I write this on the day of the LinkedIn password compromise. Of course they should have used salted hashes and a better hashing algorithm, but the thing is when you store your passwords as hashes, the specific implementation you choose is yours to live with forever. Well, almost. What you cannot do is convert your crappy MD5 unsalted passwords to SHA256 per user salted ones because you don't have the original password to rehash... that was the whole point, remember? So, LinkedIn, when they were just getting started probably figured, well, we need a user table and it needs to store the username and password. Then some smart apple said, "no way dude, store a hash" and then that was done. Even if that apple had suggested the state of the art hashing scheme, well, times-a-change. Weaknesses are found. So maybe the state of the art was MD5 at the time and now, well, isn't.

So let's say you're in that pickle. What can you do? You can build a migration strategy where each time a user successfully logs in you check against the hash strategy on record for that user. If the strategy on record is not the best strategy available, you hash using the best strategy the password you have in the live request and store that on the user record and mark the user as migrated. So over time, users logging in will cause their hashes to be upgraded. At some point you can say, well, these people haven't logged in for so long that we will just clear their hash and make them reset their password.

Of course, if you are storing passwords in plain text or encrypting them, you can (and should) instantly switch to using hashes. May I recommend SHA256 with a common + per-user salt? You need common salt to protect it from a simple rainbow table attack and you need a per-user salt to protect it from leaking cross-user password reuse.

See? Easy. Almost as easy as blaming LinkedIn for having unsalted hashes. I'm sure migrating to a better hash was on their list of stuff to do for a long time. What's on your list?

While the pundits (no, not me, the other pundits) argue about whether Apple is trying to protect their delicate users from the chainsaw gangs of Flash apps or if Adobe is now being beaten like an LAPD cop killer because of some ancient grudge, I'm thinking that their may be a whole 'nother reason: It is step one on the road to killing the Mac.

Why kill the Mac? Easy. Jobs can only make money on hardware and a little bit on their own software, but he wants the 30% on everything like he's getting on the iPhoneOS side. Can't lock down the Mac and setup an app store on it now, so it must die.

In order to kill the Mac, you'd need to be able to do everything you can do on a Mac on a iPad (well, except for development -- screw you developers!)

Replace my Mac? Yep. Get iWork on the iPad and a bluetooth keyboard. Oh, you want a bigger screen and everything. Ok, what about a 15" iPad Pro that folds up like a laptop with a built-in keyboard and multitouch trackpad/display. MacBook Air-like dimensions with a full day's battery life. Oh yeah, and you can sync it directly to your iPhone.



What more do you need pointy-haired boss? Pointy-haired boss wants a corporate dashboard application on his iPad with notifications... pronto!

The one kind of development Apple does want is iPhoneOS development. What if there was an app available for free in the app store that let you design your UI, kinda like you do in Interface Builder now, and let you write code. When you're ready to test, you click build, the code goes up to Apple, is compiled, packaged, signed and comes back to your iPad ready for you to test and debug. When you are satisfied with the results, click Publish and your app is in the App Store, ready to be enjoyed by all fartapp-aficionados.

Ah, but how can that work if you are doing stuff like Corona, MonoTouch or CS5. And so 3.3.1 had to be changed.

So, specifically, my predictions are:
* iPad Pro - Ives will twist his hands and say that they completely rethought the portable computer and voila, iPad Pro w/ laptop style and a second touch-display that acts like a trackpad - the whole package suitable for authoring applications - at the same time, Steve will declare that they listened to you and now you can own and use an iPad and iPad Pro without iTunes and you can sync your iPhone to your iPad Pro.
* iPad XCode - Integrated Development Environment on the iPad Pro for authoring apps for the appstore. Maybe free, maybe $49. But it won't include a compiler or code-signer. Your source will go to Apple to be compiled, signed, versioned, scrutinized and approved.
* Mac languish - only minor hardware improvements - Snow Leopard is the last Mac OS - security problems go unfixed and just become justification for the glorious iPad Pro. Every move they make will be to reduce the need for people to buy Macs.

The net effect is Steve gets his 30% on everything.

I mentioned previously that I upgraded the hard drives in my and my wife's Sony VAIO VGN A-190 laptops to WD2500BEVE. Well, mine just died. FAIL! Less than 8 months. Not sure yet the failure mode, but I can read stuff without any reported error, but a lot of stuff appears to be corrupt (by archive testing). Also SpinRite reads along for a while and then stops with some sort of error screen. This is the fifth time I've tried to use this software with zero results. FAIL! I've taken the drive out (look [here] for disassembly instructions with pictures - I need to add pictures for HDD removal), hooked it up to another machine and copied off what I could. Warranties for WDC drives are usually 3yrs, so I'm sending it in to be replaced. I wish I could pay a bit extra to get the new WD3200BEVE which, to my amazement, is now the new capacity king in the PATA 9.5mm laptop drive kingdom -- I didn't expect any manufacturer would continue to develop new hardware for this interface. My really big complaint is with Windows security. When attaching a foreign drive the security prevents you from reading many directories, but, of course, this is a twist-tie security measure because you can simply take ownership and grant yourself rights to these directories, but this means writing to the drive -- FAIL -- a big no-no on a failing drive. I did it anyway, and I recovered what I needed to recover and I'm running again on my old stock 80GB drive, but I think the world needs a solution to this problem, so I intend to figure it out. I'll follow up when I find it.

Was having sudden trouble with this router. It was rebooting constantly.

I couldn't even connect on the wired interface. Even with everything else turned off, the wan disconnected, and power cycled.

So, I held the reset while plugging in to get it to restore to factory settings, went through and set everything back and it just started doing the same reboot-a-thon again. Fail!

Upgraded firmware to 1.05, no help.

Googled. Turned off gaming mode, PnP. Still no go.

But, once I turned off IPsec, it started working.

I have no idea why this would work.

I used to own a Linksys WRT54G (v2) but it bit the dust after not a long time of faithful service. I decided to try D-Link. I wouldn't say it was a mistake, given the available options, but I think my next router will be a WRT54GL or Asus WL500G router; something that has third party firmware available for it. Proper routing is complicated enough now to warrant a more transparent platform to work against.

I just installed and am almost using TrueCrypt 5.1 on my laptop. Highly recommended. I have it on my work laptop as well. I say almost, because it stopped at 95.229% into encrypting with a data error (CRC). It will not proceed past this so I'm only mostly encrypted. Needless to say, I'm a bit worried about this, but I plan on trying out SpinRite. I'll report on that in the future.

[Update: Worked well enough to fix that problem but I'm not totally satisfied with it.]

Just uninstalled Windows Live Photo Gallery. Patches, failed patches, reliance on SQL Server compact edition and hanging wlxquicktimecontrolhost.exe and limited usefulness meant it just wasn't even good enough to ignore. Ouch.

I noticed this problem while downloading sessions from the mix08 site (visitmix.com) in iPod format so I can play them on my iPhone.

One of the sessions I watched was on the history of the ribbon (UX09). I've blasted the ribbon in the past, and I still don't like it, but after watching that session and considering the problem they were trying to solve, I have to admit that I'm pretty impressed with the level of thought that went into it.

My wife and boy are out of town for a couple of weeks so I thought I'd give the bus a try. Why now? So I can have a vehicle that I leave at home and another that I leave at work. I really have to have a vehicle available at work in case I need to get to a client site, although I could probably get away with a nano car like the Smart.

Phoenix has a pretty nice public transportation site (http://valleymetro.org) which includes a trip planner. Unfortunately, the way the schedules work out, I have a fair chance of missing my connection and if I do, it will be a half an hour before the next bus. Actually, Monday it was 45 minutes! Grrr.

What would make the bus workable would be:

• a spare car I could leave at work
• enough busses to where I don't have to time my trip - one every fifteen minutes would do.
• all stops lit and covered for shade and rain
• if I organized my stuff so I could work on either my work laptop or my personal one for anything so I wouldn't have to lug either one around but I could still reach across to get stuff off of either one

What would make the bus cool would be:

• an easier payment system, like a card that is connected to a credit card - the new all day card is nice, but having to pay $2.50 in cash is kinda clumsy. At minimum, $5 cash should get you an all day and another all day card that can be spent later.
• a way to associate a preferred route into your card which will automatically signal for stop - probably difficult to make this foolproof, but having it there mainly to prevent you from forgetting and overshooting your destination.
• a way to text you ahead of time if there are problems with your route.
• walk tunnels or bridges at connectioning points
• real time bus location

I can't believe a type cool on the same line as bus. Al Gore should give me a ride for that.