kind of
timing issue ? Or something that gets the mail marked as read even if it wasn’t displayed properly ?

I doubt it, but nevertheless, twice the same problem in a short period while I’ve never had a problem in years is strange.

Note: around the same time I received that mail, I was in a network that had failures due to(?) a mis-configured WebWasher proxy. That’s too important to leave this out. In particular that proxy caused errors with gmail. E.g. I couldn’t read my mail properly and couldn’t logout. More info below. I wonder if the issue could come from a combination of proxy error and bad update. So could this 2 problems be linked ? Could there be a code path in the gmail Ajax calls that update the mailbox statuses that don’t properly handle failures ?

This type of problem is not new in the world of “web 2.0″ applications. I stopped using BlogLines because they also used to have errors with their read status count. I noticed that google Reader (beta) starts having similar failures (some of them perhaps related to the fact that sometimes my google reader page is opened on multiple PCs ?), and now gmail…

I haven’t contacted Google yet. I still believe it could be a user error. But I will watch out for the third time…

Webwasher failures

webwasher proxy failures with gmail

I contacted the vendor on Thursday, let’s see if they answer…

For info, the version of Webwasher was 6.0.1 Build 2533

A multiple-language kiosk for Linux (Ubuntu Edgy)

February 10th, 2007

[This post is a work on progress and may be updated]

Linux is great for one thing: it supports multiple language on the desktop. If you plan to offer a kiosk mode supporting many languages, Linux becomes a good choice.

We settle on Ubuntu Edgy as a default distribution for this setup, but any distribution might do. The chosen environment is Gnome.

Worklog

  1. install Ubuntu.
    we name the administration account ‘administrator’. Pick a secure password.
  2. Add your supported languages (System/Administration/Language Support). I selected English, French and Norwegian. Chose Apply and select your default language
  3. add a guest account
    login ‘guest’, password ‘guest’, real name ‘Mediatheque Guest User’
  4. if you use the GUI, you can limit the privileges. I selected ‘Access external storage…” “Use audio devices” and “Use CD-ROM devices”
  5. change some account options
    • FIXME disable package notifications
    • FIXME restrict menu rights?
  6. configure gdm
    • add a theme with user list, language & logo
    • using gdmsetup, select the theme and restrict the list of users to guest only (one can still log in as administrator, it just won’t show up in the list)
    • trim gdm locales list: reduce /etc/gdm/locale.conf
    • pam for guest users. Create a file called /etc/X11/gdm/nopassusers.txt containing the name of the users that do not require to have a password typed, one user name per line. In our case the file will contain guest. Then modify /etc/pam.d/gdm so that the line auth sufficient pam_listfile.so item=user sense=allow file=/etc/X11/gdm/nopassusers.txt onerr=fail follows auth required pam_env.so

    tip: use gdmthemetester to test; which requires you to install xnest package on Edgy

  7. autologout of the guest account:
    • enable blank screen saver, 10 minutes
    • custom autologout script added to session

    You might want to use the following scripts (add them to /usr/local/bin):

    forcelogout

    #!/bin/bash   # allow close session without user interaction   gconftool-2 --set /apps/gnome-session/options/logout_prompt --type=bool false   # kill session   gnome-screensaver-command --deactivate   gnome-session-save --kill --silent

    screensaveractive

    #!/bin/bash # return 0 if screensaver actif; 1 otherwise output=`( LANGUAGE=en && gnome-screensaver-command --query )` if [[ $output == "The screensaver is active" ]]; then     exit 0 else     exit 1 fi

    autologout

    #!/bin/bash # This script will perform an autologout of the current user  # from a gnome-session when the screensaver is triggered while [ 1 ]; do     sleep 2     screensaveractive && forcelogout && exit done
  8. session
    add firefox, configure home page; change some preferences related to security. Also disable the ‘ask on exit’ element of the session preferences dialog. That will make guest user disconnect easily.
    Also set browser.sessionstore.resume_from_crash to false in about:config as to avoid session restore dialog upon restart (best would be to cleanly shutdown FF in forcelogout, but I don’t know how)
  9. potential security improvements?
    • change menus?
    • remove command line?
    • disable services?
  10. kiosk advertising/documentation. Print out a help document and let it close to the machine
    • help file
    • offer to distribute Linux
    • sell blank CDs/DVDs ?
  11. TODO
  12. improvements
    • session reset
    • localeList widget for gdm ? no flags in gdm to map to a locale (conscious political avoidance decision)…
    • auto-logout for gdm?
    • generic auto logout for X?
    • remove confirm close session?
  13. Interesting links:
    • http://www.justlinux.com/nhf/Filesystems/Mounting_smbfs_Shares_Permanently.html

Mirroring remote subversion repository

January 11th, 2007

Was searching for a way to mirror a remote subversion repository through http, for backup purposes.

After struggling with various tools, I found this blog entry. Thanks Thomas!

Disposable Hardware

January 11th, 2007

Failing hardware

My nice 3 years old Samsung ML-1210 laser printer failed. It can print but it cannot grab the pages…
Cost of repairing it 675 NOK + shipping + time to send package/post it. Cost of buying an newer more performant item and get it delivered at the office, 1100 NOK.

OK, what do I do with my almost functioning old printer ? I am sure someone can fix it.

Cost of bureaucracy

Failed RAM module for my laptop…. But it has a lifetime warranty !!!
Good, just need to send it to UK for replacement. So what are the costs ?

  • 10 min on the phone to get an RMA number
  • 40 min to go to the post office and come back
  • 80 NOK for sending the parcel to UK
  • 180 NOK to pre-declare the parcel to customs to avoid having to pay Taxes on the item to be returned, OR pay taxes on the item to be returned, i.e. 25% (125 NOK) + 99 NOK fee).

Total: 1h lost + 300 NOK to pay to get a 500 NOK item replaced… Crap. Don’t even understand why I need to repay taxes on an something I already got taxed upon.

Final thoughts

  • companies probably never replace small items like that. They just buy a new one. My Dell laptop cost me so much because of the various hardware failures that I could have bought 2 other laptops instead and still end up with less costs.
  • it’s easy for Crucial and co to offer lifetime warranty on an item when you know most failed items won’t be replaced…
  • it’s not because your dead hardware is worth less than a new one that you should throw it carelessly. E.g. it may contains valuable data.

Talking about the valuable data, now that my future phone is a PC, I wonder what are the measures taken to ensure that our data will be somewhat secure ? Encryption anyone ?

Two column design & CSS mess

November 2nd, 2006

I am not a CSS guru, but when I look at how hard it is to produce a clean 2 columns design with a header and footer, having both columns the same height, I understand why so many people stick to HTML tables…

Or is there a better way ?

Telio won’t warn me of unpaid bills on their website - greasemonkey hack

October 18th, 2006

My VoIP provider (Telio) won’t show a warning to the user if she has some unpaid bills. I know it’s possible to view the bill status list on a particular page in my account, but “it’s not possible” to display a warning on the front page.

Whether the refusal is based on technical or will ground, I don’t know.

Hopefully I don’t need to wait for them to change their mind. A little greasemonkey script comes to the rescue… Here’s the result:

Visual effect of the GreaseMonkey script

Portable J2EE applications…

October 3rd, 2006

In one of my latest project, I’ve had to migrate a J2EE application from a Windows server to a Linux server. I didn’t know the code before I was assigned the task (which was to be completed ASAP).

It’s a pretty interesting task. In fact I’ve completely failed at evaluating the time it would take. And luckily for me, I didn’t have to migrate to a different J2EE server or DB server. Here are some of the issues I encountered, most of them related to un-portability.

  • name cases: Windows tends to ignore file casing while Linux is more sensitive. Had issues in DB table names (MySQL), file paths in xsl files referencing font files, …
  • non portable hardcoded defaults: OS specific File paths (/temp anyone?), use of default Locale or charset which affected XSL file reading and PDF generation
  • issues related to file encodings (some xsl files had lost their original encodings). As it is not possible to know for sure the encoding of a file, and as no documentation was available, I could only troubleshoot the problem at deployment time
  • bugs that trigger only on a particular OS (e.g. code executed inside an if block whose condition doesn’t evaluate on the original server but does on the new one)
  • JBoss behaving differently on the new server. The code was incorrect anyway as it was using Exception handling for flow management (ignoring a javax.ejb.NoSuchObjectLocalException…). I haven’t found the exact reason for the different behavior, but I suspect a different JDBC driver version or different DB version. The problem was solved by removing dirty data from the DB which caused the original exception to not be thrown anymore
  • Database specific bugs: the DB I was using on my Linux development machine had a bug that was particular to the distribution I was using, so I’ve had to get the DB server from the vendor site instead. Talk about luck.
  • Oh and did I mention that I didn’t get the code matching the version of the software running on the production server?

Things that could have gone wrong but didn’t (so far):

  • lack of logs. log4j was already used in the application
  • OS or JRE specifc bugs but I guess I was lucky ;)
  • fact that I could have had to deploy the application on an already existing application server. I didn’t have so I was able to solve some of the issues by tuning the machine environment instead of changing the code

All these problems would have been mitigated if the code had come with:

  • proper documentation
  • automated tests (unit and/or functional)

Things to think about when transfering an application

  • be sure that you’ve got the right version of the code
  • be sure to limit yourselve to transferring the application as is on the new server. Don’t try to change any of the components version. That’s obvious but you’ve been warned.
  • is the application documented ?
  • does it come with tests?
  • be sure to recognise the localisation settings: application, application server, VM, Operating System & preferences of the user running the application. That can be pretty messy. In fact, every application should dump as much information it has from its environment in the logs. Bare minimum are the system properties.
  • try to avoid changing the code to solve problems. If you do, see if you can redeploy and test the updated application on the current production server. You don’t want to go from server1-locked-down-code to server2-locked-down-code
  • be sure to not give an estimate before you have identified some of the potential problems listed above :)

update: it took me 10 days go make the migration + upgrade of some components. That includes things like setting up both my development workstation and the hosting server, documenting the installation and hosting config, fix the SQL install scripts (there were not up to date…), lose at least half a day due to the MySQL Ubuntu issue, learn the code sufficiently to identify the various problems, clean the DB from dirty data, add foreign keys to the DB, make a script to import the old DB backup onto the new server automatically (as the production server is still the old one, and we are in test phase), then upgrade various components on the new server (DB and DB driver, J2EE server, quartz version)… Upgrade has been smooth once the DB dirty state has been cleaned. I also implemented some automated tests using selenium during 2-3 hours, but that cover only a little part of the application. My (optimistic) goal was to use 5 days for it max. :)

Disclosed information on programming forums

October 3rd, 2006

In the past weeks I’ve had an increased interest in website security. The reason: I find that many developpers are not even aware of the basic techniques to provide a minimum level of security, in particular against SQL injections.

Identifying such a site is extremely easy. Fiddle with the POST or GET parameters of a request, get a failed request and you’ve probably found a candidate.

So in that process, I’ve found many sites that are not secure. Of course, I notified them or am in the process of doing it.

This will perhaps create me some problems, but as a professional in IT development I feel it is my duty to inform these sites of their problems, as well as make sure that my personal data is stored in a secure environment.

Finding unsecure sites can even be automated e.g. using google search API.

But a simple Google query can let you find much more, sometimes enough information to compromise the site right away. In particular in programming forums, some people tend to disclose way too much information. I’ll only give this example, because it points to (what appears to be) a defunct site. So looking at that page, we have (insecure) SQL query, DB structure information and site name. Bravo.

update: and google now makes it even easier to search for (bad) code

Licensing by intent

September 28th, 2006

There’s a raging debate today between the FSF and the Linux kernel developpers due to the upcoming release of the GPL v3 and the refuse of most developpers, including Linus Torvalds, to use it.

It seems that there are many things both camps got wrong (you can read more on Luis Villa’s blog, here, here and here).

FOSS licensing starts to be a mess. Here we have 2 groups with radically different reasons to use the same license. I think that most of it comes to down to interpretation and intent. Linus chose the GPLv2 at the time because it was the one that matched best its intent: to force a source code contributor to give back. It’s mostly a protection for developpers. But the FSF sees the GPL as its tool to enforce long term software freedom. It’s mostly a protection for users. When the FSF fears new things might affect user’s freedom (e.g. DRM), they have to adapt the license. The developpers feel the user’s freedom (i.e. the use of the software) is decoupled from the developpers freedom. So they don’t have to follow the licensing change proposal.

That’s why I like the Creative Commons set of licenses: because you chose them by intent.

If only the world was not made of people trying to abuse every situation, or use any corner case of a somewhat obsolete document, we wouldn’t need complex licenses and laws and would only rely on intent. But today, depending on lawyers and legal munjo jumbo is the best approximation that works. Fortunately (by all meanings of the word) for the members of the Bar…