Jeff's LiveJournal

Planter

2009-09-12T21:11:16Z

Here's a nifty raised planter that I finished last week using some of the left-over wood from the old greenhouse at cowhouse 1. I think it came out pretty nicely, and it was a good opportunity to try making the various lap joints for the joinery. The wood could probably use some water-repelling stain to protect it from the weather though.

(Click to embiggen)

Roadtrip through New Mexico and Arizona

2009-08-24T16:47:25Z

I returned home early last Thursday morning after finishing up a week-and-a-half road-trip through New Mexico and Arizona. The total mileage was approximately 2700 miles, and was shorter in both distance and duration than than previous roadtrip last year.

One of the primary goals of the trip was to visit my parents and see their new home (in Vail, AZ) for the first time. I also got to visit long-time distributed.net buddies (cdy and bang), and a former coworker (Jon Woodring) from Jet Propulsion Lab who now works at Los Alamos National Lab.

(click to embiggen)

Sunday, Aug 9:

Leave Austin around 9am.
Arrive Carlsbad Caverns just as the visitors center was closing
Drive back across Texas border to nearby Guadalupe Mountains National Park for camping

Monday, Aug 10:

Drive from campsite back to New Mexico and visit Carlsbad Caverns. Very good cave sight-seeing opportunity, especially with the self-guided option.
Drive to Guadalupe Mountains "Frijoles Ranch" for exploration and hiking
Drive back to Guadalupe Mountains National Park campsite

Tuesday, Aug 11:

Pack up campsite.
Hike at Guadalupe Mountains "Devil's Hallway" trail.
Drive through Carlsbad city, Lincoln National Forest, and Cloudcroft to White Sands National Monument. Walk along the sand dunes--one of the few national parks that encourage you to walk anywhere and avoid trails.
Drive to White Sands Airforce Base and visit their free outdoor Museum of historical aircraft and missiles.
Drive to Las Cruces, NM and stay in hotel for the night.

Wednesday, Aug 12:

Drive to parents house in Vail, AZ (just outside of Tucson)
Lunch and dinner with parents. Drive around Tucson. Stay night in their guest room.

Thursday, Aug 13:

Visit nearby Colossal Cave with parents. It was a little disapponting, because of the amount of human damage to the rock formations that had occurred over the time. Lunch at the Colossal Cave picnic area.
Stay night in parents' guest room.

Friday, Aug 14:

Shopping at Costco with mom.
Visit nearby Saguaro National Park with my parents.
Dinner at Texas Roadhouse
Stay night in parents' guest room.

Saturday, Aug 15:

Leave parents house
Drive to BioSphere 2, take tour and explore site. Very cool, but unfortunate that it couldn't have been even more successful. Its age is showing, with rusting supports and a few broken windows.
Drive to Scottsdale, AZ and have dinner and beer with cdy & bang at Four Peaks Brewery (picture)
Watch District 9 movie with cdy & bang. Very cool movie--obviously set up for a sequel.
Drive to Sedona, stay in hotel for night.

Sunday, Aug 16:

Drive from Sedona to Grand Canyon south rim.
Walk part of south rim trail and stop at various scenic views, hoping to see President Obama's motorcade (unsuccessful).
Drive to Meteor Crater, visit their museum and the crater.
Drive to Holbrook, NM and stay in hotel for night.

Monday, Aug 17:

Drive to Petrified Forest National Park (AZ). See petrified artifacts and painted desert scenes
Drive to Santa Fe Square to meet with Jon Woodring (and old JPL coworker) and his wife. Enjoy outdoor music, dinner, and ice cream.
Drive to nearby Santa Fe National Forest. Set up camp at "Black Canyon" campground.

Tuesday, Aug 18:

Exploration and hiking around the "Borrego" and "Grizzly's Grotto" trails.
Observe movie filming truck driving around mountain roads, apparently taking footage for a future Jason Bateman film, according to the police escort. No movie stars present. (picture)
Camping and campfire.

Wednesday, Aug 19:

Pack up camp.
Drive to Roswell, NM. Visit International UFO museum and research center. It was a little below expectations, and was obviously built in an old movie theater; it will be interesting to re-visit once their new museum is constructed in ~3 years. Walk around neighboring streets and visit some of the gift shops.
Drive to nearby Bottomless Lakes State park. Decide not to camp here due to heat and disappointing lakes. Distinction between "pond" and "lake" is ambiguous there.
Drive back to Austin. Arrive around 3am.

Firetrucks

2009-04-20T18:31:53Z

There's been a lot of firetrucks around recently.

Two months ago we had a big fire alarm at the office and had nearly the entire fleet out to investigate a chemical smell that triggered sensors in the building (probably residue from paint).

A few weeks later while dining at Chinatown on Mopac, we observed that their used cooking oil had overflowed into their parking lot and down the access road of the highway. This was naturally causing a large environmental issue, a tremendously offensive odoriferous release, as well as a driving traction impairment. Never fear, AFD to the rescue to help clean up the mess with some absorbent granules.

Then two weeks ago they had to come to assist with the "partybus incident" in front of my house and the cleanup of the spilled gasoline with more absorbent granules, though I wasn't home at the time to watch.

And just this weekend, my neighbor across the street decided that his rotting fence needed replacement so he apparently recruited some of his friends to rip out the old one and start the new one. Unfortunately, in their enthusiasm to use shovels and pickaxes to dig new fencepost holes, they forgot to call the gas company to mark the underground gas lines. Excitement ensued as two firetrucks were required to blocked off all access to the intersection for several hours while the gas company repaired the line and allowed the released gas to dissipate.

I wonder what the average percentage of their calls are not actually fire related.

Re-Radiated

2009-02-08T03:53:08Z

For the last several months my Jeep has been slowly dripping anti-freeze from a joint near the top of the radiator. Within a week or two it would leak the amount of coolant between the "refill needed" and "full" lines on the overflow tank, but I have been carrying a spare bottle of 50% coolant with me just in case I needed to refill while I was away.

In fact, during last year's roadtrip I carefully checked the level each time I refilled gas, but I think the higher heat of highway driving seemed to minimize the leaking during that trip.

My OEM radiator was a plastic-aluminum composite, and appeared to be leaking at the junction between those two materials. According to other people, this is apparently a common source for leaks and generally is easier to replace than repair.

I got an estimate for a new radiator, installation labor, and coolant flush and Lamb's quoted me a total of $629 (parts $424, labor $169, tax $35). Furthermore that was just for another of those "composite" plastic radiators ($292 just for the radiator)--if I wanted a premium all-aluminum radiator it would be $80 more.

I had done some searching the previous night and knew that I could get an all-aluminum Jeep radiator online for about $130 plus shipping, so I knew Lamb's prices seemed a bit excessive. When I mentioned the price that I could get the radiator for, the guy at Lamb's recommended I buy a few of those radiators and sell them on eBay (which ironically was where I found those prices).

I decided to just buy the new radiator off eBay and install it myself. The instructions from other people on the net seemed to indicate it was relatively easy and could be done in about 2 hours, which is pretty close to how long it took me. I ended up saving and re-using the same coolant since mine still seemed pretty clean.

During the installation I puzzled over the presence of extra connections on the new radiator but not on my old one, which are apparently for an automatic transmission--I just left them disconnected on my manual Jeep. Another complication was caused by the bolt holes used for the fan shroud being just barely a different size--I ended up shearing off the head of one of the four bolts, but I figure 3 bolts should be enough.

Click to embiggenIn any case, by doing it myself I ended up saving about $460 and gained some automotive experience. Now I just have to figure out what to do with the old radiator.

mmm cheese

2009-01-14T03:46:41Z

In recognition of unending advancement of time, and the passage of one year since the last one, I'd like to welcome all of my local peeps to a celebration!

What is everyone's availability for a dinner at the Melting Pot on either this Friday, Saturday, or Sunday evening? (We'll pick the evening that the most people can accommodate.)

update: Time is Saturday at 5:30pm!

WSJ

2008-11-14T07:18:08Z

So just prior to the election, I happened to become introduced to simplistic websites like "IsObamaPresident.com", "IsMcCainPresident.com", and "IsSarahPalinPresident.com". After noticing that "IsPalinPresident.com" was still unclaimed, I quickly registered it and put up an comparably simplistic page. I didn't mention the existence of the domain anywhere other than in my regular IRC channels, but quite a few other people must have discovered it just by guessing. 200k hits later and I got asked some questions from a reporter/blogger from the Wall Street Journal:

Jeff Lawson, a 30-year-old tech-industry worker in Austin, was chatting with his friends online about election-related “Is” sites. The domain IsSarahPalinPresident.com already existed, but the breezier IsPalinPresident.com did not. So Mr. Lawson paid a few bucks just before election day to scoop up the Web address, one of several so-called vanity domains he has bought.

“It was basically only the cost of a couple of drinks from Starbucks, which is a fair price for a few laughs with my friends,” Mr. Lawson said. (For the record: “No,” it says, followed by, “And hopefully not in 2012 either.”) He’s paid up for the Web adress until next November, but Mr. Lawson isn’t sure whether he’ll keep the site up beyond that. “I’ve already had my fun,” he says.

http://blogs.wsj.com/biztech/2008/11/13/isobamapresident-and-other-single-serving-sites/

Another distributed.net milestone

2008-10-29T06:20:50Z

(Cross posted from my grid.org blog)

For those who don't already know, distributed.net achieved another significant milestone last weekend by completing the OGR-25 project. Over the ~8 years of the project, we've had the computers of nearly 125,000 people contribute (and many people have more than one computer participating). Here's the full announcement that I made regarding the completion, as well as the separate announcement for the next OGR project. Launching a new project for us is always an exciting time, including a flurry of activity involving backend server updates and finalizing the new project's code.

distributed.net's recent success was mentioned in several prominent websites, including the venerable Slashdot (Distributed.net Finds Optimal 25-Mark Golomb Ruler).

Another nice blog mention was in Mark Hopkins' blog post "Microsoft’s Azure is So 1997 (and Why I Love it)", which reminds us that today's recent cloud computing initiatives are basically just building upon the time-tested concepts of the past.

On the topic of garbage

2008-10-29T04:06:14Z

In the 1998 Supreme Court decision of California v. Greenwood, it was found (among other things):

It is common knowledge that plastic garbage bags left on or at the side of a public street are readily accessible to animals, children, scavengers, snoops, and other members of the public.... Moreover, respondents placed their refuse at the curb for the express purpose of conveying it to a third party ... Accordingly, having deposited their garbage ... in an area particularly suited for public inspection and, in a manner of speaking, public consumption, for the express purpose of having strangers take it ... respondents could have had no reasonable expectation of privacy in the [items that were] discarded.^{[findlaw.com]}

Furthermore:

The question, then, becomes whether placing garbage for collection constitutes abandonment of property ... [T]he placing of trash in garbage cans at a time and place for anticipated collection by public employees for hauling to a public dump signifies abandonment ... [T]he act of placing garbage for collection is an act of abandonment which terminates [any protection]... The act of placing [garbage] for collection is an act of abandonment and what happens to it thereafter is not [protected].^{[findlaw.com]}

In the 1995 case of United States v. Hall, United States Court of Appeals for the 11th Circuit, it was found that:

It is common knowledge that commercial dumpsters have long been a source of fruitful exploration for scavengers. ... [The defendant] did not take sufficient steps to restrict the public's access to its discarded garbage; therefore, its subjective expectation of privacy is not one that society is prepared to accept as objectively reasonable..^[emory.edu]

Additionally, summarized elsewhere:

Stealing trash is not illegal. The Supreme Court ruled in 1988 that once an item is left for trash pickup, there is no expectation of privacy or continued ownership.

By definition anything in a dumpster is waste and therefore not needed and abandoned by the owner. So you can recover anything from the trash that you want.

The problem is the location of the dumpster. If the dumpster is on private property then you can't access it without trespassing.^{[answers.com]}

It would of course be perfectly reasonable for an occupant of the building to access a dumpster that is provided by a building for the express use by its business tenants.

Vain vane

2008-10-23T03:15:39Z

Our office building recently deployed a large dumpster outside for collecting discarded cardboard boxes for recycling. Unfortunately the recycling company had not been able to empty it for almost two weeks and by this morning it had been overflowing with empty boxes, with many more on the ground surrounding it. Well finally the recycling company comes by this morning and empties it, and collects most of the boxes that were sitting around on the ground. As I was driving home this evening I noticed that they had missed a box on the ground, so I walked over to it to throw it back in the bin for next time. As I walked closer, I noticed this box wasn't empty at all and in fact looked pretty interesting! It was a large piece of hollow metal, shaped like a cow!

(Click to embiggen)
It turns out that is a copper weather vane that someone apparently didn't want and just decided to throw away. Some packing materials that came with it indicate it was a "Hereford Bull" made by the West Coast Weather Vanes company. After I got home, I found their website and found the product listing for their hand-hammered 3-foot model Hereford Bull. It's quite surprising someone would want to throw away such a pretty thing, especially considering the scrap value of copper these days. I'll have to figure out a way to mount it on top of cowhouse this weekend.

Presidential appearance

2008-10-09T20:13:35Z

I had fun at the Presidents of the United States of America concert last night at Stubb's BBQ. I managed to convince Yang and (more surprisingly) Johnno to join me. Although they played a few of their newer songs, they also did a lot of songs from their old 1995 album (Kitty, Lump, Boll Weevil, Peaches, Dune Buggy, We Are Not Going to Make It, Kick Out the Jams, Body, Back Porch). Below is a YouTube video I recorded of "Boll Weevil".

The opening act was local Austin band, The Black and White Years, though I only found their "Power to Change" song (which gets occasional airtime on 101X) to be notable.

Cows have magnetic sense

2008-08-26T19:20:06Z

Here's some interesting cow-related news that has just been discovered by using Google Earth images:

"Studying photographs of 8,510 cattle in 308 herds from around the world, zoologists ... found that two out of every three animals in the pictures were oriented in a direction roughly pointing to magnetic north."

"Cows are known to align their bodies facing uphill, facing into a strong wind to minimize heat loss or broadside to the sun on cold mornings to absorb heat, but the fact that the pictures were taken at many locations, at different times of day and in generally calm weather minimized the effect of environmental factors, the researchers said."

http://www.latimes.com/news/science/la-sci-cows26-2008aug26,0,3764260.story

Roadtrip through the US south east

2008-08-20T21:42:28Z

This past Sunday I arrived back in Austin from a 2-week roadtrip that I spontaneously decided to take. My goal was to visit interesting places that I had never seen before. In total I drove about 4500 miles in my Jeep Wrangler (and 18 tanks of gas). I got to meet up with Mike Woss (ex-coworker), Lucent (first IRL meeting with long-time d.net buddy), Mary Bass (coworker), and Rey/Swiggy (ex-coworker).

There were a few cities that I had hoped to go through (Atlanta and Birmingham) that I ended up cutting out so that I could spend more time in other locations. I could have easily have spent more time in most of my stops if I had more vacation time.

I bought a new Digital SLR camera (Nikkon D40) specifically for the trip, so I had some fun playing around with it at the same time. Snorkeling and night-time kayaking in Key West were both pretty fun. Visiting Kennedy Space Center was also pretty neat, since I had been involved with parts of the Shuttle missions but never seen the launch facilities. The Great Smokey Mountains National Park was also a great place to explore and hike around.

(Click pictures above to embiggen)

Sun, Aug 3

Leave Austin @ 12pm
Drive ~8hours
Pictures at Louisiana welcome center and nature boardwalk
Arrive motel at Laplace, LA

Mon, Aug 4

Depart Laplace, LA
Arrive New Orleans
Visit French Quarter, Bourbon Street, Canal Street
Depart New Orleans
Arrive motel at Pensacola, FL

Tue, Aug 5

Depart Pensacola, FL
Visit Big Lagoon State Park, tour boardwalk trails
Brief stop in Destin beach
Drive ~7 hours
Arrive motel at Tampa, FL

Wed, Aug 6

Lunch with Mike @ 12pm in Tampa
Ferry to Caladesi Island State Park. Nature walk, beach, shell collecting
Depart Tampa
Arrive motel at Fort Meyers, FL

Thu, Aug 7

Depart Fort Meyers
Arrive Key West
Sunset kayaking and marine life exploration tour
Arrive Blue Marlin hotel in Key West

Fri, Aug 8

Visit hot sauce store in Key West
Visit Duval Street stores
Snorkeling in Key West @3pm
Depart Key West
Arrive motel in Florida City

Sat, Aug 9

Depart Florida City
Tour Coral Castle
Everglades fan boat ride by Miccosukee Indians
Everglades Shark Valley boardwalk hike
Drive along Lake Okeechobee
Arrive motel in Cocoa Beach

Sun, Aug 10

Depart Cocoa Beach
Tour Kennedy Space Center, Astronaut Hall of fame
Drive 4 hrs
Arrive motel in Jacksonville, FL

Mon, Aug 11

Depart Jacksonville, FL
Drive 4 hrs
Arrive Charleston, SC
Tour Kiawah island
Tour Charleston historical Market Hall
Drive 5 hrs
Arrive motel in Spartanburg, SC

Tue, Aug 12

Depart Spartanburg
Drive 3 hrs to Great Smokey Mountains National Park
Meet Lucent
Camping, Hiking in national park campsite

Wed, Aug 13

Camping, Hiking
Leave park, because Lucent wimped out and did not want to camp another night!
Arrive Knoxville, TN. return Lucent home, sleep night on his couch

Thu, Aug 14

Tour Knoxville, including Sunsphere and World Fair park.
Depart Knoxville, TN
Arrive motel in Chattanooga, TN

Fri, Aug 15

tour Tennessee Aquarium
tour Chattanooga Choo-choo
tour Ruby Falls and caves
Drive to Nashville, TN
Nashville with Mary+Walker
see the Nashville Parthenon
Downtown Nashville
Stay night with Mary+Walker

Sat, Aug 16

Depart Nashville
Arrive Memphis
Memphis lunch with Swiggy (Rey) at local seafood place
Depart Memphis
Drive through Hot Springs, AR
Back in Austin, via Dallas

iGive, you receive insecurity

2008-08-03T05:41:41Z

I've been delaying the posting of this blog entry, but since there haven't been any new developments I thought I should finally post it...

iGive.com is a website that allows people to shop at popular e-commerce retailers and have a small percentage of the purchase sent to a charity that you nominate. In theory it's a nice idea, however I've noticed a few problems with their implementation, particularly in regard to the security and confidentiality of the personal information of members that sign up. distributed.net has been using iGive since 1997, though my opinion of them has been lowered as a result of this (and other actions that are not covered here).

iGive elected to belong to the TRUSTe "web privacy seal" program, which has the goal of providing some assurance to internet users that their privacy can be safely entrusted to a website. Most of TRUSTe's assurance comes from requiring websites to pay a certification fee and have a privacy policy that complies with TRUSTe requirements, but they don't actually seem to do their own auditing unless someone makes a complaint. There are other critics that claim that TRUSTe does not take a proactive role in monitoring or punishing organizations.

Issue #1: unauthenticated autologin URLs

I noticed that their periodic email newsletters included a URL to view a HTML version of the newsletter as a webpage (in case your email client does not display full HTML). Unfortunately, the URLs were of the form "http://www.igive.com/html/igivenews.cfm?mid=xxxxxx" and the "mid" is an integer that references your personal Member Identifier. The newsletter is customized to including your name and some statistics, and also automatically log you into your iGive account so that you will receive credit for any subsequent shopping activity.

Of course the flaw with this is that anyone can compose an equivalent URL with any random Member Identifier, become logged in as that user, and then use the iGive account management features to view the personal details of that person (such as full name, mailing address, phone number, what charity they are supporting, and their full shopping history of store names, order invoice numbers, and shopping amounts).

9/14/2006 -- email iGive support notifying them of details of the vulnerability
9/14/2006 -- receive email response stating "Thanks for your note, we've passed it along to the appropriate people."
1/17/2008 -- email iGive support notifying them that the issue is still unresolved after 17 months
1/17/2008 -- receive automated email response acknowledging receipt.
1/17/2008 -- separately send initial email to TRUSTe watchdog notification regarding issue
2/1/2008 -- receive email from iGive with the response "Your ticket ... has been closed. ... No action is required on your part."
2/1/2008 -- email iGive support disputing their arbitrary closure of the ticket
2/5/2008 -- receive email response from iGive saying "it does appear that your ticket was inadvertently closed. Please resubmit your initial query and we will promptly attend to it."
2/5/2008 -- confirm TRUSTe watchdog submission to permit forward progress, and supply additional details
2/5/2008 -- reply to iGive support to reopen issue
2/5/2008 -- receive response from TRUSTe asking for details to reproduce
2/5/2008 -- send details to TRUSTe about issue
2/7/2008 -- receive email from iGive acknowledging that they are being investigated by TRUSTe and they will work with them rather than me
2/25/2008 -- receive email from TRUSTe notifying that the issue has been resolved.

iGive resolved the issue by making the webpage version of the newsletter ignore the "mid" variable and rely on you being logged into iGive already. If you are not already logged in, then you are sent to a login page.

Issue #2: insecure cookie logins

As I was confirming that the above issue was corrected, I realized that iGive was relying on a Cookie that contained my Member Identifier to decide whether I was logged in. By simply typing a line of javascript in my browser address bar, I could change that "MID" cookie to be any other integer Member Id and I would be considered logged in. I could then perform all of the iGive account management functionality that I described in Issue #1 above.

2/27/2008 -- notify TRUSTe of the additional entry-point to the vulnerability. Suggest an external security audit.
2/28/2008 -- receive reply from TRUSTe indicating they are pursuing the new issue. "due to the complexity of the issue, this may take some time"
3/27/2008 -- request status from TRUSTe, receive response saying nothing new.
3/31/2008 -- receive response from TRUSTe about other questions
4/2/2008 -- receive response from TRUSTe notifying that the Cookie issue is resolved.

The resolution by iGive was to introduce additional cookies containing session identifiers. The "MID" cookie is maintained, but apparently ignored.

Issue #3: insecure charity details

While looking through other parts of the iGive website, I noticed that anyone can view the full contact details of any charity that has registered with iGive (including the name of the charity officer, his mailing address, the charity's phone number, contact email address). As with issue #1, the URL of the vulnerable page simply accepted an integer Charity Identifier as an argument: http://www.igive.com/html/body_editlisting3.cfm?cid=1100

4/14/2008 -- notify TRUSTe of the vulnerability
4/18/2008 -- receive response from TRUSTe asking more questions about how to repro the issue
4/19/2008 -- send response to TRUSTe with details and screenshots of the issue
4/21/2008 -- receive response from TRUSTe indicating they have received the details and are verifying the claims
4/22/2008 -- receive response from TRUSTe indicating that they have confirmed the claim.
6/6/2008 -- receive response from TRUSTe indicating that iGive has improved the security of charity editing pages.

iGive resolved the issue by deleting the specific page. I've not yet attempted to verify whether the new equivalent pages fully eliminate the original problem.

Issue #4: Insecure member listing

iGive permits charity operators to see the list of members that have contributed towards that charity. Charities are not supposed to be able to see members that are only affiliated with other charities, or those members that have opted to remain invisible.

However, I found a way for anyone to view the full list of contributors that are supporting a cause/charity and seeing their first/last names, their email, and their contributed amount. You do not even need to be a charity operator to do so--only have a standard iGive contributor/member account. All you had to do was set a cookie with some Javascript and then access a URL:

javascript:document.cookie="SUPPORTERLISTOK=1100"
http://www.igive.com/causetoolbox/html/supporterlist2008.cfm

4/14/2008 -- notify TRUSTe of the vulnerability
4/18/2008 -- receive response from TRUSTe asking more questions about how to repro the issue
4/19/2008 -- send response to TRUSTe with details and screenshots of the issue
4/21/2008 -- receive response from TRUSTe indicating they have received the details and are verifying the claims
4/22/2008 -- receive response from TRUSTe indicating that they have confirmed the claim
6/6/2008 -- receive response from TRUSTe indicating that iGive has improved the security of charity editing pages.

I've not yet attempted to verify whether the new equivalent pages fully eliminate the original problem.

Issue #5: Tracking images

iGive sends out periodic newsletters by email that includes the use of "clear gif" tracking images to determine if/when members actually read the newsletters. Although this is not a unique practice, all members of the TRUSTe program are required to disclose that they make use of this technique in their privacy policy, and iGive's policy did not do this. Apparently all iGive newsletters have contained tracking pixels since 2003.

4/14/2008 -- notify TRUSTe of the non-compliance issue
4/18/2008 -- receive response from TRUSTe confirming the requirement, and asking for an example email
4/19/2008 -- send response to TRUSTe with an example email that contains "clear gif" images
4/21/2008 -- receive response from TRUSTe indicating they have received the details and are verifying the claims
4/22/2008 -- receive response from TRUSTe indicating that they have confirmed the claim
5/21/2008 -- receive response from TRUSTe indicating that iGive has updated their privacy policy to disclose the tracking images
6/17/2008 -- iGive updates their privacy policy again to more clearly describe tracking images and remove references to TRUSTe, but does not remove the TRUSTe logos from all parts of their website

Other general developments

As a result of my reports of these security issues, it appears that TRUSTe has taken the rare action of terminating the membership of iGive into the web privacy seal program. Technically, I wasn't able to get any official confirmation that their membership had indeed been terminated or whether iGive chose to discontinue their membership, but the result is similar. Here are a few key statements that I did receive:

4/22/2008 -- "We are escalating this issue within TRUSTe to determine next steps ... We really appreciate the help you've provided in alerting us about this and the prior issues."
4/22/2008 -- acknowledge response, indicate similarity of vulnerability, ask about notification to members, ask at what point certification status might be revoked
4/23/2008 -- receive response from TRUSTe acknowledging the concerns
6/17/2008 -- iGive removes some references to TRUSTe, but not all TRUSTe logos from other parts of their website
6/23/2008 -- receive response from TRUSTe indicating "iGive is no longer a member of our program and we have no further enforcement capability relative to their site. We were unable to resolve the audit issue during this time."
6/24/2008 -- receive response from TRUSTe regarding the specifics of why they are no longer a member: "We are unable to disclose whether ending the certification was mutually agreed or similar issues. Our standard license agreement limits what we can disclose."

According to TRUSTe's fact sheet, as of today only 3 companies have ever been terminated from their program. If you use the archive.org wayback machine, you can see that the number of terminated companies was still only 1 as recently as November 22, 2007. I suspect iGive might be one of the two recently terminated companies--I don't know who the other company might be.

I haven't decided whether TRUSTe's handling of iGive was adequate or not. Perhaps they do deserve the criticism that they do not act quickly or proactively enough. It's a little disappointing that both iGive and TRUSTe do not seem to have adequate security resources to evaluate website implementations on their own.

TRUSTe recently made a blog post warning that "encoding an ID# in the URL or relying on another mechanism that can be changed by the user risks exposing data". I don't know if iGive qualifies as a "major consumer web site ... [that exposes] passports", but I'm sure they were at least attempting to aggregate the lessons from iGive's problems in that post.

Kayaking trails

2008-06-10T20:50:55Z

About two years ago I bought a kayak and I've been using it every few weeks to explore some of the local waterways and enjoy the scenery. Here's a few Google Maps that I made of the places I've gone while kayaking around Austin recently.

I intend to try some places further away from the city sometime soon, instead of repeating previous ones (as I have been). There's also some more local places to try on Austin Kayak's boating map. I also need to try out the Texas Parks and Wildlife Paddling Trails and some other paddling areas.

Good fortunes

2008-05-25T19:02:52Z

Freebies:

Johnkw and I attended an Agile Austin lecture on May 6 and I think there were about 80 people in attendance. At the end of the talk they drew random numbers to give out 3 door prizes, and he and I both won prizes. He got a book on agile development, and I got a license to IntelliJ IDEA (a commercial Java IDE based on Eclipse).
My XM Radio service is still receiving free radio after 5 months, since I installed it in January. I guess they don't retransmit their entire whitelist/blacklist of authorized radio IDs frequently enough to catch my short commutes.
My T-Mobile cell phone bill normally automatically charges to my credit card every month on the 23rd. Last month there was no April 23rd charge so I call T-Mobile and ask about it. They said that somebody else paid my bill in advance by phone (perhaps they entered the wrong account number), but they didn't know who or what credit card was used to do it. They recommended just leaving the credit and see if it eventually gets retracted. I did get billed on May 23rd, so I guess it was only a one-time freebie.

Lucky recoveries:

I went kayaking last weekend and as I was getting back on land, I apparently dropped my phone on the dock without noticing it. After finishing dinner at Chuy's and realizing my phone was missing, I returned to the dock and the manager there had luckily found and kept my phone. No damage either!
This week I've had the windows open ventilating Cowhouse rather than running the A/C, and naturally the cats like to sit by the open windows and look out. Apparently Jasper was leaning too hard against the screen window and fell out from the second floor to the ground below--I didn't realize he was missing until around 10pm. Using a flash light I quickly found him hiding under one of the bushes in the backyard uninjured.

Free basketball backboard hoop

2008-05-12T05:19:02Z

Any local Austinites interested in an old basketball backboard hoop with chain net? You'll just need to install some kind of permanent vertical post in your ground someplace, and then you can mount this backboard to it.

Cowhouse came with one installed in the front driveway, but I have no use for it so I took it down.

I'll probably post this on Craigslist in a few days if no one's interested, but I wanted to give the people who know me a chance to claim it first.

UPDATE: I put the hoop in front of the house with a "FREE" sign on it, and it disappeared within a few days.

Jury duty

2008-04-25T16:34:33Z

So I got a summons to go downtown yesterday and participate in jury duty for my first time. I was actually pretty excited about the opportunity and was hoping that I would be picked to be on the final jury. Unfortunately, I ended up being juror candidate 22 (out of 23 present), and they ended up only needing the first 6. Regardless, I chose to stay and watch the trial since it seemed kind of interesting and my boss already had the expectation that I'd be gone the whole day.

@#&$@#!!

Apparently a lady was riding her bicycle on the Town Lake Hike & Bike trail in February and almost ran into a loose dog on the trail. She shouted some profanity ("expletive deleted") at the dog's owner as she passed, and some nearby bicycle cops happened to hear it and gave her a citation for disorderly conduct by disturbing the peace. The cops testified that at the time she was ticketed, the woman admitted to shouting the profanity and apologized for it.

The jury ended up finding her unanimously not guilty, despite the absolutely horrible job that she did while representing herself and not actually providing any compelling arguments. The testimony of the two bicycle cops was basically insufficient to get the verdict.

(At the time of the ticket, she supposedly claimed to the police office that the profanity was part of a story she was telling to a friend she was bicycling with. But there was no exploration of why a profanity in a retold story would have been more appropriate in a public area, or why she changed her excuse to now being because a loose dog was in the path, nor why shouting a profanity at the dog's owner would have been more justifiable.)

If the jury had found her guilty, they could have fined her between $1 and $500.

Kaweah Pole House

2008-04-20T22:22:08Z

My parents both retired a few months ago in December and have recently put their house up for sale, so that they can retire to Arizona. A few of my Austin friends (decibel45, dopplertx, snaxxx) got to see it in person when we went to New Zealand last year.

Part of the reason that my parents don't feel that the real estate market slump in California will have too much of an impact on their sale is the relatively unique nature of their house. It is a Japanese-inspired haiku house, which is a modern-day interpretation of a Japanese country house. It is supported entirely by long wooden poles that extend deep into the ground, and is made almost entirely out of redwood trees. My parents liked the design so much that they hired an architect to build it for them in 1981 on a carefully selected hillside in Pasadena, California. It would be impossible to build a house like it today in California due to recent construction regulations to reduce fire risk, plus the difficulty/expense of obtaining that much old-growth redwood.

Their realtors set up a little website with its own domain [1893kaweah.com] to host a description and some photos of it. My mom sent me some good details about the media coverage and open house interest:

"Our home was featured in the local Pasadena magazine as well as in the LA Times. The first open house had a lot of neighborhood people ... We had a couple serious parties. Our realtors (2 partners) were very surprised at the numbers showing up. The 1st [open house] had 175 coming through; our 2nd has about 100. It must have been a huge traffic jam since we got a phone call 1½ hr into the open house and the realtor sounded overwhelmed at the tremendous # of people going through the house!"

The house keeps itself very cool in the summer because of louvered windows that can open up along the entire bottom floor, and skylights and roof vents that open up on the second floor. All the hot air escapes at top vents and draws in cool air through the lower windows.

You can also see their house on Google Maps StreetView, though it appears that Google has mixed up some of the images if you move too far along the street. The realtor also has a bunch of photos on their website. I also have some of my own photos in my personal gallery. It's a little sad to think that the house I grew up in will soon belong to someone else though.

Fry's <3 AmEx

2008-03-14T19:18:52Z

Finally after enough customer complaints Fry's Electronics now accepts American Express. I noticed the signs at the cashiers had changed when I stopped in last weekend at the Austin Fry's and the cashier confirmed it was true. A press release was put out just this week:
http://www.americanexpress.com/corp/pc/2008/frys.asp

Birthday dinner

2008-01-14T17:32:32Z

It's my 30th birthday on Tuesday (Jan 15), but I was thinking of having a group dinner on another night instead. How does 7pm at Cheesecake Factory at the Arboretum on Saturday Jan 19 sound? Reply below so we can get a headcount.

Weekend, XM radio, and home security

2008-01-14T17:31:53Z

On Friday night, I went and had dinner at Uncle Billy's BBQ and then went to see the band She Craves at Emo's Lounge. Then on Saturday we went to the McKinney Falls State Park and we did the 3 mile paved hike around the park. Next time I go I'll definitely want to try the other 3 mile unpaved hike they have. reanimated wrote a little more about it here and here.

On Saturday evening and Sunday afternoon, I did a bit of electrical work on my car by installing an integrated XM Radio receiver into my Jeep. This was basically added on a hidden XM Receiver electrical box under the driver's seat with cabling that snakes up under the carpeting and into the back of my Pioneer stereo head unit. Even better is that it seems because the XM receiver I bought was factory refurbished, it is still activated and receiving radio content for free. Apparently the XM activation/deactivation signals are only transmitted occasionally for each Radio ID, so I may continue to get free service for a few weeks.

Sunday evening, snaxxx started moving some of her things into the Cowhouse, beginning mostly with her books. She'll be moving the bulk of her things next weekend.

Unfortunately, it seems that the commotion of going in and out of her car might have attracted some criminals, because in between car loads some vandal snuck into her car and my Jeep and looked for things to steal. The burglar must have been scared off as Snax was coming back her car, because my Jeep passenger door was left open with my car insurance paperwork scattered around. The only thing taken from my Jeep was less than a dollar in spare change in the cupholder (apparently ignoring my obsolete Garmin StreetPilot GPS). They similarly took a few dollars in cash and a digital camera from Snax's car, but seemingly not much else (also apparently ignoring her iPhone and iPod). The Austin Police were dispatched out and they took a crime report from us and managed to lift a few good fingerprints from Snax's car, so maybe something good will happen.

Maybe I'll try to get some infrared video cameras installed outside around the house. I had been playing with an open source Linux-based video surveillance package called ZoneMinder a year or so ago, but never really extended it to any permanently mounted cameras.

Christmas holiday

2008-01-14T16:53:43Z

Over the Christmas holiday I went back to visit my parents in Pasadena again. We had the usual big group dinner at one of my aunt's houses with all of the other aunts, uncles, and cousins.

Then from Dec 26-28, I went to Las Vegas with a smaller group (Aunt Shirley, Uncle Chuck, and my 4 oldest cousins) to see the Cirque du Soleil: Beatles Love show [wikipedia] and do some gambling. The Cirque du Soleil show was great and incorporated lots of songs by the Beatles with great choreography and a fair bit of acrobatics. It didn't seem to have quite as much of the acrobatics as I think other Cirque du Soleil shows are known for, but it was still quite enjoyable.

While I was there, I also went on my own into the Star Trek: The Experience [wikipedia], saw the museum, the two attractions (Borg and Klingons), and brought back some souvenirs (including a Tribble). The recreation of the ship interiors there were neat to see up close--the ride and experience is kind of similar to the Star Tours at Disneyland.

Although I did a bit of gambling, I didn't really gain or lose very much. I mostly played Video Poker and some of the slot machines. I did much better with video poker than the slots, especially after finding this Wizard of Odds: Video Poker website. A $20 bill lasted me 2 or 3 hours in the quarter Video Poker machines with the optimal strategy.

My dad and mom had just retired, so there was also a big retirement/birthday party for my mom, which was pretty exciting. My parents are also in the process of selling their home in Pasadena, so I was helping with some of the packing and furniture moving to help stage the house for its sale. It's too bad that they'll have to sell such a neat house at a low point in the housing market though.

The 20 Ugliest Colleges in the USA

2007-12-13T04:10:57Z

So someone forwarded this article to me that lists this person's selections for ugliest campuses. As it turns out, my school (Harvey Mudd College) came in at #14. Pitzer college (just across the street from HMC and part of the Claremont Colleges consortium) is ranked even worse. IIT is also present. The first place was Drexel, which looks like it has an industrial smoke stack in one of its buildings and "prison-like dorms": http://campussqueeze.com/static/20-ugliest-colleges-in-the-USA.html

14. Harvey Mudd College- You’d think that because of it’s (sic) California location, it would actually be pretty. Well you couldn’t be more wrong. Being a Claremont College, that’s surprising. The buildings are old and faded, and the architecture isn’t relative to the California lifestyle. That’s too bad, considering how well some of the other colleges in the area are designed. Harvey Mudd got just slabs of concrete. It’s a pretty good school, too. What a shame.

I also found this other recent news article about my school that mentions that campus pranking now needs students to "opt-in" to being pranked: http://www.cbsnews.com/stories/2007/10/31/national/main3436701.shtml

Following complaints in 2000 from several students at Harvey Mudd College in Claremont, Calif., about an annual prank where sophomores perform elaborate freshman room rearrangements - such as turning a dorm room into a campsite, complete with sod - administrators decided that rather than sacrifice their prank culture, they would refine it by creating a "no prank list."

"There is an implicit assumption that when you come to Harvey Mudd that you are willing to be party to pranks against you and your room," explains Guy Gerbick, associate dean of students. "We tell students during orientation, 'If you don't want to have certain things or yourself or any of your stuff pranked, let us know, and we'll put you on a list.' "

Over half the student body has registered. According to Mr. Gerbick, most make specific demands, such as not to interrupt sleep or meddle with a prized guitar or stuffed-animal collection. Only about 15 students have asked for no involvement whatsoever.

Geocaching

2007-10-30T05:37:59Z

While visiting Austin over the last week, Ertyu has gotten me started geocaching by cooperatively finding 9 caches in the Austin area with me.

I've even gotten started by hiding my own cache (GC1718T) in the watershed area near me. However, I think I will need to look into more securely chaining it to something before the rain season starts, in order to ensure it does not get washed away.

Changing of the cards

2007-10-16T05:43:25Z

It seems like every year I end up getting new business cards because something on it has changed (address, title, phone number, logo, company name, etc). So what are you supposed to do with all of the left-over cards that you hadn't given away yet? Build some origami out of them!

Here is just part of a "Level 2" Menger Sponge that I built out of my old cards and those of several ex-employees. Notice that this is actually the equivalent of 8 of the "Level 1" sponges that Ivo built last year.

(Click to embiggen)

Getting this far took a lot more patience than I expected, and I'm not sure I really want to build the 12 more L1-sponges that would be be required to turn this into the full "Level 2" sponge. In any case, it makes a cool piece of artwork.