Side Channels

Last night I happened to watch Rambo: First Blood. Of course, this is not the first time I’ve seen it, but it has been a while. The cruelty these vets suffered from the population upon their return always struck a chord with me. For the record, Rambo I is a good movie; it has what we would call today “moderate violence” and a decent message and dialog (unlike its successors). I dare say that even the acting was good. These were the times where they (Hollywood) had to produce a good script because they couldn’t distract the audience with visual effects like they do today.

Anyway, I remembered that as a child and young teenager, I was convinced that the Vietnam War was invented by the movie industry as a ruse to produce war movies. I think I had the notion of this “fake” war because I only heard about it in the movies. Then I grew up and found out the sad truth. In Israel, they didn’t teach us about these wars; we had plenty of our own.

While the idea of a world without children appeals to me, I can recognize the tragedy of such a world. Children of men is a movie set in one such world (adapted, loosely I am lead to understand, from a similarly titled book by P.D. James.) This is one of those rare movies that I recommend without hesitation… “just go see it,” I say, since anything I add will detract from the experience. I have not seen the trailer before the movie, but if you do, I think it does not do the movie justice.

Just go see it!

Incidentally, the movie opened here in the UK a few weeks ago, but apparently will only open in the US on December 25^th. So, you US folk have something to look forward to aside from seeing the awesome Bad Santa on some premium channel.

A food vending machine, similar to the one on the right, was recently installed in the lab. It’s been giving us some trouble lately. Mostly the common failure mechanism of not supplying goods despite cash. The trouble is with the sliding door. A special—undocumented, mind you—procedure needs to be followed in order to get goods.

1. position tray to desired item.
2. insert cash.
3. slide door until stuck and release (it does not open all the way; this is to indicate to the machine which item you chose so two or more doors could not be opened simultaneously.)
4. slide door open again.
5. get item.
6. enjoy crappy food specially designed for graduate students with no life who need them to survive at night.

I asked Robert Watson (who was already home) though our irc channel if the machine is “safe.” He replied that it was wholly functioning earlier today. Knowing this, I ventured to get a muffin with confidence. I came back with a muffin but still screwed out of cash. I posed the riddle to Robert:

21:38 < rwatson> saar: so something that results in you getting screwed, yet still getting the muffin.

21:38 < saar> rwatson: yes. and it only involves the machine, not other people ;)

Can you guess what happened? It’s a tough one.

I only had one gigantic 2 GBP coin and I inserted it into the machine. Following the procedure above, I also got my double chocolate muffin. Happily, I was futzing around with the sliding door to examine its spring rigidity and the option of invading another compartment ;) Little did I know that since I had a 1.2 GBP credit, the machine charged me 80p AGAIN! So, I payed for that damn, unhealthy, fatty muffin TWICE!

Clearly a design error (NOT user.) I think I’m going on an 80p rampage a la Payback!

Yes, I’m talking about Miami Vice! The best actors of Hollywood team up to give us a thrilling ride, full of depth and introspection. We’re going to get a rare glimpse into the lives of the people who make this world safe (it’s based on a true story, the original Miami Vice TV series.)

Some notable quotes:

Foxx: There’s “undercover” and then there’s “which way is up.”
Ferrell: You think I’m in so deep, I forgot?
Foxx: I never doubted you.

and

Chief: Things get emotional, moves get messy; moves get messy and the wrong people die!

Deep stuff! I’m SO going to see it!

(OK, so I think I’m going to have some trouble getting someone to come see this with me, if there are any volunteers out there, let me know; we can negotiate how much I pay for your ticket ;)

A good friend, Nir, has sent me a link to a website he’s been working hard to make and promote: BidTheGrid. He launched it less than two weeks ago and it looks like people are showing interest. The idea is interesting and site is well done… but after my last poor attempt at making predictions for the success of such internet fads, I’ll end with wishing him good luck.

Skype’s great; no need to deliberate on that any further.

Yet, skype developers, I have one major issue, one minor and one feature request.

Major: once I grant other users the privilege to see my “online status,” I can not revoke it. Ever (for that UID.) I may remove them from my contacts, or even block them, but they can still see me. That bothers me. I’m not sure what’s going under the hood, but it would make me feel better if I can revoke the permission. Anyone of us can easily think up scenarios why this would be desirable.

Minor: There is no need to show how many contacts I have as part of my profile. It is permissible to have no other info than the UID on one’s profile but this piece of (private) info always appears. Easy fix.

Request: I’d like to assign different “online status” to different users instead of a common one for everyone. Some people, I wouldn’t mind bothering me anytime, some I’d like to be invisible forever :) This will also help with my first concern above. It can probably be done through grouping; even two groups will suffice.

There you have it.

I enjoy Billy Joel’s music. There, I said it in public. I used to be too cool to admit it, but no longer. I liked Joel’s schmaltz as a teenager before I graduated to heavier stuff, so it always reminds me of those years. But seriously, I still enjoy his music today in moderate doses.

My parents, brother and his girlfriend were here and we went to see the “Movin’ Out” musical from Broadway that is now showing in London. There’s a band on a moving platform, a singer who’s no real match to Joel and a bunch of dancers on stage. You can see it’s a major production, but there wasn’t much substance there; some key hits were glaringly missing too. It had a loose story connecting the dance segments (Brenda and Eddy from “Scenes from an Italian Restaurant” fame) with Love, war, betrayal… the usual story, portrayed though the lyrics and dance. What can I say? That just doesn’t touch me; I just can’t seem to appreciate this stuff. All I can think of is that engineers are just as talented as these dancers, but no one is buying tickets to watch them work, or clap, or give a standing ovation. I just wish. Somehow “Live FPGA verilog coding” show on Broadway wouldn’t survive more than 10 weeks :)

Well, “Brenda” was quite pleasing to look at, so that was a plus. However, there were two soft-porn themed segments that were a little over the top to my taste. But “I’ve let it slide” while noticing that one of those segments was during “Captain Jack” with this verse cut out:

Your sister’s gone out, she’s on a date
And you just sit at home and masturbate
Your phone is gonna ring soon, but you just can’t wait
For that call, hmm

So you stand on the corner in your new English clothes
And you look so polished from your hair down to your toes
Oh, but still your finger’s gonna pick your nose
After all, hmm

Hmmm, indeed! Mostly naked women molested on stage, and singing about masturbation and nose picking is just too much to handle. OK.

It’s all over the place; the aftermath of “Trapped in the closet” South Park episode (view here.) Links to get up-to-date on this incredibly logical and attractive cult: scientology, operation clambake, evil Xenu, costs and illustrated history of scientology [PDF].

I’ve spent a few hours reading into this bad joke (actually, a joke would be a compliment) and it occurred to me that there are a lot of similarities between its ways and hollywood.

- Scientology (S): First 6 months free without giving you any of the details… these are only revealed piecemeal as you pay to go through the ranks. Preconditioning.
- Hollywood (H): The trailer.

- S: Large sums required to get in the know, only to find out it’s utter crap ($360K, to be exact.)
- H: The movie.

- S: The shittiest plot ever. Come on! DC-8’s with jet engines? In space?
- H: Doesn’t need explanation.

- S: Congregation of rich people who think that they are the best thing that ever happened to this world/universe/man-kind.
- H: The Oscars.

- S: Out of touch with reality.
- H: Well, hollywood.

Now, I ask you, is it any surprise that the feeble minded hollywood folk are buying into this? Literally, they are spending their easily earned money on this Xenu story. Lafayette Ronald Hubbard, the creator of this establishment said in 1940, “Writing for a penny a word is ridiculous. If a man really wants to make a million dollars, the best way would be to start his own religion.” THEY STILL PAY UP!

Cryptonomicon by Neal Stephenson

When I mentioned to a friend that I’m reading Cryptonomicon, he asked “what took you so long?” Good question; I was offered the book twice before and refused. Why? It’s too damn long. 900 page. Being a slow reader (~225wpm, I’m working on it, btw) I shy away from these long books because I know it will take me ages to finish them, if ever. This problem also makes me think very hard before committing to a book, so I basically need to know it’s good before I read it. It’s really hard for authors to get into “Saar’s book club” (unlike Oprah, I do my research…) For example, Michael Crichton has been accepted to the club long ago (but he’s on probation now because too many of his books were made into Hollywood movies and his latest ones seem to be solely written for that purpose.)

All of this is a long winded excuse for not listening to JJ and HS and grabbing this book earlier. It called to me from the library shelves of my designated college here in Cambridge (Darwin), so in a moment of determination I checked it out. It’s fantastic. It’s been a week of low productivity and long nights trying to finish the book and I enjoyed every minute of it. I needed to get back to my “regular” schedule so today I had a reading marathon and I’m done.

It’s been a long time since a book occupied my mind even when I was not reading it; it’s one of those books that make you want to go home early, make some tea and read for hours. I won’t give a description of the book because I can say without reservation “just read it!”

SaarStars: 4.5/5
(Half a point dinged for the length and the unanswered questions left open despite it!)

P.S: Stephenson has written a prequel trilogy called “The Baroque Cycle” that takes place in the 17^th and 18^th centuries with the ancestors of the characters in Cryptonomicon. Each one of those is 900 pages long; I shouldn’t get near that library if I want to finish my PhD on time :)

P.S.2: I do realize that this is not a proper review, more like an order to go read a book. But, most of you know me and my style, so based on that and other reviews, you can make up your mind.

Since it got some decent reviews, I went and saw King Kong. I expect very little intellectual stimulation from Hollywood; However, I do anticipate some entertainment. This movie provided neither. It’s a 3 hour boring, sleepy experience in 3 acts… 1) get to secret island 2) stun and haul KK to NYC and 3) Kill KK… each phase taking about an hour. Yawn.

I heard a guy on TV say that “King Kong is the state of the art in special effects at the end of 2005.” And here lies the problem. I first realized it while reading Maddox‘ insight on Star Wars III:

NEWS FLASH: Episode III had no special effects.

They’re not “special effects” anymore when they’re found in EVERY SCENE. Lucas has done the seemingly impossible: he has made something that was once so unique that people called it “special” by name, and turned it into something so ordinary that nobody raises an eyebrow during a scene where a guy is having a sword fight on the back of a giant beast.

Fact is, there is no more “special” in “special effects.” What used to “wow” us and covered up for crap storyline and bad acting is over. King Kong is the ultimate example since the CGI is the story here, not anything else. They had 3 hours of good CGI and they stretched the story thin to accommodate it. The b-level actors didn’t help either. Hollywood is busy blaming everybody else for their losses except themselves for producing crap, but now the “special” well has dried up too.

I’ve learned another important thing from this movie: people run as fast as giant apes and dinosaurs. The movie accurately shows, in many a scene, that this has to be true. The scientific community is taking note.

Ari Paparo’s article explains the failure of Blink.com to become the del.icio.us of today back in 1999. He is lamenting now that Yahoo! purchased del.icio.us (for $25mil?) about what he and his colleagues failed to see back then. It is always refreshing to read people’s account of failure without them throwing dirt at the ones that succeeded… saying stuff like “we were wrong” instead of… “they are idiots with a lot of luck” or “we were visionaries before our time.” People who can do that, like Ari, are commendable…. I thank him for the insights.

I like Reddit; I was skeptical at first, but it won me over. I don’t bother that much with slashdot or digg as much as I used to. The simple interface, no comments and up/down moderation is the right combination.

Things have changed at Reddit in the last few months due to increase in users, — I’m not talking about the conversion to Python, a fact that I couldn’t care less about, but seemed to rock that little world for odd reasons — you can no longer get karma boosts from random news articles from BBCNEWS or CNN. This is a good thing, because if I want news articles from them I’ll go there directly, I don’t need Reddit as the middlesite.

The flip side is that these days literally every post from some weblogs are being submitted and moderated up. Examples are Dilbert, Schneier, Paul Graham and freaknomics to name a few. These are the best blogs around, no doubt, and highly popular (yes, I know Graham’s not a proper weblog.) Do we need Reddit to keep linking to them? Once or twice is enough, the rest I can get directly if I like it. It’s clogging the nice interface. When I see articles from popular weblogs (some of which I read,) I moderate the link down regardless of how I liked them (Adams’ and Graham’s posts are consistently awesome, but I still moderate them down.)

In short, I want Reddit to inform me of original content I wouldn’t otherwise get to. It does. Some of the time. Linking and encouraging links to highly popular weblogs/news outlets is not going in the right direction.

The other thing that bothers me is the incestuous self feeding at Reddit. Think about slashdot linking to itself, or to an article saying how great it is. Legitimate, but unpleasing. I can’t figure why people moderate these posts skywards. Early on, I submitted “reddit.com” just to see what happens… people moderated me down to oblivion.

So, are you a karma junky? Why worry about how the algorithm works? Link to Reddit praise, Dilbert, Paul Graham or Bush bashing.

My current Karma is 230, I’m going to link to this post, I’ll update what that figure looks like after the hoards of Reddit zealots find this offensive or informative. Who knows. Who cares.

Subtitle: Controlling the Human Element of Security.

Kevin Mitnick is a talented social engineer with a frank admission that some of the myths regarding his activities are simply not true. “Social engineering is the practice of obtaining confidential information by manipulation of legitimate users.” In this (3 year old) book Mitnick outlines social engineering attacks and recommends how to help prevent them, or make them more difficult to execute. The book has some organizational flaws that make it both fascinating and boring.

The first thing I learned when “they” tried to beat English writing into me in college was to define an audience. Mitnick hasn’t done that; his audience range from the casual reader through a security professional to a social engineer looking for new tricks. This book should have been split into two shorter volumes. One with a description and storytelling of social engineering attacks for the casual interested reader (fascinating) and the other for information security professionals who are looking for a guide on how to manage information vulnaribilities (boring.)

So, if you got the time and interest in social engineering, I’d read the first 2/3 of this book. If you are someone looking for defining a security policy for your corporation, you’d probably be better off with a book dedicated solely to this topic (or read the whole book as a good addition.)

If there is one sentence you should take from this book, this is it:

“The truth is that there is no technology in the world that can prevent a social engineering attack.” p.245

SaarStars: 2.5/5

Authors: Kevin D. Mitnik and William L. Simone.
ISBN: 076454280X
Amazon, BN
Kevin’s company: kevinmitnick.com

A 21 year old came up with a clever idea to cover his university fees and still be left with (lots of) change. The result is theMillion Dollar Homepage. This is another one of those internet fads that have an interest spike that quickly trails off. However, the original innovator gets to make a good sum of cash in the process, while the imitators don’t get to make much, if any, money. I doubt that the guy will be able to cash-in more than $20K or so before the interest dies out. (This prediction excludes the chance that goldenpalace.com would buy a banner size ad from him, of course; they are the ones who bought the 10 year old “virgin mary grilled cheese sandwich” and other crap on ebay for publicity.) Still, that’s good profit for a good idea like that. I wish him all the best and once again, disappointed that I did not think of it myself.

(imitators here and here.)

Maybe I should have my own “The $1000 For Your Name On The Thanks Section Of My PhD Thesis Homepage” to fund my studies. You think that would work?

Paul Graham, who writes magnificent articles IMO, ran his “summer founders program” this summer. He gathered people with ideas he thinks are worthy of investment and gave them seed money and an incubator style development setting (9 companies in all, IIRC.) I wished I could have attended it, but it didn’t work out. One of the resultant websites is Reddit. From their faq:

A source for what’s new and popular on the web–customized for you. We want to democratize the traditional model by giving editorial control to the people who use the site, not those who run it. All of the content on reddit is from users who are rewarded for good submissions (and punished for bad ones) by their peers. You decide what appears on your front page and simultaneously, which submissions rise to fame or fall into obscurity.

Basically, you submit links to what you deem interesting and others vote on them. If they like them you get more “karma” points, if they don’t you lose them.

I gave it a try and was moderately successful until I thought it would be clever to submit “www.reddit.com” itself (hey, would anyone vote against it???) Other users didn’t think that was clever at all and I was demoted to the rank of scum; I guess people didn’t want to give me any shortcuts, fair enough . I then recovered some, but it still hurts my geek pride. (my user name is “elric” if you want to raise me to a very short-lived obscure stardom.) I am not sure how they prevent geeks with nothing else to care about from registering multiple accounts and self-promoting themselves. Maybe they don’t care because they rely on many concurrent users that would make that scheme ineffective. I really liked the simple layout of the webpage and that there are no ads. I think I’ll give it another serious look when there are more users participating since I think their overall algorithm and scheme relies on it; it will then be a bit more live and dynamic. Give it a look.

All considered, it’s a nice concept to play with for a little while but I think I’ll stick with Slashdot for now. I did find some very interesting articles that I would not have otherwise, so that was refreshing.

I wish the founders all the best with this interesting endeavour. Good job.

The airline industry is very interesting. I’ve always found their structure, incentives and operation intruiging. The way they structure their airfares is a mystery. I mean, you can sit next someone on a plane who paid 10 times the amount you paid, for the same seat. You can also fly within Europe for 1 Euro with the cheap fare airlines.

Over the years, I’ve purchased many tickets online. I found that when looking for the best fare, you must check with all online travel sites. There is no single site that has the best fares everytime. Sometimes I found the best fare on the airline’s site itself (United.com, round trip to London from San Francisco for $450 last summer.)

The following are webpages I typically visit:

QIXO is a little known “airfare search engine” that gets the best fares from many sites. I found great deals here and is where I go when I narrow down my travel times. It also works for travel not originating in the US. They charge $20 service fee.

orbitz.com has two advantages: It can search +-3 days and mix and match airlines for your route which is often convinient. However, the trip must originate in the US.

travelocity.com/yahoo travel has a flexible date search that is very good if well, you are flexible on the dates.

expedia.com, cheaptickets.com and the others have nothing special about them, but are required when you are airfare hunting (for my next trip, I found the ticket on expedia.)

ryanair.com and easyjet.com are the cheap airlines of Europe. They fly to main cities, but to the more remote airports than the main hubs. Airports like London Stansted, Oslo Torp and Frankfurn Hahn are 2-3 hour bus ride from the city centers and main airports.

Virtual Network Computing (VNC) is one of the most powerful tools in my arsenal. Simply put, it lets you control another computer remotely. It is fast, nimble and intuitive to use. I often find myself “revealing” this tool to coworkers and friends in order to make their life easier by helping them remotely connect to their home computer, not to go to the lab for every little click and even work from home.

At Xilinx, I developed and ran the Rosetta experiment. This experiment measured the frequency of FPGA configuration bit flips caused by ambient radiation. These occurances are called “Single Event Upsets,” or SEUs. The experiments ran remotely 24×7 at various elevations: San Jose (California,) Albuquerque (New Mexico,) Mauna Kea (Hawaii) and Barcroft Station (California) which is part of the White Mountain Research Station near Bishop. These many experiments were all in the network (some using VPN) and were controlled using VNC from my cubicle desktop; I was able to do almost anything from my cube (unless the network was down.) I designed the experiments to be nearly autonomous, emailing me when any problem occurred and keeping meticulous logs for analysis. This was a great project to develop.

Our group’s lab was a 5 minute walk away, and often it became tedious to do it hundreds of times a day. At the beginning of an experiment I installed VNC on the lab machine and was able to run or monitor most of the activity from my desktop once the experiment was setup. Adding the powerful capabilities of ChipScope on-chip logic analyzer made it even better.

Many versions of VNC are available, such as RealVNC, TightVNC, UltraVNC and more. The basic editions are free.

A couple of good friends are getting married next week. They met through match.com nearly a year an a half ago. We discussed the success stories these dating services have on their webpage. Some stories tell of couples getting hitched within a month or two and swear that they have found the love of their lives. Alright, maybe. The first few months of a relationship are always the most exciting. However, if you get married during that time it is most likely a result of the daze induced by the prospect of true love. No one should be making life altering decisions under these circumstances. Yet, people have been doing that since before the dating website boom.

The ultimate goal of these services is to get people married. The more marriages, the better the supposed “matching technology” is. eHarmony.com has been pushing their “Compatibility Matching System^TM” pretty hard lately. However, my intuition tells me that all told, they have quite a significant contribution to the eventual divorce of these couples.

Let me explain. People have a tendency to believe marketing hype. It should be expected that fresh and madly in love couples will believe that the unbeatable matching “technology” can not possibly be wrong in their case. After all, the numerous testimonials prove it to be extremely effective. This extra (and mostly false, IMO) confidence will expedite their decision to get married where otherwise they would have waited and perhaps concluded that they might not be perfect for each other after all. I did not do a thorough analysis by any means, but my guess is that overall these “technologies” increase the percentage of failed marriages by providing a false sense of confidence at the initial stages of the relationship.

Oh, and another thing…
Shortly after spending $30k on a wedding, the previously “inseparable” couple decides that marriage wasn’t such a great idea and get divorced. Now separated, they never bothered to delete or edit the raving testimonial on getmarriedfast.com; there, they will forever be a success story of the unbeatable “marriage4sure technology^TM.”

Through /. I was informed that google released it’s toolbar for firefox. Fine, no reason to get excited. Or is there?

Well, there is for me because I found how it is going to make my life a whole lot more convenient: It can spell check forms. It will also give you suggestions for correction (in 10 languages!) in a very user friendly manner.

This means that when I write new posts in Wordpress, I can spellcheck them right away in the edit window. Previously, I cut+paste the post to my mailer, spelled checked and cut+paste it back to the edit form.

_{(I’ve used the toolbar back in the IE days, so I am not sure of this feature is totally new to this version or not; but it is to me.)}

There are currently 221 reviews on amazon for this book, so I won’t attempt at a long winded one.

This book was a joy to read; light, fun and very interesting. It was clearly written to be a best seller. It lively reports the conclusions of the authors after analysis of data collected by various agencies and organizations. Questions such as do parents really matter, why real-estate agents sell their own house for more than they sell yours, is there cheating in Japanese sumo wrestling and why drug dealers live with their moms are answered. One chapter explains why legalize abortions led to drastic crime drop during the 90’s. The answers are purely derived from database analysis.

The authors encourage the readers to ask question and try to figure our the answers, both based on the stimulus from this book. What they fail to mention, is that data mining is typically boring, tedious, hard and often inconclusive; far from glamorous. But that would have distracted from their enthusiastic portrayal of Levitt’s profession, economics, and that is perfectly legitimate.

I often evaluate books by their index. This book’s is pretty good, although “Israel,” for example, appears several times in the book, but does not in the index. So I’d give it an “index rating” of 4/5.

Other than that, it would be nice if the book was double in length; I had appetite for more.

SaarStars: 4.5/5

Authors: Steven D. Levitt, Stephen J. Dubner.
ISBN: 006073132X
Amazon, BN
website: freakonomics.com