SpyMe: another remote control app for OS X

SpyMe2 is presumably another VNC based remote control app, though the main page doesn't mention VNC. We're still waiting for something like Windows terminal services (RDP).

I might try it. Inexpensive.

The NYT Permalink Generator

I'll start using this in my blog posts:

TidBITS - Create Permanent Links to the New York Times

... because the New York Times considers itself as the newspaper of record, back in 2003, they worked out a deal with Dave Winer of UserLand Software to provide permanent links in RSS feeds generated through the Radio UserLand RSS aggregator. That said, it would seem that the New York Times is running its own RSS feeds now, so there's no obvious way to find a permanent link to an article you're reading on the New York Times Web site...

...use the New York Times Link Generator, written by Aaron Swartz of the social bookmarking site reddit. Just feed it a link to a New York Times and it returns a version of the link that will remain free for the foreseeable future, though of course the Times could always change their policy. There's also a bookmarklet that you can use to generate a permanent link from the current page when you're on the New York Times Web site.

Hard drives: everything is wrong

I'm used to this sort of reversal from medical science, not computer hardware. Google research says we don't undersand hard drives all that well.

In brief:

1. They're much less heat sensitive than we thought. Once a drive is "mature" heat doesn't have much of an impact on lifespan.
2. After a drive emerges from its infant mortality period, it's not much affected by use. So contrary to everything I've ever written, there's no great need to spin down a USB attached drive.
3. If a drive is found to have any defects on initial testing, it is 10 times as likely to fail as a defect free drive. I'd read that Apple selects server drives by buying conventional drives and tossing out any that have defects. Makes sense. If you buy a new drive, and find a mapped-out defect (may need special software), maybe you should consider returning it ...

The router/javascript bug - this feels big

This feels pretty serious to me. In retrospect, of course, the attack is obvious. I suspect many security people have known about this vulnerability.

Symantec Security Response Weblog: Drive-By Pharming: How Clicking on a Link Can Cost You Dearly

...The attackers create a Web page that includes malicious JavaScript code. When the Web page is viewed, this code, running in the context of your Web browser, uses a technique known as ‘Cross Site Request Forgery’ and logs into your local home broadband router. Now, most such routers require a password for logging in. However, most people never change this password from the original factory default. Upon successful login, the JavaScript code changes the router’s settings. One simple, but devastating, change is to the user’s DNS server settings...

Since I'm a geek I have two inline routers from different vendors with different admin passwords (the password you use to connect to an encrypted WLAN is not relevant here) and, I think, usernames. There are probably two other people I know who do this. I'm not even sure I changed the un/pw on my mother's router -- nor would I necessarily know how! Her primary router, which is where her DNS information comes from, was installed by her cable company.

In the near term browser vendors will be scrambling to see if they can hack in some fix that breaks javascript for this purpose, while not disabling it for every purpose. I'm interested in what Schneier will say.

I don't believe my Airport Router has a web interface, so it's probably immune. Even if it weren't, Apple has a distribution mechanism that allows effective updating of their routers. There's something to be said for that ...

Most browsers, btw, will 'memorize' passwords. I presume that's not exploitable here.

PS. I assume it's obvious to my handful of geeky readers, but a robust WLAN password is of no help here. This is all about the router's admin pw.

Update 2/16/07: I underestimated myself. I did change my mother's router's admin pw.

Update 2/24/07: Schneier has an article. He agrees, it's impressive.

A document management program for OS X

The author of ReceiptWallet has created a general image management package for OS X. The idea is to manage scanned documents.

DocumentWallet

... DocumentWallet is a Mac OS X program that allows you to scan in and manage your documents. When you scan in each document, you enter a few pieces of information about the document such as the title, category and sub category (as well as fields that you define) and then you can quickly and easily locate your documents. You can view the documents right on the screen, print them, email them, or save them as PDFs. In addition to the powerful search built into DocumentWallet, you can organize your documents into collections. These collections can contain whatever you want and even better than that is the ability to create smart collections that automatically create collections based on whatever criteria you like. For instance, you can create a smart collection that contains all of your manuals for your electronic components or one that contains documents for a certain case...

I think he needs to deliver one solution that manages 'receipts' and documents together. Two products is kind of odd.

I did test ReceiptWallet. I imported 200 receipts and discovered there's no way to cancel a mass import. You can only cancel one at a time. I had to kill the app. It's not a big design flaw, but it did tell me the program is still early in its evolution.

Update 2/16/07: I mentioned the problem with canceling imports to ReceiptWallet's developer, and it's been fixed for the next minor release. That's why I love small developer projects. Also, Jacob Reider pointed to Yep in the comments. I'll watch his blog to see if he adds more information there.

Parallels global sharing: now an XP virus can destroy your Mac

By now quite a few people have noticed that OS X Parallels beta allows a non-admin user to read-write-delete anything on the drive. A recent statement on the Parallels blog feels a bit defensive:

The Official Parallels Virtualization Blog: Upgrade your XP virtual machine to Vista with RC3

Global Sharing shares the your entire Mac file system. It is important to note that Global Sharing is DISABLED by default.

A malign XP process can now destroy an entire OS X system. I don't understand why there's not more of a fuss about this. Of course I'll disable "global sharing", but the affair forces me to recognize how extensively Parallels bypasses OS X. I wish Apple were interested in doing a virtualization layer that respected the primary OS ...

Dapper - a tool for extracting website data

Jacob Reider used Dapper in a PBX/CallerID applet he built. New to me, so I visited the URL he provided. It looks like a productized version of the tools people build to do mash-ups. It probably creates a DOM-like model of a web page and then provides an API to manipulate that data. Here's an excerpt from the FAQ:

Dapper: Frequently Asked Questions

What is Dapper?

Dapper is a service that allows you to extract and use information from any website on the Internet. For those familiar with web services, you can think of Dapper as an API maker. For the rest of you, Dapper allows you to build web applications and mashups using data from any website without any programming.

What is a Dapp?

You can think of a Dapp as a "black box" which represents a specific type of page on a specific website on the Internet. The Dapp provides access to the content of that specific website in XML. This XML can then be used in any way you like, including in your next application. Furthermore, Dapper provides a set of tools to transform this XML into other formats, including RSS, email, and Google Maps...

If I get a chance, I may see if I can use it to create an RSS feed for Dyer's archaic web site.

A revised! AirPort Extreme 802.11n review from Macintouch

[Update: The Macintouch reviewer was measuring performance across a NAT interface. It turns out that NAT translation is slow in consumer devices, and it becomes a real bottleneck for connections. Most of us would never notice this, since we probably use a switch for wired devices and we do NAT translation only to connect to the Internet. In most circumstances Internet connections are so slow NAT translation is not an issue. The revised Macintouch review is favorable, as are most reviewers.]

Macintouch reviewed Apple's new 802.11n router: Review: AirPort Extreme 802.11n. It's pretty negative, though they tried to be kind. Slow, quirky, hot. Bleh.

I'll wait for version two.

One side-comment caught my eye:

As a side note, USB disks we attached never spun down when idle. This maximizes AirPort Disk's availability — a client will never have to wait for a disk to spin up — at the cost of increased power consumption.

The power consumption is trivial, but this also shortens the life of the drive. Another negative!

[Update: A Google study on hard drive longevity claims spin down has no effect on drive lifespan. Even so, I like spin down just to reduce noise.]

Yahoo Pipes - a Googler's review

Matt Cutts works for Google. His review of Yahoo Pipes is both positive and relatively easy to follow:

Matt Cutts: Gadgets, Google, and SEO - Review: Yahoo pipes


As every decent UNIXhead knows, pipes let you combine small command-line tools easily by routing the output of one tool into the input of another tool. ...

The idea of Yahoo Pipes, as far as I can tell from a quick look, is to allow that same pipe behavior on RSS feeds. The system also outputs RSS urls. There are operators like sorting, counting, truncating, etc. If you wanted to make a mash-up of different feeds, this would be a neat way to prototype it.

So if you have a set of RSS feeds, you can manipulate them through Yahoo Pipes. I can't think of a personal use case yet, but I'm working on it ...

Gecko vs. WebKit - an insider's perspective

I mostly use Firefox these days (the extensions and Google toolbar), but I have use Camino and might switch back. If Google ever adopts Safari as a first rate client I'd even give it a try.

So I was quite interested in this insider's view of WebKit vs. Gecko:

Sucking less, on a budget: Chicken Little 2.0

... Gecko is a strength. Camino would be nowhere if its rendering engine sucked. Gecko has had the benefit of more than 8 years of development, and as part of that development, testing and exposure. AOL paid for QA to ensure that it correctly rendered over 98% of the net when they wanted to embed it in the AOL client. Anybody who thinks writing an HTML engine is easy is dead wrong. You spend years getting the last few percent, but it's in the last few percent that you make your users feel like they no longer have to worry their browser will be unsupported. To throw that away would be dangerous, it's what keeps us relevant. We say "Mozilla power, Mac style" for a reason, because it's true. I can't use Safari because the sites I care about just don't work. You can't overlook that.

Gecko is a liability. The architecture from day one was light years better than what we had (a grad-student project gone horribly wrong), but by no means was it well-designed. The horrible misapplication of COM, misguided pre-optimization, a singular focus on Windows, and a variety of other serious design flaws made Gecko difficult to understand and in some cases impossible to fix. The learning curve is immense (think Mt Everest), just ask my students every year; the look of terror in their eyes is proof enough. Gecko is as impenetrable and bloated as it is fast and compatible. WebKit, on the other hand, is sleek and svelte. It's approachable. It's really easy to fix bugs. If you ask developers which they'd rather work on, the ones who pick Gecko should get their heads examined.

New blogger: Changing the subjet does not change the url!

Google has finally seen the light. The original Blogger didn't use semantic identifiers for posts, they used a number. You could change the subject and the URL didn't break.

Blogger 1.x used the title as the post name. Change the title, you changed the URL and broke any links.

Blogger 2 uses the title as the post name, but it's a one time operation. You can change the title and the URL remains the same. This is a GREAT improvement.

For example, I corrected the title of this post but the URL shows the old title. I'd prefer a meaningless identifier for the URL, but this is an acceptable alternative.

Utility to charge a RAZR from an OS X machine

The world's worst phone became a little less crummy today. Scott Gruby, an experienced Mac developer, has a utility that will allow an OS X machine to charge the phone:

Scott Gruby’s Blog :: Charging a Motorola RAZR over USB

The Motorola RAZR has a mini USB plug on it for charging and hooking to a computer which is great as I have lots of those cables lying around. Unfortunately it won’t charge over USB from a Mac out of the box. Luckily, I know some tricks and someone told me the magic to get it to charge. I whipped up a little program that tells the RAZR (or any other Motorola cell phone) to charge over USB....

... The app is pretty simple; place it in your applications folder, launch it and set it as a login item. Whenever you plug in your phone, it should start charging. If your machine goes to sleep, it will stop charging. (For those curious, all the program does is open and close the USB interface on the phone.)

Easy to install, easy to uninstall. I'll definitely try it. Scott asks that, in return, we take a look at his receipt management software. I'll give that one a try too.

BTW, this app is not easy to find! Scott published it in November 2006, but I couldn't find it on versiontracker. I only know about it because Scott mentioned it in a comment on a post of mine. Scott's blog is also an underappreciated gem, I've added it to my bloglines collection.

Update 2/7/07: Nina Love (see comments) was able to charge her RAZR from her MacBook apparently without installing this utility.

StuffIt Expander: bypass evil email harvesting

StuffIt Expander is nasty stuff. Some versions mangle zip files, the installation is very ugly, it's very hard to remove, the vendor harvests email addresses and is an infamous spammer -- bad news.

Unfortunately, some vendors still use .sit files. As a rule, I don't buy from them. If you're stuck, you may be able to download form the above link without surrendering your spam-mail address.

RSS to email and RSS for the old web

Amit had two related posts worth keeping for reference:

How to generate email from an RSS feed

and

RSS notification for non-syndicated web sites

I'm going to try the latter with Dyer's news site.

Update: alas the links Amit recommended for rss monitoring of a web site both failed me. One is no longer working the other is very complex to configure.

BlogAssist now on services menu

Dejal - BlogAssist has been on my system for ages, but I've made little use of it. I'll try version 2.1 of this html tool. Only web tools that work with services can use the service option -- so Safari or Camino only.