OS X, perl security update

I noticed in the Security Update 2006-007 for OS X, they are including an update to the system Perl. I remembered that Redhat also recently released a security update for Perl on RHEL4, so I did a little digging. Turns out that today's update from Apple has nothing to do with
CVE-2006-3813 which is Redhat fixing their own slip-up. No, Apple is fixing CVE-2005-3962, for which Redhat released an update on December 20 of last year.

Oif! That's not good turnaround. Especially considering there have already been several other security updates for OS X this year and this relatively straightforward perl fix could have been in any of those.

Does OS X Server get more timely security?

We're gonna need a longer spoon

Open Letter to the Community from Novell

See Also:

Novell Withdrawing Participation from the Hula Project

A penny saved

I just learned that if you want to go to the Zune store and buy one 99 cent song, you can't just spend 99 cents. You have to buy $5.00 of "points" and then spend 99 cents worth of points.

Just like Expose versus Flip 3D, Microsoft can't just copy something even when the template for success is right in front of them. They have to copy it, and then tweak it, usually tweak it for the worse, so they can claim to be innovative. (Their word, not mine.) If you're going to take something, just take it, cause you're not fooling anybody. You guys already won that lawsuit anyway.

But in this case, there's more. The points system is a way to take your money and give you nothing in return. If you buy $5.00 of points and buy one song, obviously you leave behind $4.01, or you buy five songs and leave behind $0.05. Buy $100.00 worth of points, and you can buy 101 songs and only leave behind a penny. Everyone assumes there's a breakeven point, even if they don't reach it personally. But where is the breakeven point, exactly?

It just so happens that the numbers 500 and 99 are relatively prime. This means their least common multiple is the product of themselves, 500 x 99. The breakeven point is 500 songs at 99 cents each, or $495.

And you thought your grade school math was useless.

If the Zune store is even moderately successful by global standards, it will have a few million customers. Aside from the lock-in effect of the points system (i.e., no one is going to drop $5 and just buy one song), if each of those customers leaves behind a few pennies, we're talking about at least a hundred thousand dollars - not in revenue, but profit - for which those people received no product!

It's like J Allard was watching Superman 3 when he drew up the pricing structure. (Geez, did you know that's his real name?)

babble + log

This is exactly the problem I have with the "blogging uber alles" crowd. They talk about conversations -- and spend all of their time lecturing. you think Scoble actually spent any time figuring out what was going on? No, he took a sound byte he could play with and started babbling. That's conversation?

- Chuqui 3.0

Sing it brotha! Sing it to the mounTAINS!

Snake Plissken. I heard you were dead.

Hey! There are still practicing Gnostic churches in the world!

Apostolic Johannite Church
Ecclesia Gnostica

I had no idea until now. I thought the Popes had managed to kill them all.

VBScript == teh SuxOrz

VBScript sucks in so many - oh, so many! - ways.

The interaction between VBScript and ADO is particularly non-intuitive and bug-ridden. Let me make a note of this one in particular, before I push it down into the part of my brain where it will become just another mote swirling around with all of the other instances of VBScript sucktitude in my memory.

Sometimes you want to know if a field of a database record is NULL, because some VBScript functions like Replace() will choke if you pass them a NULL field. This does not work:

for objField in rsQ.Fields
  if IsNull(objField.Value) then
    strValues = strValues & "NULL,"
  else
    strValues = strValues & "'" & Replace(objField.Value, "'", "''") & "',"
  end if
next

ASP will crash out saying "invalid use of Null: Replace()" even though the value passed the IsNull() check. This, however, works fine:

for objField in rsQ.Fields
  scratchVal = objField.Value
  if IsNull(scratchVal) then
    strValues = strValues & "NULL,"
  else
    strValues = strValues & "'" & Replace(scratchVal, "'", "''") & "',"
  end if
next

One of the nicest projects I ever inherited was from a guy who had done a site in "old" ASP (pre-dotNet) but he did all of the scripting in server-side JScript. It helped that he was a good programmer, but with JScript you spend less time fighting the language. Unfortunately, you can only combine VBScript and JScript under some narrow conditions, so if you inherit a site already done with VBScript you can't just start writing all of your changes in JScript. Even if you fit inside those narrow conditions at the beginning, you'll probably very quickly reach a point where you need to include some JScript into VBScript at a very specific point or vice versa, and the necessary ordering of the code just isn't going to work out.

What you can do that's better yet is to start a gradual migration to ASP.NET, using this really great trick for sharing session state between ASP and ASP.NET on the same server.

Things I Learned From Cartoons, #28

Any even vaguely boomerang-shaped object can fly thru the air, injure a cat, and then return safely to its owner's hand.

boundlessly accessless

So I made this Blogger/Blogspot/Google Blog account a couple weeks ago, and for the first several days I had been making sure to login to my Gmail account and then go to blogger.com, because I was sure that the Gmail login page is secure, while it's less obvious that the blogger.com login page is secure. The URL is http://blogger.com, not https, and there's nothing in the login form that says "we'll use SSL, promise." As it turns out, they do submit the password via SSL:



If I was only risking access to my blog I might not have worried so much, but I was using a password that, if intercepted, would give someone access to my Gmail. Why doesn't the login page mention SSL? Have we reached an era when people just assume sites are keeping their logins safe? (I hope not, cause it's not a safe assumption.) Or is Blogger just being sloppy?

They should do a show where a family has to live like it's 1895

When you're young, you look at television and think, There's a conspiracy. The networks have conspired to dumb us down. But when you get a little older, you realize that's not true. The networks are in business to give people exactly what they want. That's a far more depressing thought. Conspiracy is optimistic! You can shoot the bastards! We can have a revolution! But the networks are really in business to give people what they want. It's the truth.

- Steve Jobs

As long as people will accept crap, it will be financially profitable to dispense it.

- Dick Cavett

I hate reality tv. If you're watching reality tv and you wonder "how can these people be so dumb/selfish/cruel?", keep in mind that you're not seeing a random cross-section of society. The show's producers have kicked over every damp rock and rotten barrel they could find to locate people who will (a) do anything for money and (2) form a volatile mix of conflicting personalities. And that's just the beginning. TV audiences are finally starting to twig on to the fact that reality tv isn't real.

You may find it depressing to see the dregs of our society being rewarded for being horrible people. You may find it depressing to think about the heartless tv producers who seek these people out, throw them together, and stir them up, like a bloodless form of dog fighting. But the part that depresses me is that we, the collective we, we who watch television, keep watching the dogs night after night. TV producers don't make reality shows because they like them, they make reality shows because they have piles and piles of statistical reports telling them that's where the money is. The average American tv viewer, as measured by the Nielsen system, craves this stuff. We don't turn away in disgust. We don't say "I refuse to reward these people for being cruel to each other. I refuse to reward the producers for creating this crap." Instead we eat it up and ask for more. Why, WHY is there a Flavor of Love 2? Because people watched the first one. We live in a culture where enough people watched Flavor of Love to warrant the creation of a sequel. That's depressing.

If the television medium were a Hollywood starlet, reality shows would be her fake boobs. They kinda sorta look real, everybody knows they're really not real, but everyone keeps looking at them anyway.

I Can See Through Time

Time Machine: incremental backups and rsyncing are nothing new. But if you've ever been responsible for backups you know something about scheduling full dumps versus incremental dumps and layering restores and on and on... it used to be we'd try to come up with clever levelling strategies to optimize our storage space, but now storage has gotten cheap enough that I think everybody just does level ones all week and full dumps on Sundays.

Normally this is where we say "if you've ever tried to walk your mom thru doing X you'll appreciate how Apple makes it easy" but no one I know has EVER tried to walk their mom thru restoring a level zero and layering the most recent incremental over it. That's one of those things that (assuming you make backups for your parents) if you ever have to do a restore you just drive over and do it yourself, stopping for a six-pack on the way there and a fifth on the way home.

Is Time Machine the silver bullet so that now Mom can restore her own backups? Too early to say, but I think there's a chance. I think the interface to Time Machine is pretty damn clever. Obviously each of those windows in the stack stretching off to infinity represents a checkpoint on the backup volume, and you can browse them or search them, and when you find the file you want just drag and drop it back to the present. The slider on the right lets you zoom into the past, but it also lets you zoom back to the present, recovering windows that you had previously popped off the stack. Without that slider the windows would have to be represented as some kind of carousel instead of a stack, and would be much more difficult to navigate a la Fanta's Expose knock-off.

Even assuming Time Machine is every bit as effective and intuitive as its proponents say, is this going to change the face of computing? Of course not. It will "just" be the best backup and restore interface ever. Oh noes! Damn you Apple! I was expecting nanobots that trim my lawn while factoring prime numbers with XGrid!

It's like Dashboard. When Dashboard was previewed the majority response was "oh, it's just eyecandy." But if you actually use a Mac, every day, Dashboard is a great convenience. Just by throwing my mouse into a hot corner (another simple convenience that I love) I can see the weather, football scores, and the stock market, and also have a dictionary, a calculator, and a phone book. Flick the mouse into the hot corner again, and I'm back in my work environment.

Actually I'm not here to apologize for Time Machine or for Dashboard. The underlying theme here is Apple's products, their "innovation", and people's expectations. I think sometimes Apple is part of their own public expectation problem. Dashboard is NOT the centerpiece of anyone's workspace, and it was never meant to be, but when Apple trots it out they make it sound important enough to be a centerpiece. In a way you can't blame them - their people worked hard on these things and they did a great job and they deserve to have their work showcased. But if Apple made a toaster, they'd act like they'd invented bread.

The upcoming Web Parts feature is another example of the same phenomenon. I think Web Parts is going to be a great convenience for me - I anticipate making widgets so I can keep up with an auction or a discussion board or football games or anything else I feel like watching during my day. But if you watch the WWDC presentation, you kind of come away with the impression that Web Parts are so easy and so cool and so much goddammed fun that Apple expects us to spend all day every day making Web Parts. They don't say it, but the grandeur of the presentation is such that you just feel it. But really the exact opposite is true - Web Parts are supposed to be easy so that you don't spend all day making a widget. You make one in seconds and throw it away when you're done with it exactly because you didn't pour your sweat into it.

Part of the enjoyment of using a Mac is the sum of all these conveniences. I can read my mail with Thunderbird on Windows. I can browse the web with Firefox on Linux. But the sum of Expose and Dashboard and Spotlight and Quicksilver makes me happier and more efficient during my day.