I have a small request to make of the NC-DOT, if there are accidents on the interstate at I-40 and I-540 which backs traffic up 10 miles to NC-751, can we please, please make use of the expensive electronic information signs on the interstate to warn people? There’s a difference between a small traffic slowdown that you will soon get past and one that means you’ll be driving 5-10 miles at an average speed of 10-15 mph.
August 22, 2006
August 19, 2006
August 17, 2006
Friday, er, Thursday Snake Blogging
Took the day off and spent most of it working on the snake terrarium. Watching him pace (hmm, that doesn’t seem like the right word for a snake) his cage today made me particularly sad and motivated me to get about 95% finished. He could actually move in now – the only things missing are the decorative frames around the side vents. Overall, I’m pretty happy with the terrarium. There are a number of things that I would do differently next time, but some things will definitely stay the same. For example, I used plexiglass for the front which made the whole thing significantly lighter. The plexiglass was about $20 more expensive but definitely worth it. And here’s the (near) finished terrarium. Next time I post about this, we’ll be completely done and have the snake moved in.
In other snake news, K caught a picture of an eastern hog nose in its red phase in our front yard last week. S/he’s an absolutely beautiful snake. In case you can’t quite tell from the picture, the snake is extremely red at the front and it gradually fades to yeallow at the tail. Your science tidbit for the day: the eastern hog nose eats the occassional small mammal, but is particularly well adapted to eating frogs and toads. As you can imagine, the amphibians don’t like being eaten and have a tendency to inflate to prevent a snake from swallowing them. The eastern hog nose has its fangs in the upper back of its mouth. These fangs are used to paralyze and “deflate†a swollen frog to enable swallowing. The eastern hog nose apparently also plays dead if it can’t drive off predators. When it plays dead, it goes limp and sticks its tongue out – which, IIRC, is how I played dead when I was five.
August 15, 2006
August 14, 2006
things that make a security officer cry
I spent a lot of time last week looking at an application in order to assess its security. The thing that was troubling me was that this is a web application and the primary form for data entry was defined like:
form name=â€foo†method=â€post†action=â€â€
This means that the nothing happens when you hit submit on the form – at least not in the html world. So, I took a closer look and found that each of the buttons (submit and clear) actually had a field “onclick=’doSomething();’†attribute.
Okay, so we’re dealing with javascript. I can handle that. I grab the included javascript file and realize that I’m dealing with something exceedingly strange. The whole script is one line long and contains very little valid javascript. Instead it contains what looks like a brief function, a ton of line noise and a bunch of words at the end that are delimited with pipes (|).
Since it’s my job to be paranoid, I think, “ah ha! someone has something they’re trying to hide.†It takes me a bit, but I realize that the java script is actually an eval function with a number of arguments. Poking at the arguments, I realize that one is the line noise, one is 62, one is an array of words and one is the number of items in that array. The code at the beginning basically unparses the whole thing. It breaks the line noise into tokens. The tokens are indicies into the array in base 62! Base 62 b/c you can use numbers and upper and lower case letters for each digit.
The code takes all of the tokens and replaces them with the word in the right position. It then runs an eval() of the whole thing. Armed with this, I alert() on the final command, only to find that the whole thing is a fairly simple client side validation and Ajax based POST. There’s absolutely nothing sensitive there!
*sigh*
Update: spoke to the developer. This wasn’t an attempt at obfuscation, it was actually a test of a program he downloaded that is supposed to be a javascript accelerator. It accelerates by creating a smaller version of your javascript so it downloads faster! Never mind that it then takes 5 seconds to unpack the stupid thing. ðŸ™
August 13, 2006
Memo to the left hand
To the left hand: It is clear that you no longer know what the right hand is doing. This weekend’s “accidental†dremeling was eerily similar to the wood carving incident in grade school where a supposed “art project†resulted in losing a chunk of left index finger. Combined with the great butcher knife massacre where we almost lost left thumb’s nail when it “supposedly†looked like a carrot, we have a pattern that can not be ignored.
These incidents will likely continue until we become the dominant hand and end the right hand reign of tyranny. That is all.
August 12, 2006
Get your woodworking geek on
Just so you don’t think that I’m just a computer and photography geek, I wanted to update folks on another project. As I’ve said before, my wife does wildlife rehabilitation and managed to get conned talked into taking home a boa constrictor. Since they’re not native, he couldn’t be released once he was patched up.
For the past eight months, he’s been living in a smallish (75 gallon?) aquarium. Okay, that’s not really small unless you’re a 6.5′ snake whose looking to get to be 8’+. This presented a great chance to do some woodworking. For the past couple of weekends, I’ve been building a 5.5′ x 2′ x 3′ terrarium for the snake. I’ve got the main walls, floor and top cut, stained and coated with many layers of polyurethane. Today, I put the cabinet together, caulked it (the caulk is still fresh, it will dry clear) and started working on the door.
Overall, I’m happy with how it is turning out. Hopefully by next weekend, the door will be complete and mounted and the snake’s furniture (water and food bowls, hide box and heating pad) will be here and we can move him in.
Oh, and for those whom know our family history with tools, I managed not to injure myself until tonight when I dremeled my fingernail and gouged the finger. I don’t think it’ll need stitches.
August 10, 2006
August 8, 2006
Vacation pictures
The vacation pictures checklist from earlier:
- Get 22 rolls of slide film back from the developer [Check – received mid June]
- Put 800 slides into transparancy holders so they are easy to look at on the light box [Check – took two nights]
- Go through 800 slides to determine which are worth scanning [Check – took another two days]
- Scan 120 or so “good†slides [Check – finished tonight after three nights of scanning]
- Color correct the images in the GIMP [done]
- Remove dust from scans because my slide scanner doesn’t have an infrared channel [done]
- Upload the results and put ’em online [finished today]
Everything is done! Pictures online finally. For the record, I’m not thrilled with them. My biggest complaint is that there aren’t really any good animal shots. This is different from prior years. I blame oversleeping.
a nomenclature question
given that the vulnerability and the patches haven’t yet been released, does this constitute a “-1 day exploit?â€