Logo




Subscribe:
RSS 2.0 | Atom 1.0
Categories:

Sign In


[Giagnocavo]Michael::Write()

# Friday, December 10, 2004
Activision loses a good customer because of copyright protection

Bill writes about his bad experience with Activision. So, Activision loses a customer. Not only that, but they turn their real (and anti-piracy) customer to “illegal” methods of cracking their games. So, basically they're telling Bill that he's not valuable enough to offer a decent experience to, and that again, the pirates and cracking groups (always portrayed as evil thieves) are the only ones who can help him.

Misc. Technology
Friday, December 10, 2004 1:24:45 PM UTC  #    Comments [0]  |  Trackback

# Thursday, December 09, 2004
xsp init.d service script

I'm putting XSP into production this week (yey, right on time for Mono 1.0.5). For those who don't know, XSP is a lightweight ASP.NET webserver for Mono (.NET). I have a few webservices that need to run on Linux, and XSP seemed like the easiest way to do it.

One of the things I ran across was how to start up XSP automatically. I'm not that familiar with Linux yet, so I wasn't sure how to go about it. The only site I found with anything on it is here, but it didn't work correctly (shutdown) for me. So after playing around with other scripts made for mod_mono (didn't work), I decided to figure out how init.d scripts work. After a bit of learning and lots of copy and paste from the other init.d files, I came up with the following. I'm pretty sure it's not that great, so please correct me.

Steps: 
  1 - Create /etc/init.d/xsp and paste the contents in (from below). Be sure the permissions are right (chmod 755 /etc/init.d/xsp).
  2 - Create /etc/xsp.conf and add the command-line args. Example:
            --port 8080 --root /path/to/site/
  3 - Run chkconfig --add chkconfig
  4 - service xsp start

/etc/init.d/xsp:
#!/bin/bash
#
# Startup script for xsp server
#
# chkconfig: 3 84 16
# description: xsp is a asp.net server
#
 
ARGS=`cat /etc/xsp.conf | grep -v \# `

. /etc/init.d/functions

start() {
 echo -n $"Starting xsp: "
 
 # Check PID/existence
 pid=""
 if [ -f /var/run/xsp.pid ] ; then
         read pid < /var/run/xsp.pid
         if [ -n "$pid" ]; then
   rm /var/run/xsp.pid
  else
   echo -n $"xsp is already running."
   failure
   echo
   return 1
         fi
 fi

 mono /usr/bin/xsp.exe --nonstop $ARGS > /dev/null &
 RETVAL=$?
 if [ $RETVAL != 0 ]; then
  failure
  echo
  return $RETVAL
  fi
 PID=$!
 echo $PID > /var/run/xsp.pid
 success
 echo
 return 0

stop() {
 echo -n $"Shutting down xsp: "

 if [ ! -f /var/run/xsp.pid ]; then
  echo -n $"xsp not running"
  failure
  echo
  return 1
 fi

 kill -15 `cat /var/run/xsp.pid`
 RETVAL=$?

 if [ $RETVAL = 0 ]; then
  rm /var/run/xsp.pid
  success
  echo
  return 0
 else
  failure
  echo
  return $RETVAL
 fi 

restart() {
 stop
 start


case "$1" in
  start)
   start
 ;;
  stop)
   stop
 ;;
  restart)
   restart
 ;;
  *)
 echo $"Usage: $0 {start|stop|restart}"
 exit 1
esac

exit $?

Code
Thursday, December 09, 2004 6:33:30 AM UTC  #    Comments [1]  |  Trackback

# Wednesday, December 08, 2004
Running Windows as non-admin, Gnome style

MVP Valery just wrote a cool little utility to assist people running as non-admin. A little key icon that sits in your notification area, and allows you to escalate your privs. Similar (in some ways) to how Gnome handles running admin things. Very nice.

Security
Wednesday, December 08, 2004 12:19:10 PM UTC  #    Comments [0]  |  Trackback

# Monday, December 06, 2004
Console.ContentType

I think this is a joke, but it looks like a somewhat serious question. If so, this guy is an idiot. And not just a common idiot, but a truly moronic person who shouldn't be allowed near a computer. Thank you, www.thedailywtf.com.

Humour
Monday, December 06, 2004 2:21:38 AM UTC  #    Comments [2]  |  Trackback

# Sunday, December 05, 2004
Now my brother is blogging too

My brother Alan (the same one doing Christmas gifts for orphans in Guatemala) now has his own blog at MSN Spaces: http://spaces.msn.com/members/alang/ -- cool! He also has his own photo site at www.photoartgallery.net, and I must admit, he's doing a great job. He's got some great pictures of Guatemala too, so go ahead and check it out.

Misc
Sunday, December 05, 2004 2:28:43 PM UTC  #    Comments [0]  |  Trackback

The coolest new blog on MSN Spaces: Jana Carter
Get ready to subscribe to the coolest new blog. Yep, the Royal Chat Queen, the most powerful woman in chat business, Jana Tsering Neve' "Don't ASL Me" Carter herself is blogging: Jana Carter. Everyone on Earth[1] had been asking her to start a blog for many years, but I guess it took MSN Spaces to finally convince her. For those of you who don't know who Jana Carter is, she's a PM at MSFT. More specifically, she's responsible for the cool new Chat 2.0 client that MSDN and others use. She is the one that liberated us from MSN Chat and it's evil ActiveX control.

[1] Actually, I don't have any data on how many people asked her to start a blog. So I asked a few things in the room, discarded null answers (the teapot refused to answer) and extrapolated the results.
Misc
Sunday, December 05, 2004 4:23:08 AM UTC  #    Comments [0]  |  Trackback

# Friday, December 03, 2004
Are C# and VS2005 that good?

Today I was in a chat with some members of the C# team. Usually, I can go on an on about how the product can be improved. But today, apart from some questions, I really couldn't think of anything great to ask. I use VS2005 all day for all my projects, and it is so much better than VS 7.

Things just rock, and as far as I know, all my major complaints have been fixed or will be fixed. This might not be true, and perhaps I throw a fit when Beta 2 drops :). But seeing that MS has done huge changes and 180s (i.e., C# E-n-C, data diagrams), I feel pretty confident that I'll be exceendingly pleased.

Code
Friday, December 03, 2004 12:46:04 AM UTC  #    Comments [0]  |  Trackback

# Thursday, December 02, 2004
Are kids these days really so helpless?

I came across this program, called “Hector Protector”, created by the NetSafe Programme of New Zealand. It's to “help keep kids safe online”. What does this program actually do? It puts an image of a dolphin on-screen. Kids who run into materials that frighten them should click the dolphin. At that point, a congratulations message and picture of a dolphin fill the screen, protecting the poor child. The idea is that kids can do this and then run and find their parents or teacher to help them with the bad things on the computer.

Are kids these days really so helpless that they need a bloody dedicated program just to hide a window? I've been using computers since before I can remember. I never needed a system to hide stuff from me. I was on BBSs since I was 8 or 9 or something. Hell, when I was 13, my friend and I ran a BBS, complete with an “elite” section of programs, images, etc. He even worked as a sysop for other places, checking out all uploads and adding descriptions. He didn't need a stupid program to keep him safe. Why is it that kids now have turned into (or people think they are) such wussies when it comes to computers and networks?

Also, what's wrong with “If you see something wrong, minimize the window and go get help.”? Are kids going into such a bloody panic they need a damn dolphin there to click on? They're so offended and frightened they can't hit the minimize button? Also seems like a missed opportunity to teach keyboard shortcuts (say, Win+D). Or, what's wrong with just standing up and going to get help?

I'm not against helping kids deal with things. But technology isn't the answer. That's what parents and teachers are there for. Providing crutches like this? Please.

And... what happens when kids stuble across bad animations of Hector doing things he shouldn't? Won't this confuse and scar kids even more? Or what happens if kids happen to stumble upon some dolphin + redhead footage? Just think how many kids' lives are been wrecked by trusting hector, only to find he scares them later!

Misc. Technology | Security
Thursday, December 02, 2004 5:01:34 PM UTC  #    Comments [1]  |  Trackback

MSN Messenger 7: Made for 13-year-old AOL kiddies

MSN just released a beta of MSN Messenger 7. I got it ASAP, installed and rebooted. I was really hopeful that there'd be some nice new features. Instead, I found that the MSN folks decided to take all the lameness of Yahoo messenger, and up it a notch.

First, the actually cool stuff, to get it out of the way:
  More ink support. Now there are tabs when you send a message, switching between “Handwrite” and “Type”. I don't use ink, so not that cool. Can't find out how to disable it. So it just adds more clutter (a recurring theme), but when I get a tablet, I'm sure I'll love it.

  Message history. Here's an awesome feature. In fact, probably the coolest thing about the new client. When you start a new conversation, it shows you the last few lines of conversation. That'll save a lot of “oh damn, I closed the window” problems.

  Nudges. Actually, I don't know what this is. I THINK it's a way to make the window beep or move or something to draw people's attention. Has the possibility to be helpful, and unlike many other features, can be easily disabled.

OK, and that does it for the useful new features. Now, lets turn to all the load of crap they crammed into the new client:

  Winks. There's winks here and there. There's even a “My Winks” option, which sounds like some kind of gay porn thing. And what is this? Stupid animations that take over the window and annoy the heck out of everyone except 13-year-old girls. Fortunately, reception of them can be disabled. BUT, you still get a whole ~50 pixels devoted to this feature in every IM window. 

  More clutter. Almost every feature is now cluttered with junk. The emoticon window, for instance, now has a “What's Hot” section, featuring random sets of ugly icons. “Packs”. Now, in EVERY IM window, you have another ~50px devoted to downloading new packs of backgrounds, display pictures and icons. This should be in the options or main window, not each conversation window. A “Click here to customize MSN Messenger” link that takes you to an MSN page, and again, something that belongs inside the main window, not each conversation. Sigh. “Get over it, you don't need to use those things!“ people might say. That's not the point. Up until now, MSN Messenger was a clean, slick, useful tool. Now the UI is busy with all sorts of junk. It's visually annoying.

  “Billing Information”. At first I got scared, thinking everything was going to be charged. But it doesn't seem that way. Instead, you have Blue Mountain (the people who sued MS over Outlook Express's Junk Mail feature and got it removed from the product), selling you... you guessed it: More useless icons and pictures for MSN Messenger. Wow! As if the free stuff wasn't craptastic enough, now you get the pleasure of paying for lame icons.

Finally, all the usefull stuff they still haven't done:

 Sign in with status. You still can't sign in as away or so on.

 Status for group or contact. AFAIK, there's no way to appear as Offline or Away to a certain group, while Online to others. 

 Search history. Self explanatory.

So, I guess in MSN (which is at least as strange as marketing divisions), features that appealed to 13-year-olds, infants, and lemmings, were rated as more important than improveing usability or usefulness of the product. The only excuse I see is “MSN Messenger is for l4m3rz and for serious people you should get Istanbul and LCS and whatever integration product MS sees fit.” I suppose you get what you pay for. I hope Microsoft aquires MSN and fixes their products.

Anyways, I'm going to uninstall this thing now. I just hope they don't try a protocol switch and forced upgrade anytime soon.

Misc. Technology
Thursday, December 02, 2004 4:34:08 PM UTC  #    Comments [3]  |  Trackback

Security FUD: Internet Security Foundation

Security sells quite now, and lots of companies like to cash in by making up fake security threats, and then selling a “solution“. One such company is the “Internet Security Foundation“ which is just a clever marketing name for “Some Lame Company Trying to Sell Free Tools“.

When you goto the site (InternetSecurityFoundation.org), they make a big deal and a fake security alert from Sept. 2004 that you can see the text in a textbox, even if Windows renders it as asterisks. Anyone who programs understands this. These people pretend it's some kind of new threat and that terrorists are using it over the Internet to rob bank acounts. What a load of crap!

Why do they do this? They want to sell you “SeePassword“ (SeePassword.com), a $20 utility to do the same thing as the free Glow Password Recovery Util (download: Glow.exe (14.5 KB)) -- or similar programs, which have been around for YEARS.

The REAL issue lies in each individual program passing around passwords in plaintext. If a password is sitting in a user's memory space, in plain text, then why is it a surprise that it can be seen? Oh wait, it's not a surprise. This company is just using security for marketing.

Oh, and interesting info on their domain name registration. Perhaps I shall give them a call.

Registrant:
   KMGI Corp.
   119 72 St., 339
   New York, New York 10023
   United States

   Registered through: GoDaddy.com (http://www.godaddy.com)
   Domain Name: INTERNETSECURITYFOUNDATION.ORG
      Created on: 29-Oct-04
      Expires on: 29-Oct-05
      Last Updated on: 29-Oct-04

   Administrative Contact:
      Corp., KMGI  ak@kmgi.com
      119 72 St., 339
      New York, New York 10023
      United States
      17032427114      Fax -- 12122024982
   Technical Contact:
      Corp., KMGI  ak@kmgi.com
      119 72 St., 339
      New York, New York 10023
      United States
      17032427114      Fax -- 12122024982

   Domain servers in listed order:
      NS2.KMGI.BIZ
      NS3.KMGI.BIZ

Edit: Fix .com to .org (Although both appeared to be registered by the same thing).

Security
Thursday, December 02, 2004 1:04:21 AM UTC  #    Comments [2]  |  Trackback

# Wednesday, December 01, 2004
Interesting Nmap result
I just scanned my XP machine to ensure the firewall was working correctly. Nmap detected an interesting OS:

Running: IBM AIX 4.X, Microsoft Windows 2003/.NET
OS details: IBM AIX 4.3.2.0-4.3.3.0 on an IBM RS/*, Microsoft Windows Server 2003

Now THAT'S what I call integration.

BTW.... is it just me, or does Nmap really work much better under Linux? Especially when aborting a scan: Ctrl-C on Windows takes a while (same as with Telnet), while under Linux it exits immediately.
Humour
Wednesday, December 01, 2004 4:17:40 AM UTC  #    Comments [0]  |  Trackback

# Monday, November 29, 2004
Convergence Communications (Cybernet) Guatemala doesn't know how to route IPs; says IANA and ARIN are wrong

Well, today Convergence (Cybernet) in Guatemala installed my cable line. They use a REALLY OLD Zenith modem. At first, they could not configure it, since it requires, get this, a Win3.0 program (ZUDUSR.EXE) to configure. Plus, they have to connect via serial using this old Win16 program. So, they had to go out somewhere else, configure the box, and bring it here.

Well, they assigned me this IP: 192.10.18.76, telling me it was a public IP with no filters at all. It struck me odd they'd have a class B assigned to them, especially 192.10.0.0/16. So, I called support.

He tells me, “Oh, you have a private IP.” I said that 192.10.18.76 was not private and actually fully routable. He disagrees and says that 192.* is private. I'm sure people who own other IPs in that netblock would be surprised to hear this.

So, it turns out Convergence is using else's (Symbolics, Inc.) netblock for now reason, other than that they are clueless. He says it's perfectly correct to route like this. I think ARIN and IANA might beg to differ. So I'm going to send him to ARIN's whois, so he can see for himself that he's 100% incorrect. My past experience with Convergence / Cybernet was pretty much the same: utterly clueless people for the most part.

Oh, and they filter ICMP, for reasons unknown. My guess is to prevent customers from easily seeing how bad their lag / packet loss is. Sigh... why is so hard to find people here who know what they're doing? As if basic TCP/IP routing was so incredibly difficult...

Guatemala
Monday, November 29, 2004 7:58:37 PM UTC  #    Comments [5]  |  Trackback

# Sunday, November 28, 2004
Cracking Code 4: Replacing a strong name

In my last article, someone commented that editing an assembly would create a problem if the assembly is strong named. They are correct. If an assembly has a strong name and is tampered with, you'll get a System.IO.FileLoadException: Strong name validation failed for assembly <foo>.

Strong names are to identify an assembly. They are "strong" because the identification is provided with cryptographic means, rather than just the name of the file. The system is designed to ensure the assembly is what it claims to be, and public key cryptography proves it. Against malicious people, it can ensure someone can't drop an assembly signed with one of your trusted publisher's keys and get you to trust their assembly more than you should. It's NOT meant to be a way to stop people from editing and running assemblies on their own machine.

I was hoping there was a simple way to replace the strong name on an assembly, but I don't believe there is. Then again, there's a LOT of stuff that ships with .NET, so perhaps I just overlooked it. If so, let me know. At any rate, I wrote a tiny program to replace the strong name on an assembly. Let me explain it.

Somewhere in the assembly, a public key is provided (otherwise the runtime wouldn't know what to verify against!). Then, there is a hash of the assembly, and the hash is signed with the private key. When the assembly is modified, the hash will change, the signature will no longer match and the runtime will refuse to load the assembly. A cracker usually won't have access to the private key, and thus can't resign. However, one can simply replace the public key in the assembly with our own public key, and resign using our own private key. Problem solved.

A quick word to those who are thinking "Can't I just use SN -Vu to skip verification checking?". No, this doesn't work. Verification skipping only applies to partially (delay signed) assemblies, not to fully signed assemblies. If you somehow manage to get verification skipping working on fully signed assemblies, I'd love to know.

My program is a very simple tool with nothing amazing in it (except for a very slow search algorithm). All it does is take an assembly and a keyfile, replace the public key, and call SN -R <assembly> <keyfile> to resign. Here's how you'd use it:

1. Take Some.exe, a strongly named assembly. Modify it.
2. Note that attempting to load Some.exe will fail.
3. Create a new keyfile by running "SN -k mykey.snk". (SN is the StrongName utility that ships with the .NET Framework SDK).
4. Ensure you have the .NET Framework SDK (bin) in your path.
5. Change the public key and resign via "SNReplace Some.exe mykey.snk".

That's all. You can run "SN -Tp Some.exe" before and after to see that the public key has indeed changed. "SN -v Some.exe" will verify things are in order.

Download: SNReplace.exe (16 KB) Source: SNReplace.cs.txt (2.72 KB)
Code | Security
Sunday, November 28, 2004 7:20:21 AM UTC  #    Comments [12]  |  Trackback

# Friday, November 26, 2004
Flaime bait: A new exception in Whidbey for VB devs
http://weblogs.asp.net/wallym/archive/2004/11/25/270521.aspx

The coolest thing about this new Whidbey exception model is that the IDE actually throws exceptions *about your code* at design-time instead of runtime.

Humour
Friday, November 26, 2004 8:58:05 PM UTC  #    Comments [1]  |  Trackback

Telgua ADSL: Turbonett -- really sucks

Isn't this fun? I ordered ADSL from Telgua (Turbonett -- their marketing people are morons, yes) at a price of $229 a month for 512k. Ridiculous. Even more crazy is that now, 2 months later, they haven't installed the service. Also, since Telgua moves your phone line over to the Turbonett people, now my phone line doesn't work either. Every call to them, including talking to manager ends with some silly statement about how the technical people don't have phones, so you can't call them. I asked the guy if I should just cancel my phone and switch companies and he said “yea, you're right.” I'm supposedly getting some cable Internet today, so we'll see how that works out.

Personal
Friday, November 26, 2004 8:49:42 PM UTC  #    Comments [2]  |  Trackback