I’ve recently learned that the companies that make these products have, after literally decades of knowingly shipping insecure products, begun to respond to the challenge and actually build a safer product. Master Lock, in particular, has released what they call “bump stop” technology, with a specially crafted pin that makes lock bumping difficult if not impossible. Here’s a YouTube video describing the technology.

At the moment, this type of lock is difficult to obtain for residential use; and while technology rarely ever works as well as the manufacturer claims, the important thing here is that bump resistance has become one of the metrics by which the security of a lock is measured, and products are already available to some consumers that address this threat. In short, it we’re at least on the right track.

And now, on with the original article.

It Worked

I recently saw a report on bump keying and how it, in theory at least, makes pin-and-tumbler locks useless. I was a bit skeptical, so I decided to try it out.

Using nothing but the little information I had gained through some Internet searches and You Tube videos, I took an old, unused key, filed it down to the appropriate shape, and tried it in my front door.

It worked first try.

This is serious. Though I’ve been taught how to pick locks, I’ve never successfully opened anything other than a simple desk drawer lock. With this one bump key, I can open about 40% of the locks I encounter in my day-to-day activities. A second key gets will open another 30% of the locks I encounter in a day, and between the two of them, I can open nearly every residential lock I’ve ever seen. This has very serious implications in the world of home security.

Making a bump key is trivially easy, and costs about $4 to do (or free if you already have an old key and a file). It’s not a new technology, and has been used for a few years no by criminals to break into house without leaving obvious signs of forced entry.

Burying Our Heads in the Sand

Continuing to keep this technique hidden from the public is not serving our best interests. The more expensive locks you can buy at the hardware store are expensive because they’re more difficult to open with a lock pick. Those same locks, though, can be opened in under 10 seconds by a bump key; often, the more expensive the lock, the easier it is to open. Everybody knows about lock picking, so lock makers build locks resistant to that technique. Very few people have heard of bump keying, so lock makers don’t bother to make bump-resistant locks. (There’s good reason for them to drag their feet; bump keying is a very, very difficult technique to guard against without radical changes to the way keys and locks work).

Nonetheless, the problem is here, it’s serious, and it’s not going away. Our only hope for any sort security is to force lock makers to start selling bump-resistant locks. They’ll do that only when the general public finds out that they’re being sold snake oil, not security. Our only hope is raising awareness.

To that end, I’ve created a simple video showing the basics of how to create and use your own bump key. All you need is an old key and a file to cut it with. You’ll be opening doors within an hour.

http://www.youtube.com/watch?v=pwTVBWCijEQ

Refinement

I’m no expert at this. Not at lock picking, not at bump keying, not at anything I’ve talked about here. However, I know who is. Check out www.toool.nl/bumping.pdf for some refinements on this technique.

In particular, their “Minimal Movement” technique caught my attention. I was surprised to find that the directions in the referenced PDF file were all I needed to make that technique work. Unfortunately, in my zeal to create the most efficient bump key, I managed to file away too much and ruin the key.

However, and this is the point, making a new bump key is so easy that there’s really no way to guard against it. You can’t control through legislation any more than you can control lock picks (I’ve seen a lock picked with a screwdriver and a paperclip–you can’t outlaw that!).

So try it out, tell your friends. This is an interesting skill that you can master in just a couple of hours, and a great way to impress strangers at parties. More importantly, when word finally gets out that everybody knows how to bump locks, lock makers will have to respond with better security.

Update

I’ve recently added a follow-up article to this one that answers a number of questions and gives further information about how you can protect yourself. The article is (unremarkably) entitled Bump Key Follow Up.

This one is largely an unfocused repository for whatever I happen to have to say at the moment. And while that was the original intention, it’s not an optimal solution. So, I’ve decided to break my writings up into the following categories:

• Technical articles – How-to’s, explanations, tips, etc. This will probably be the meat of my writings.
• Personal happenings – Sort of a family newsletter idea. Interesting to relatives and close friends; terribly uninteresting to everyone else.
• Snide Remarks – Political commentary, opinions, editorials, that sort of thing.

Perhaps there’s more to add, but that should be enought to get along with. I’m pretty sure I’ve got some interesting stuff to say, but one of my primary problems is that it never seems relevant to the subject of my blog… probably because my blog has no subject. Do my latest .NET coding tricks belong here? How about my musings about some bit of software I’ve been trying out? I don’t know.

I would like to have everything hosted on my site: it sure helps my search engine ratings–my personal website is actually ranked higher than my employer’s; higher than most people’s, for that matter (5 of 10 by Google), meaning that most of what I write about becomes “important” in web searches if it’s not too common a topic.

Since I’m going to be changing things around, I’d be interested to hear about alternatives for my blogging software. I’m using WordPress right now; It’s nice and all, but I would like a bit more direct control over the content formatting. Less like blogger, more like Slashdot, if that makes sense.

Wiki-based systems are somewhat attractive if you can make the paradigm work. WordPress is always an option. I expect that this may become my new homepage, so it should be highly customizable with minimal hacking.

More on this is probably to follow once I get more figured out.

I’ll, of course, continue to post content here, but please have a look at this new show and tell me what you think.

Show home page: http://techtrickspodcast.blogspot.com
Show RSS feed: http://techtricks.libsyn.com/rss

Confusion in the Task Manager

You notice that your computer is behaving as though it’s under heavy load, but you can’t find which application is hogging the CPU. You take a look at your task manager and see something like this. Look, in particular, at the areas that I circled:

Here, the process list shows that 7% of the CPU time is being taken by googletalk, while the remaining 93% is spent idle. Those numbers add up just fine. However, at the bottom, we see that 61% of the processor time is in use — that’s a whole lot more than 7%. So what’s using the other 54%?

I know some of you have seen this before and probably thought something devious was going on. Could it be a virus? Perhaps spyware? I’m sure you’ve heard about rootkits–programs that hide their existence from the user. Could this perhaps be a sign of a rootkit?

Well, the reality is a whole lot less exciting. What we’re really dealing with here is bad reporting. Once again, as in the case of the Sony rootkit fiasco, Mark Russinovich gives us the tools to see what’s really going on. One of his free utilities, Process Explorer, gives us a more accurate view than the built-in task manager. Have a look at the following screenshot, and look, in particular, at the first three processes listed. This screenshot was taken soon after the previous one, so the numbers won’t match.

This will all probably make a lot more sense with a bit of explanation…

Interrupts and DPCs

One of the primary responsibilities of the operating system is to schedule time for each process that requests use of the CPU. Most of a program’s run time is spent waiting–waiting for you to type something, waiting for a file to open, that kind of thing. When a program is ready to do something, the operating system schedules it a time slot. Yet even on computers with over a hundred processes running, most of the time there isn’t any process that’s ready to run. The OS schedules this left-over time to process number zero, the “Idle” process. This special-purpose process sends the CPU a HALT instruction that tells the CPU to go into low-power mode and wait for something to happen (like a keypress, for example).

So, we’ve got X number of programs running, plus process number zero, the “Idle” process. Between these, we can account for all the time that’s allocated by the process scheduler. However, this isn’t necessarily all of the time that gets used by the CPU. The OS kernel itself also uses CPU time, but it doesn’t ever have to wait in line for the scheduler. This code, which is usually hardware drivers (like for your video card), runs under a totally different set of rules.

Kernel CPU time is, for the most part, divided into two categories: time spent on interrupts, and time spent on Deferred Procedure Calls (DPCs). These are really two heads of the same beast; the distinction comes from what kind of code you’re dealing with and exactly when that code has to run. The important point is that interrupts and DPCs aren’t part of the normal process schedule, but do take up (some times significant) CPU time.

So, what we saw in the first screenshot was the result of the fact that DPC and interrupt time isn’t reported by Task Manager. At the time of the screenshot, about 58% of the CPU time was being taken by DPCs and interrupts, leaving about 42% of the CPU time for the scheduler to use as necessary. Of that remaining 42% which the scheduler had to work with, 93% went unused and 7% went to googletalk. Some quick math (42% x 93%) tells us that the real time spent idle was only 39%. Googletalk only used 3% of the total CPU time, which was 7% of the time allocated to the scheduler.

Confused yet? Well, here’s the executive summary: Windows’ built-in Task Manager does a poor job at reporting CPU usage because it doesn’t directly report the time that is used by the Windows kernel (drivers in particular). The per-process percentages are actually calculated based on the remaining time after the drivers have already taken their piece of the pie. This can lead to boatloads of confusion when trying to diagnose a problem, particularly when the real culprit is a driver. Process Explorer by Sysinternals does report DPC and interrupt time, thus bringing balance back to the universe.

If you want to find out more about DPCs, interrupts, and Windows process scheduling, check out Chapter 3 of the book Microsoft Windows Internals.

Like most of us, I suppose, I run into a lot of web content that seems really interesting, but I often don’t care to read it at the moment. Perhaps I’m looking for something else, or perhaps it explains how to do something that I’m not working on right now. So that’s what bookmarks are for, right? That may be, but it hasn’t worked too well for me. I’ve been disappointed with my bookmark setup for a few crucial reasons.

The first is portability. I use at least 3 computers regularly, and what I bookmark here I want to be available anywhere. Using a bookmark service like Delicious solves that problem; but it also introduces my other problem: ease-of-use. Delicious is, in fact, about as easy to use as they could possibly make the site. But I want something that no website can offer; I don’t want to have to go to their website. I want complete browser integration, like my bookmarks toolbar. I decided that the only solution was to write an extension to integrate Delicious bookmarks directly into Firefox. Then I observed–quite correctly–that I was far too lazy to do that. And then, and this is the cool part, I realized that Delicious and Firefox developers had already done the hard work; I just have to “turn on” the existing capability.

So, there’s the background; here’s the solution. This solution only works with Firefox, not Internet Explorer. It almost works with the new IE version 7, but Microsoft unfortunately left out some very critical pieces in their implementation.

Delicious will serve up your bookmarks either on their website, or in handy RSS form. This works very well with Firefox’s RSS bookmark feture, allowing you to put a “Folder” of Delicious-served bookmarks right into your normal bookmarks collection, anywhere you might otherwise display your own browser-served bookmarks. That includes my old friend, the bookmarks toobar. So, here’s what you do.

Go to your Delicious account (or Delirious — same exact concept, but open-source), select a tag you want to add as a bookmark folder. (Did I explain that these “bookmark folders” are actually the tags you already use? Well, they are.) Now, do you see the little orange RSS icon in the address bar? It looks like this: . Click it.

When you click you get a drop-down list of RSS feeds to use. You want the feed of bookmarks, not the feed of tags. It will then ask you where to put the “live bookmark” and what to call it. You can pick whatever you want, but I’d suggest calling it something short (like the name of the tag) and creating it in the bookmarks toolbar folder. Go ahead and repeat that process of all the other tags you want quick access to. What you end up with is something that looks quite a bit like this:

Of course, there’s no rule that says you can only use your bookmarks. It works just as well with anybody’s bookmark collection. If you want to, you can create a normal bookmark folder (even on the bookmarks toolbar) and put any or all of your “live” bookmarks folders inside it. If you have a lot of computers to do this on, you can get one set up and then copy your “bookmarks.html” file to the others. If you want to do that but you have no idea what I’m talking about, contact me and I’ll walk you through it.

Finally, you’ll need an easy way to add bookmarks to Delicious. You may already know about this, but Firefox supports javascript bookmarks that actually do something. Delicious has taken advantage of this fact and created a bookmark you can add to your toolbar that adds the site you’re looking at to your bookmarks collection. Go to http://del.icio.us/help/ffbuttons to get instructions for installing the bookmark buttons.

One limitation that I haven’t addressed yet is that each live bookmark collection only uses a single Delicious tag. This means that you may want to have a few tags that you use specifically for classifying bookmarks in your browser’s collection. Since Delicious lets you specify any number of tags for a given entry, that’s not a problem. Also, the other RSS feed that we didn’t use, the feed of tags, is one that lists your Delicious tags rather than bookmark entries. This drops you off on the tag’s Delicious page. This may be useful to you if you use a LOT of tags, of you want to link to someone else’s tags collection. Another limitation is the number of bookmarks it will display under one tag. On my browser, it will display the top 31 and clip the rest–the others just don’t fit on the screen. If you have more than that, perhaps you’ll want to consider a more fine-grain classification system. There is no limit (that I’ve seen) on the number of RSS bookmark folders you can create, so go ahead and create as many as you deem necessary.

I hope these ideas help you make better use of your bookmarks collection. If you’re part of that unwashed 90% who still use IE instead of Firefox, perhaps this will give you one more reason to upgrade to Firefox. Give it a try and you probably won’t go back.

The world is not so simple anymore.

Guiding Principles

The truth is, a dictatorship, if run correctly, has the power to beat the pants off a capitalist democracy in every arena. However, in past history, dictators always (overgeneralization, I know) acted in their own immediate self-interest at the expense, and eventual destruction, of the country they run.

Capitalism and democracy solve that problem–a capitalist society acts in its own financial self-interest, while a democratic society acts in its own social self interest, which luckily both actually serve the greater good. However, there’s one serious caveat — a rare condition that can destabilize these systems and make them behave like a poorly run dictatorship. The problem, as you know if you’ve studied economics, is any artificial centralization of power. For example, The Monopoly.

Economic Destabilization

In a capitalist society, each individual entity acts in its own self-interest, attempting to strike some optimum balance where its own return on its investments is at a peak. As luck would have it, when each individual component is working at its peak performance, the economy as a whole is also at a peak. The market automagically adjusts to meet supply and demand changes, and competition drives the innovation required to find new ways of meeting demand while spending less. It’s as though, as Adam Smith put it, an “Invisible Hand” is guiding the market to its optimal performance.

This all assumes, however, that the individual entities always act in their own self-interest, and without interfering with the actions of others. Adding a monopoly to the mix changes all that. If one single player can directly manipulate supply or demand (like a monopoly can), he can force other entities to act in his self-interest, rather than their own. This creates a sub-optimal situation that may not always be obvious.

For example, our most recent American monopoly, Microsoft, has been using is position to control the market to a degree not generally within the bounds of a capitalist environment. For example, nearly all computers sold in this country come with Microsoft’s software pre-installed. You pay for it, of course. Usually, Windows accounts for $60 to $200 of your computer’s purchase price. And at current prices, that could account for a third of the computer’s cost. There are alternatives, of course. Linux, for example, can be had for as low a price as free, and its main hindrance to widespread adoption is its lack of popularity. In fact, nearly every piece of software you’ve ever used has a free alternative that closely rivals (or even exceeds) its commercial counterparts in quality.

Microsoft, however, using its monopolistic influence often takes the choice out of your hands. That copy of Windows running on your computer–how much did you pay for it? You don’t know? Free? No, it wasn’t free. But you didn’t see the price tag, either. Microsoft struck a deal with the maker of your computer (Dell, IBM, Sony, etc.) allowing them to sell your copy of Windows closer to the $60 range instead of the standard $200 price in exchange for an agreement which forces that manufacturer to sell a copy of Windows with every computer they sell–effectively taking that purchasing decision out of your hands. A single company has been allowed to directly manipulate both supply and demand on a few different fronts, resulting in a broken market. Adam Smith sighs resignedly in his grave.

Well, fool me once… and I’m not going to get fooled again: Such acts by monopolies are now illegal in this country. Microsoft went to trial for this very thing, and interestingly enough, the very companies they were influencing, the hardware manufacturers, actually came out in the company’s defense. As history later showed, this hold–the preinstalled software pricing deal–which allowed Microsoft to dictate what the manufacturer would sell, was also used to force these manufacturers to testify in court in Microsoft’s defense–falsely if necessary.

Social Destabilization

These events lead us to the other half of our discussion, the social effects. In a democracy, each citizen is a well-informed active participant in all matters of governance. He votes in his own self-interest, and the society as a whole progresses in what could be considered an ideal situation.

We don’t live in a democracy.

No one does. To use a computing term, democracy doesn’t “scale”. The more members you add, the less effective the system becomes. A system where half a billion citizens spend a good part of their day discussing legal issues and voting on bills would collapse under its own weight. The real truth behind issues presented would rarely be understood, the only decisions that actually get made would have to be pushed through by a “man on a white horse” who mobilizes the masses based on his own propaganda. Democracies of any real size don’t work–it’s just not an option.

We, along with our “democratic” neighbors, live in a Representative Republic. We elect representatives whom vote on our behalf. Your opinion on real-life issues only matters to the extent that it affects whom you vote for. Beyond that, your own views are quite irrelevant to the direction our society takes.

Real governing power is concentrated in the few elected officials who actually direct public policy. If an organization can convince enough elected officials that it’s in their best interest to act in the interest of the organization, then they’ve effectively wrested control of the government out of the people’s hands. If the issues in question are minor (or difficult-to-understand) enough as to not attract too much public attention, any policy decision can be effectively influenced by those with enough political clout. This is, of course, the “Iron Triangle” you heard about when studying government. Bureaucrats, politicians, and special interests run the country. You just think you do.

Companies like Microsoft can then effectively use the legal and legislative system to avoid any social repercussions to their tampering with the economic side of things. You’re the one who gets hurt, but you didn’t get to vote on that decision.

Enter China, Stage Left

This is where the dictatorship comes into play. China still wants to take over the world. Recent history has shown, however, that the most effective way to do so is through economic strategies, not through military conquest.

The societies in Eastern Civilization tend treat authority with a higher degree of importance than their Western counterparts, which leads to a more stable social situation. The success of an Eastern empire is measured in millennia–years are just milestones. It’s not uncommon for an Eastern company to have a 10-year, 50-year, or even 100-year plan on the books.

The current Chinese government is no different. World domination is what they’re after, and they’re willing to wait if that’s what it takes. The government is free to make whatever decisions are required to make that happen without having deal with the requests of special interests.

For example, China is one of the world’s leading consumers of Nuclear Energy research, promising the largest deployment of pebble bed reactors in the world in a time when building nuclear reactors is taboo among countries with an active environmentalist contingent. The fact is, China needs electricity. These reactors are cheap, absolutely safe, low-maintenance, and more environmentally friendly than their conventional counterparts.

The Global Market

One point that makes the current situation different than that of centuries past is an awareness of the global scale of our opportunities. China had found, for example, that it could artificially tie their own currency to the American dollar, thereby assuring that labor and materials in China were always the cheapest no matter what happened to exchange rates–thus guaranteeing the availability of an export market. Export markets are, in fact, the mainstay of Chinese technology production, where supply far outstrips internal demand. And Chinese companies are always looking for ways to better compete on cost; an area where China excels in comparison to other countries where workers’ unions are all too willing to trade a job’s viability for short-term benefits.

The Future of Technology

And that brings us back to our discussion on software pricing. China has the resources and the motivation to produce computers and computer parts at costs below the global average, and its capability is increasing as time goes by. The Chinese government has already publicly eschewed Microsoft and everything they stand for. China has even gone as far as to create its own Linux distribution: Red Flag Linux. This platform has already been adopted by all levels of Chinese operations, from government offices to insurance companies to news media. In China, Microsoft has much less clout.

It’s only a matter of time before Eastern companies start selling large quantities of very-low-cost computer systems to Western consumers. It’s all part of the game plan. The software is free; the hardware is cheap. Here in the West, a small handful of very powerful companies is manipulating the market to their own advantage. The expense we pay is overpriced goods, stifled innovation, and the loss of market dominance.

The situation won’t last forever, of course. The market will recover. The monopolies will be rendered ineffective, and supply will once again balance out with demand. The bad news is that the American economy will no longer have a commanding role in global commerce.

Sooner or later, we’ll all have to learn to speak Chinese.

My self-assigned quest was to figure out exactly what was going wrong, and to do so in a non-destructive way. This involved attaching a serial cable to the modem’s circuit board and using it as a console to interactively diagnose the issue.

Some disassembly required. Some pictures provided.
http://www.tlarson.com/guides/dslhack

Thank heavens for competition. Our phone company was offering a 1-year promotion for $20/month. After the year is over, the price goes up to $25/month. I can live with that. Of course, you’re going to say, what about download speeds?

The cable company, with its massive bandwidth capacity, often advertises download rates that rival those business links that cost thousands of dollars per month. The catch, of course, is that business bandwidth is guaranteed, residental is not.

So in this rare opportunity where I have both DSL and Cable Internet access at the same time, on the same computer, I decided to conduct a scientific experiment. Using Speakeasy’s Speed Test, I did a few speed comparisons with each ISP. There was very little variation in the results; I’m not much one for statistics, but I’d guess a margin of error of about 2% or so.

A couple of points stand out here. First of all, DSL is hitting exactly 82% of its advertised speed both upload and download. That’s significant because general TCP/IP overhead counts for about 20% of your bandwith usage. That means that the DSL connection is actually delivering around 100% of its advertised bandwith.

Cable, on the otherhand, reaches a dismal 28% of its download capacity, and 56% of its upload. This test was conduced at 7pm local time, which is just after cable’s peak usage period. As you may know, total bandwidth is shared between everybody on your cable broadcast network, which is usually everybody in your immediate neighborhood. So while you may be able to get better download speeds in the middle of the night, what really counts is what you get when you’re actually using it.

Another interesting metric is price versus speed. For example, cable costs about 400% of the price of DSL (no promos), and gives you about a 136% of the speed. Conversely, DSL costs roughly 30% of what Cable costs, but gives you about 74% of the speed.

Also, the Cable provider is very protective of its bandwidth, since my usage cuts into other customers’ availablity. As such, certain methods of using your internet connection are prohibited; like for example, running any sort of server whatsoever from your home. As for DSL, it’s all the same to the phone company: whatever bandwidth you don’t use can’t be reallocated to someone else, so you might as well use it for whatever you want.

So, I dug through the javascript source code to find out how they do it. Obviously there’s some real deep magic involved, right? After all, some people pay a lot of money to use things like this on their web page.

So what did I find? Magic? No. It’s all built into the browser. Internet Explorer and and Mozilla-based browsers both have an “editable” mode that handles all the excitement. Microsoft calls their version The MSHTML Editing Platform, while Mozilla has a built-in module called Midas.

What you’re really paying for is that nifty toolbar that allows you to send commands to the browser that say “make this bold” or whatever. It seems almost dishonest for these vendors to brag about all the “features” they’ve included in their version (like “Fonts!”, “Sizes!”, and “Images!”), when it’s actually all provided as part of the browser… which the user already owns. Aw well, welcome to the world of Marketing.

Just for a heck of it, I created an editable version of my own homepage. It’s just the normal page, but with an extra line of JavaScript tacked on the end to turn on editing mode. Note that if you’re using a Mozilla-based browser (like Firefox), it seems to want to stay in editing mode even when you go to another page. You’ll have to close the current tab (or window) to get out of editing mode, since I don’t have a button on the page to turn it off.

Here’s an interesting essay describing a particular type of problem we often run into when maintaing other people’s work. There are certain decisions about a project which must be made, but which are not directly related to the technology or design of the underlying archetecture.

While this fact is entirely unremarkable, what is interesting are then various artifacts introduced by the mantenance of these decisions. The gist of the essay (though unstated) is that it’s import to understand the reasoning behind these “bridge color” decisions if the project is going to be properly maintained.

How to make high-gain antennas out of cheap cookware. These examples exhibit much better results than some of the more complicated models that were popular in the past.

Unix programmers like their code like the old legos. Each piece might be a different size or shape, but the bottom of one snaps onto the top of another and the ordering and number of pieces used is left as an excercise for the reader. With experience, anything can be built with the pieces, and yet each piece is simple and easy to understand.

Windows is like the new lego sets. You get specialized premolded parts suitable for one specific task, plus two or three additional add-on pieces that give the illusion of being fully configurable for any task. You can build anything you want with the new legos, as long as you only want to build what is on the cover of the package.

– Tsaingkun

So, how do you know a real find when you see one? Are there any criteria that you can use when screening potentials? Well, there’s no sure-fire way to pick a winner, but after working with many people in the industry, I’ve seen a few trends. What you’re looking for is someone who is mentally brilliant and enjoys working with computers because he enjoys learning new things. Wizards become so because the want to know how everything works, and are willing to do the research to figure it all out.

• Hobbies
  This one is really the key. What you want to know is what they enjoy doing. If a person is in the computer business because he’s smart and enjoys the mental challenge, his hobbies will often involve working with computers as well. If he’s in it just for the money, he probably would rather spend his free time water skiing.
• Programming ability
  If the person does not know how to program a computer, his knowledge of how to work the thing is severely limited. Furthermore, admins who can write programs can solve a problem in far less time than those who cannot. The ability to create your own tools as necessary is a key skill in serious admin work. Finally, programming is one of those skills that every computer genius naturally gravitates towards, while people “in it for the money” naturally shy away from it.
• Knowledge of Programming Languages
  If a person only learned to write computer programs to pass a class in school, his knowledge of programming languages will be limited to those he learned in class. On the other hand, an expert will find learning new languages extremely easy, and will likely be proficient in a good handful of them, while having just a few favorites.

  It is also significant which languages a person knows. While I can’t give an exhaustive list here, here’s some pointers:

  • C/C++: the lingua franca of computer programming. If a person doesn’t know C/C++, he really shouldn’t even be considered a programmer.
  • BASIC, VB: knowledge of BASIC and Visual BASIC counts for very little, but is better than nothing.
  • Java: while not terribly useful in most cases, java is a respectable programming language.
  • PHP: this language is used almost exclusively for web programming. Many people understand the basics of PHP programming, but few understand the deep details. PHP experts are often experts in other languages as well.
  • Perl: this language is extremely powerful and quite difficult to master. A serious Perl programmer is a force to be reckoned with. He can often solve problems many times more quickly than his peers.
• Linux/BSD Experience
  It’s been my experience that the smartest in the computer world naturally develop an interest in Linux (and/or BSD –a similar alternative). Linux provides an ideal environment for the curious computer user, as it allows the user to gain a much more in-depth understanding of the internal workings of the system. A deep understanding of Linux and other similar operating systems counts very strongly in a person’s favor, especially if he actually uses it on his own personal computer.
• Certifications
  This is a tricky one. Companies started offering tech-related certification exams for two reasons: First, and most importantly, the wanted to make a lot of money off the growing IT industry; and second, they wanted to establish a baseline level of knowledge for IT professionals. When push comes to shove, though, companies doing the certification (like Microsoft) would much rather make money than be useful. As such, certifications have sometimes degraded into something of a purchased diploma as the companies responsible have attempted to appeal to a much wider (and less capable) customer base.

  A certified professional is at least guaranteed to have memorized a bunch of facts about the technology he certified in. He’s not guaranteed, however, to be able to solve problems as difficult as, say, tying his shoes. It’s unfortunately very difficult to test problem-solving skills, while it’s very easy to test memorization. And, while certification exams test knowledge, it’s the ability to solve problems that makes a difference in the real world. A person with an IQ in the 130-140 range is worth an army of “certified professionals.” Some of the more intelligent and experienced techies actually refuse to take certification exams because they see it as insulting.

How about an explanation.

The problem is called a “memory leak.” The idea is that a computer program tells the operating system that it requires a chunk of RAM for something; but when its done, it never tells the operating system to take the RAM back. This leads to a situation where, over time, the program continually asks for more and more memory from the OS, and never gives it back. Eventually the resources are exhausted and the system crashes.

It seemed as though one of the programs I had written was exhibiting this very behavior. Over time, the program’s memory usage would slowly climb. And though it would take weeks of uninterrupted use before any definate pattern emerged, the symptoms were clear.

Now, as easy as it is to explain the problem, finding it is a different story. If it were a simple programming error, it could be easily isolated. But in this case, the basic operating logic is slightly different than expected. That is to say, while the program is behaving as expected, the environment in which it runs is different than previously thought; and factors that would otherwise have been harmless are causing the program to behave inapropriately.

So then, how do you isolate this sort of situation? How do you know which one of the thousands of assumptions you made is the one that isn’t holding true? There a technique called “profiling” that give you the data you need to make that determination. It involves keeping track of every time you allocate and deallocate every piece of memory you use. You keep track of which programming instruction asked for it, and when you said you’re done with it. In theory, over time the offending instruction will have asked for a disproportionate amount of the memory currently in use, and you can then see why that particular piece isn’t being given back. It’s a nifty idea, but it sure sounds like a lot of work.

That’s where profiling tools come in. These are tools that are designed to help you keep track of all this information, and more importantly, interpret the results. It’s a pretty tough tool to make, and options are in short supply. This sounds like a job for Google.

While I fully expected a Google search to direct me to a solution, I never thought the solution would be provided by Google itself. You heard that right. Google has a profiling tool. That much doesn’t come as a major surprise–they have plenty of reason to analyze the efficiency of the programs they write. But Google also recently made these tools available for the public. For free.

There’s a website: http://code.google.com, where Google gives away some of the code that they created as a gift to the software community. Most everything there is only of interest to programmers like me, but that’s not the point. The point is that they’re doing things for the right reason. They continue to use their resources to make life a little easier for the rest of us, and they ask nothing in return. They’ve made no attempt to capitalize on most of their creations. What they do get, however, is first prize in the industry’s popularity contest. It’s a bold strategy. So far, the system has served them well.

Contrast that with the business practices of other companies in the computer field. When the Internet was a new and exciting technology, Microsoft’s Bill Gates made the following remark: “I don’t care what the Information Superhighway looks like as long as I have a tollbooth on it.” It’s no secret that the majority of the civilized world distrusts Gates and the company he founded. We know Microsoft just wants our money. And the business practices they’ve used to get it have been found to be illegal in courts across the world. When Google went public, Gates lamented the universally positive press in an interview, saying “You’re not allowed to criticize and say that Google isn’t solving all the world’s problems.” Google is, indeed, one on the most trusted and respected companies in the industry. Even the news media finds difficulty in coming up with something bad to say.

On the one side you have the most wealthy software company in the world and on the other, the most popular. The philosphies of the two couldn’t be any more different. One faces disappearing market share, fines, and legal battles over illegal business practices. The other has seen its stock price more than triple in the past few months.

The next big thing in internet communication is the blog. It’s a shortened form of the phrase “web log,” which apparently took too long to say. A “web log,” in the classic sense, is nothing more than a personal log (diary or whatever) that’s made accessible over the web. Now, there’s nothing new about that concept–it’s been around as log as the web itself. I’ve been keeping a sort of running online journal of thoughts for ten years now. After all, what else do you put on your personal website.

However, what’s changing the world isn’t so much the practice per se, but rather the rising popularity of tools that make the practice so much easier. That’s where the blog, in the more contemporary sense, comes into play. See, the term blog today seems to be reserved, not just for online journals, but specifically for journals that are managed by a Content Management System (or CMS) that was designed specifically for managing personal pages. The cool thing about a CMS (and, in fact, its reason for existence) is the fact that it makes data entry a lot easier. Creating and managing web content is so much easier with a CMS that you can spend your time writing instead of moving files around.

Now, the concept of a CMS is also not new. They’ve also been around since the beginning of the Internet, but until recently, few people used them on their own homepages. The time and work involved in setting one up was simply too prohibitive. There’s no money to be made in homepages–especially those telling everyone what’s new with your cat–so the home user wasn’t much of a target audience for people designing these things. Progress was slow.

However, once CMS technology took root in the personal home page arena, the results were astounding. Let me go over the major selling points of the average blog.

• Adding a story is fast. You can compose content for your blog as fast as you can compose an email.
• Your audience can participate. Every major blogging package allows readers to supply their own comments in response to your story. Suddenly, the user has a real incentive to write–they know they have an audience, and the audience writes back. It’s like having hundreds of pen-pals.
• Built-in syndication. A technology that is currently gaining popularity is called RSS (“Really Simple Syndication”). It allows your blog to communicate with client software, like mail readers. People don’t have to visit your website to see your latest story–they can read it with their morning email. RSS aggregators are designed to pull content from any number of sources and make them all available in one spot. Not only are blogs easier to write, their easier to read.

So, what has the net effect of the introduction of the blog been? In a nutshell, it’s a decentralization of media sources. When everyone can make their own voice heard, the public starts focusing on those whose story is the most interesting rather than who has the greatest publishing power. People start getting the news from their peers, rather than from traditional media outlets.

Information now comes unfiltered. Whereas the news sources used to get their information “from the experts,” they now consult the experts’ blogs. And in the mean time, the average joe has come to bypass the news outlet, and read the story directly from the source–whether they realize they’re doing so or not! It is a revolution of sorts. Your voice can be heard. And if you have something the world want’s to listen to, it will be.

One of the latest technical absurdities to catch my interest is one involving unbreakable encryption. The plot generally centers around the discovery on an encryption scheme so perfect that no one, not even the most powerful organization in the world, can break it. The implications of such a discovery are, of course, so potentially devastating to the intelligence operations of <insert powerful organization here>, that they focus all their efforts on destroying/containing the technology by any means necessary–usually involving a whole lot of chasing, explosions, and the demonstration of just how powerful this given organization is. As expected, gratuitous action ensues.

Of course, with a little technical knowledge on the subject, you’d realize such a scenario is virtually impossible, but not for the reason you might originally suspect. No, it’s not impossible to create an unbreakable encryption scheme. Quite the contrary, actually. Such encryption codes already exist. In fact, unbreakable encryption is the really the foundation of internet commerce. The tools are available and within the reach of any computer-using individual to encrypt a secret so completely that not even the most powerful organizations in the world could get to it.

Over the past 20 years, the science of encryption has evolved to the point that for an encryption scheme to be considered "strong", it has to not only withstand everyday use, but it also has to withstand any theoretical attack from a mathematical perspective. In other words, it’s has to be proven unbreakable in theory, not just in in practice.

The gory details of such a process are fairly uninteresting. But the implications are this: If an encryption scheme is a house, then an unbreakable scheme is one such that the easiest method of entry is always the front door–no matter how heavily guarded it may be. That is to say, the easiest way of decoding your secret document would have to be guessing your password, no matter how difficult that task me be. While theorists don’t like to say "unbreakable" or "impossible", Modern "strong" encryption is so difficult to break that doing so would require more energy than exists in the universe.

Suddenly, password guessing becomes a very attractive option.

And that’s exactly how they do it–when the government seizes the computer of a suspected criminal, they employ a huge network of their own computers to attempt to guess the passwords on any encrypted documents. They optimize their search by building a dictionary of words to try from the other files on the victim’s computer. The idea is that most people aren’t too adept at remembering passwords, so chances are you wrote it down somewhere.

Asymmetric encryption (also known as public-key cryptography), uses one password to encode a secret, and another one to decode it. This makes the CIA’s job all the more difficult. When you log on to your bank’s website, the computers encrypt the transmission without asking you for an encryption password (not to be confused with your account password). What is actually happening is your computer is picking a temporary password for that session–a random number, usually between 0 and 2¹⁰²⁴ (about 1 centillion, or around 1 googol³), which is a large and fairly unguessable number by any standard. Through the beauty of asymmetric encryption, you temporary password is never sent to anyone–not even the bank–and it is destroyed once you’re done with it.

Unbreakable? Yeah, you could say that.