Open invitation - I am using Microsoft Outlook 2003. This is an open invitation to you, the Internet populace. I dare you to send me an email message (rgautier@cox.net) that infects my computer with a virus/trojan/malware through my email client. Obviously, I won't be clicking on any attachments...so if you're going to prove that Outlook is such a security risk, you'll have to do it without my help. Prove me wrong - show me why I'm an idiot by using Microsoft Outlook - send me a virus that will execute just by my receiving it. Make it as in-your-face as you want - format my hard drive...go ahead...
Now, if you haven't just sent me that email - SHUT UP about Outlook being an insecure mail client. You are just repeating rhetoric and you don't really understand the issues. Why do I use Outlook? Because I can - safely...and it lets me easily do what I want to programmatically. I like it - it's a nice interface, and it does what I need it to do. And Bob? I didn't mean you buddy.
March 31, 2005
Wonderful Helpful Outlook - NOT!
I use Outlook 2003, and Im not ashamed to admit I use Microsoft products. Sure, I'm a geek, a programmer, a Unix guy and all things Slashdot and Fark, but it boils down to usefulness. I have to say that I've never been infected by a virus or trojan because I use Outlook. I keep my system patched and I don't run executables that people send me - I'm a safe emailer.
Now, with that out of the way - the saga begins. As some of you know, I play chess at the Free Internet Chess Server (FICS). One of the options at FICS is to email your games to you in PGN format. I had briefly discussed this here on my blog, and I wrongly blamed the FICS software for sending me corrupt PGN games. Last night, user DAV at FICS helped me find the root of the problem, and it wasn't FICS at all. It was Microsoft Outlook trying to be helpful. As usual, good intentions lead to bad results. The solution is to tell Microsoft Outlook not to help you...
Microsoft Outlook seemed to feel that any line of the chess game that started with a check (+) in the first move of a word-wrapped line needed to be cut twice and the move repeated. Don't ask me why...who knows who wrote the stupid line wrap-insertion code for Outlook or what drugs they were on at the time. Suffice it to say that inserting extra moves into the middle of a chess game is not conducive to computerized analysis.
The solution is to tell Microsoft Outlook not to help you, by unclicking an option in the mailer called 'Remove extra line breaks in plain text messages' - which, by the way is NOT what it's doing, since there ARE NO LINE BREAKS in the pgn file that FICS sends out. To set this, go to Tools|Options|Email Options and uncheck the box about a third of the way down labeled [Remove extra line breaks in plain text messages]. Now, this will appear to corrupt all of your game emails without the option to repair them with the manual [Restore line breaks] option. To make it effective, close Outlook and re-open Outlook.
Amazingly, all of your emailed games will now be magically fixed. This was important since I wanted my Outlook to automatically process this inbound mail and send it to Crafty for analysis, and post it automatically to my website when it was done. Now I'll be able to complete that little project.
Now, with that out of the way - the saga begins. As some of you know, I play chess at the Free Internet Chess Server (FICS). One of the options at FICS is to email your games to you in PGN format. I had briefly discussed this here on my blog, and I wrongly blamed the FICS software for sending me corrupt PGN games. Last night, user DAV at FICS helped me find the root of the problem, and it wasn't FICS at all. It was Microsoft Outlook trying to be helpful. As usual, good intentions lead to bad results. The solution is to tell Microsoft Outlook not to help you...
Microsoft Outlook seemed to feel that any line of the chess game that started with a check (+) in the first move of a word-wrapped line needed to be cut twice and the move repeated. Don't ask me why...who knows who wrote the stupid line wrap-insertion code for Outlook or what drugs they were on at the time. Suffice it to say that inserting extra moves into the middle of a chess game is not conducive to computerized analysis.
The solution is to tell Microsoft Outlook not to help you, by unclicking an option in the mailer called 'Remove extra line breaks in plain text messages' - which, by the way is NOT what it's doing, since there ARE NO LINE BREAKS in the pgn file that FICS sends out. To set this, go to Tools|Options|Email Options and uncheck the box about a third of the way down labeled [Remove extra line breaks in plain text messages]. Now, this will appear to corrupt all of your game emails without the option to repair them with the manual [Restore line breaks] option. To make it effective, close Outlook and re-open Outlook.
Amazingly, all of your emailed games will now be magically fixed. This was important since I wanted my Outlook to automatically process this inbound mail and send it to Crafty for analysis, and post it automatically to my website when it was done. Now I'll be able to complete that little project.
March 29, 2005
Everything is the Same
It all runs together after a while. Especially after 38 years, and I suspect it'll run together even more as I get older. When I go to the movies, it is rare there is anything new or unexpected in the plotlines. When I listen to music, it is very rare that I hear anything truly unique. As I read other's blogs on the 'net, they all begin to look the same.
People all shop at Walmart, Sears or Kohls for their clothes. Men's suits and slacks all look alike. Even bikinis are all extremely similar, and I'm beginning to wonder about my sanity because even the bikini fillers are all the same ole thing.
Perhaps I have an innate need for new things because of my desire to always be learning something new. The world isn't so much letting me down as it is pandering to the young blood. Everything old is new again - to them, the next generation. Meanwhile we old people have seen it all before. My son, now 11, is ga-ga over Metallica and Black Sabbath songs from the 1970's era. To him, this stuff is brand new. He's learning to play electric guitar, and this is just the coolest stuff. To me, it's nostalgic.
If you're reading this, I hope I'm not boring you. I know that I can get into a funk and that it rubs off on the blog.....I'm just trying not to feel so old....and I could ramble on for a real long time here....but what's the point? I'm sure if you go back in my 5 years of archives, you'll find a similar rant...there hasn't been anything truly new or interesting since the invention of the World Wide Web.
People all shop at Walmart, Sears or Kohls for their clothes. Men's suits and slacks all look alike. Even bikinis are all extremely similar, and I'm beginning to wonder about my sanity because even the bikini fillers are all the same ole thing.
Perhaps I have an innate need for new things because of my desire to always be learning something new. The world isn't so much letting me down as it is pandering to the young blood. Everything old is new again - to them, the next generation. Meanwhile we old people have seen it all before. My son, now 11, is ga-ga over Metallica and Black Sabbath songs from the 1970's era. To him, this stuff is brand new. He's learning to play electric guitar, and this is just the coolest stuff. To me, it's nostalgic.
If you're reading this, I hope I'm not boring you. I know that I can get into a funk and that it rubs off on the blog.....I'm just trying not to feel so old....and I could ramble on for a real long time here....but what's the point? I'm sure if you go back in my 5 years of archives, you'll find a similar rant...there hasn't been anything truly new or interesting since the invention of the World Wide Web.
March 27, 2005
New Skin Available
I put together a skin called Piano800 (a new stylesheet - use the skin selector drop down at the top of the blog.) The skin is designed for 1024x768 and 1280x1024 screens, which covers the majority of folks. The image isn't one that resizes well, so I didn't make it a resizable skin (like the default skin). I'm going to work on a skin that resizes through all of the dimensions next, probably. It's going to requires some planning. The skin is cool looking though if you have one of the afore-mentioned screen sizes....took me a few hours...working with the CSS to make it just right...and making the image. Much of the time was spent tweaking 5px here, and 5px there.
March 25, 2005
Deploying ASP.NET Apps with Integrated Security
At work we're in the midst of deploying an ASP.NET application using Integrated security (using impersonation - <identity impersonate ="true"\> is the tag, btw). This allows us to develop the application securely using Windows accounts, and make use of the security features of the Operating system, including integration with SQL Server 2000 and the Active Directory groups, etc... In deploying it to a new server, I was locking down the application directories to ensure that only the people who needed to access the application could get to it, and I found out something when I locked it down too far. and why are you using a domain controller as a web server, you naughty geek?!?
You see, ASP.NET needs to recompile the application into a DLL before it starts executing the code (it checks for things like changes to the aspx files before starting up). But if you're using Imersonation, the ASPNET account is not the account being used for this compile operation. Instead, it's the 'NETWORK SERVICE' account, which will need access to the entire application for checking for changed files, and write access to the binaries directory for writing out the .dll. The error you'll get if this problem applies to you is something along the lines of "Access Denied to .[your app path]\ web.config'. Failed to start monitoring file changes.". The fix is to permit 'NETWORK SERVICE' account (local account except on domain controllers - and why are you using a domain controller as a web server, you naughty geek?!?) read access to your entire web site, and write access to where the compiled code is.
Using Integrated Security for your web applications is a good way to build security deep into the site when using SQL Server or other integrated database product. It allows security to pervade the very core of your code, rather than provide only an entry mechanism to your web site. You can and should lock users out of things that they shouldn't have access to, even if your code doesn't allow them to execute code. New bugs, buffer overflows, viruses, and the law of unintended consequences will come back to bite you in the ass if you're not careful, and it's better to apply security at all levels of your design.
You see, ASP.NET needs to recompile the application into a DLL before it starts executing the code (it checks for things like changes to the aspx files before starting up). But if you're using Imersonation, the ASPNET account is not the account being used for this compile operation. Instead, it's the 'NETWORK SERVICE' account, which will need access to the entire application for checking for changed files, and write access to the binaries directory for writing out the .dll. The error you'll get if this problem applies to you is something along the lines of "Access Denied to .[your app path]\ web.config'. Failed to start monitoring file changes.". The fix is to permit 'NETWORK SERVICE' account (local account except on domain controllers - and why are you using a domain controller as a web server, you naughty geek?!?) read access to your entire web site, and write access to where the compiled code is.
Using Integrated Security for your web applications is a good way to build security deep into the site when using SQL Server or other integrated database product. It allows security to pervade the very core of your code, rather than provide only an entry mechanism to your web site. You can and should lock users out of things that they shouldn't have access to, even if your code doesn't allow them to execute code. New bugs, buffer overflows, viruses, and the law of unintended consequences will come back to bite you in the ass if you're not careful, and it's better to apply security at all levels of your design.
March 24, 2005
Putting it together with Duct Tape and Baling Wire
My new custom 404.ASP page reads <%
If Request.QueryString <> "404;http://www.richgautier.com:80/styles/null" Then
Set FileObject = Server.CreateObject( "Scripting.FileSystemObject" )
Set LogStream = FileObject.OpenTextFile (Server.MapPath ("/statistics")& "\-----,txt" ,8, true)
LogStream.WriteLine ("404 on " & Request.QueryString)
LogStream.Close
Response.Redirect "\index.asp"
End If
%>
as shown in the box. You see, in my stylesheets I added a hack to fix an Internet Explorer CSS Display bug wherein CSS floating elements slice themselves off to match the size of its neighbors when hovering over links in the parent element (div/span). The hack involves pointing to a background image, which forces a redraw....but I didn't want an actual image to be used, so I pointed it to 'null'...which generates a request back to the server for an image that isn't there. I guess that I could create an empty image called null, but that didn't occur to me while I was fixing the 404 redirect page. Oh well, I need a way to track 404's anyway, since GoDaddy.Com doesn't give me the ability to scan my raw log files for free. So, I use ASP to track session and application stats, and visits to my web page, including referers (sp?). Obviously, in the code I am posting here, I've changed the filename I track to -----------. You'll want to make this an actual file on your server if you use it. The 8 represents APPEND mode for opening the file.
If Request.QueryString <> "404;http://www.richgautier.com:80/styles/null" Then
Set FileObject = Server.CreateObject( "Scripting.FileSystemObject" )
Set LogStream = FileObject.OpenTextFile (Server.MapPath ("/statistics")& "\-----,txt" ,8, true)
LogStream.WriteLine ("404 on " & Request.QueryString)
LogStream.Close
Response.Redirect "\index.asp"
End If
%>
as shown in the box. You see, in my stylesheets I added a hack to fix an Internet Explorer CSS Display bug wherein CSS floating elements slice themselves off to match the size of its neighbors when hovering over links in the parent element (div/span). The hack involves pointing to a background image, which forces a redraw....but I didn't want an actual image to be used, so I pointed it to 'null'...which generates a request back to the server for an image that isn't there. I guess that I could create an empty image called null, but that didn't occur to me while I was fixing the 404 redirect page. Oh well, I need a way to track 404's anyway, since GoDaddy.Com doesn't give me the ability to scan my raw log files for free. So, I use ASP to track session and application stats, and visits to my web page, including referers (sp?). Obviously, in the code I am posting here, I've changed the filename I track to -----------. You'll want to make this an actual file on your server if you use it. The 8 represents APPEND mode for opening the file.
March 23, 2005
Prime Number Algorithm Breakthrough?
In New Scientist Breaking News - Classic maths puzzle cracked at last the article discusses a breakthrough in congruence mathematics. At the end of the article, it mentions applicability to cryptographic algorithms currently in use on the Internet, and I am assuming that applicability is meant for the prime number algorithms used in public key cryptography. Already, weaknessed in SHA are showing up (well, after 30+ years). Combined with this, are we set to weather a new storm of cryptographic attacks on the underlying security of the 'net?
The article isn't clear, however, as to the applicability toward prime number computation. If any of you reading this know where I can get more information on the new discovery, or a laymen's discussion on its applicability toward public key crypto, please drop a comment and point us in the right direction.
The article isn't clear, however, as to the applicability toward prime number computation. If any of you reading this know where I can get more information on the new discovery, or a laymen's discussion on its applicability toward public key crypto, please drop a comment and point us in the right direction.
March 22, 2005
American Culture at its Best
MSNBC reports that Monster swine 'Hogzilla' was real, experts say. That's right - National Geographic has confirmed that an 800 pound wild hog did indeed exist in Alapaha, GA - a small town at the intersection of RT129 and RT82. One of the things that makes America great is the ability of its residents to make money off of practically any occurence, natural or unnatural that they come across. One of the things that makes America great is the ability of its residents to make money off of practically any occurence...With access to two major highways, the exit for the huge hog should bring in plenty of tourist cash once the locals capitalize on the giant pig. I already feel the urgent need to stop at the new exit that I can imagine them building, and picking up an "I heart the giant hog" T-shirt...a perfect slogan, if I do say so myself. They've already held a festival for the big piggie, so I know they're on the right track. American road trips are nothing unless you stop at the tourist traps along the way, and I still have a trip planned to see the World's Largest Ball of Twine. Someday.....
March 21, 2005
Blog Skinning
Ok, I'm working on skinning my blog so that I can play with different stylesheets on the fly. One of the results of doing this is the addition of cookies to my site that will remember which skin you choose, so that all of the pages pick up the new skin. I found a lot of useful references on the web, but no one site was more helpful than the next. Most places that I looked at used server-side scripts to skin their blog. Instead, I am choosing to use multiple stylesheets with Javascript to switch between stylesheets.
To do this, you place link tags in your header that load in the different stylesheets. Then, there is Javascript linked to the option box (top right of this page) when the value is changed. It uses DHTML to switch the active stylesheet to the one that is chosen. A List Apart had the necessary Javascript code for switching the stylesheet on the fly. I'll work on some stylesheets that are actually attractive (as opposed to the only alternate that is up there now).
One thing that this work is doing is helping me to understand page layout more and more, as well as understand some of the nastier CSS bugs in the Internet Explorer display code.
To do this, you place link tags in your header that load in the different stylesheets. Then, there is Javascript linked to the option box (top right of this page) when the value is changed. It uses DHTML to switch the active stylesheet to the one that is chosen. A List Apart had the necessary Javascript code for switching the stylesheet on the fly. I'll work on some stylesheets that are actually attractive (as opposed to the only alternate that is up there now).
One thing that this work is doing is helping me to understand page layout more and more, as well as understand some of the nastier CSS bugs in the Internet Explorer display code.
March 20, 2005
We went for a walk
I dragged the boy out for a walk (he would rather stay home) and the wife grabbed the dog. We walked for about a mile and a half, and back again. 
Now that we're back and tired, thought I'd stop and post a pic of the dog from the walk. We didn't see anything interesting nature-wise other than funny looking trees and some squirrels. I'd hoped to be able to get a picture of a large bird I'd seen out there before, or maybe a deer, but no such luck.
Now that we're back and tired, thought I'd stop and post a pic of the dog from the walk. We didn't see anything interesting nature-wise other than funny looking trees and some squirrels. I'd hoped to be able to get a picture of a large bird I'd seen out there before, or maybe a deer, but no such luck.
Subscribe to:
Posts (Atom)