MichaelCrawford

You might at first expect that its best to write articles on the general topic of books. While there is some benefit to that my experience is that its best to diversify your topics.

The public's interest in the topic of the day varies widely. For example just before Thanksgiving Americans search the web for "turkey stuffing recipe". I expect Canadians do so as well but in early October.

In inlink from a book-related site will be the most relevant, but some other topic may produce more inlinks.

Forum on Risks to the Public in Computers and Related Systems

http://catless.ncl.ac.uk/Risks

I learn from the kind if tutorials that are linked from HN, but if I google for a tutorial many have little useful information but lots of ads.

My own tutorials often focus on underlying principles rather than srep-by-step solutions. If the solution doesnt apply bevause the problem is different, say because a new release changed the UI of the software that the tutorial discusses, understanding the principles may enabke you to work out your own solution.

How to Promote Your Business on the Internet

http://www.warplife.com/tips/webmaster/website-promotion.htm...

White Hat Search Engine Optimization

http://www.warplife.com/tips/webmaster/search-engine-optimiz...

Painless Serch Engine Site Submission

http://www.warplife.com/tips/webmaster/site-submission.html

Analyze your webserver log files. I use analog but it has not been maintained in years, doubtlessly there are better tools by now.

Avail yourself of Bing and Google Webmaster Tools, also Alexa. Use http://www.google.com/trends/ to find keywords to target. Note the geographic distribution.

I havent written anything yet about pay per click ads like AdWords but I intend to. The key is to bid on keywords that only a paying customer is likelely to search for. I paid $300.00 per month for "software consultant" and "software consulting" with nary an inquiry, but got a signed contract for $30,000.00 after paying ten cents apiece for but two clicks by bidding on a keyword that I will never tell anyone because I might need to use it again.

How about legislation that requires auto industry executives read the Forum on Risks to the Public in Computers and Related Systems?

http://catless.ncl.ac.uk/Risks

Risks will put the fear of G-d in you.

Security experts such as Kevin Mitnick have already testified before Congress. Rather than wasting Kevin's time I suggest our Congresscritters just look up his testimony transcript in the Congressional Record.

My ex is a Buddhist. Bonita and I often discussed this.

When I am gone I won't be around to know whether anyone remembers me. But when the end is near and I look back on my life, I will feel it was well-lived if I created something that is of at least plausibly lasting value.

Your experience and mine is why I write "Solving the Software Problem: a Taxonomy of Error":

http://www.warplife.com/jonathan-swift/books/software-proble...

While actual code serves as a good example the problem is far more general. Consider the Apollo I fire: the Astronauts were unable to convince NASA to redesign their capsule's inward-opening door so they had themselves photographed praying over a model of the capsule.

Everyone knows astronauts are brave; those men died for a door hinge.

I often ask other coders to contemplate "What software that we write today will still be in use 10,000 years from now?"

That I am unable to answer that question is a primary reason I write English text rather than code the last ten years.

I often avoid software upgrades not because I know something will break but because I speculate something will break and dont want to find out.

Out of all the "features" that anger me the most are automatic, silent upgrades. One can generally disable them but I dont want to have to figure out how; if I want an upgrade I will download and install it manually and do so when I am good and ready.

That web applications - as opposed to those I install locally - are increasingly common I regard as the problem not the solution. Quite commonly a website breaks for no apparent reason, eventually I clue into that they revised their Javascipt but did not test on the browser I actually use.

When considering whether to install software, first look for reviews. Many eCommerce sites make it easy to sort by most-critical first. Do take them with a grain of salt as bad reviews are sometimes posted by unethical competitors as well as cyberstalkers like Kuro5hin's modus.

If those bad reviews would affect you and are in a recent release then maybe you want to give it a pass.

I know all about security patches, I once got to play on that same Sun workstation that Kevin Mitnick ransacked but at least I had the sense to ask Tsutomu's permission first.

I often use "Jonathan Swift" as a psuedonym, more recently I have adopted "Durante degli Alighieri".

Many embedded systems are that way.

While it is helpful that hardware memory management will protect against erroneous and malicious code, even better is for the code to be correct and ethical.

This because the MMU hardware takes up power, it costs money, generates heat and uses real estate. Also the software is complex and uses a lot of memory for page tables and complex allocation schemes.

The Oxford Semiconductor 911, 912 and 922 didnt even have a kernel nor did they have dynamic memory allocation, just stack and static memory with an infinite loop operating a state machine. A huge PITA to debug but the memory and flash were quite cheap because there werent very much of either.

I don't click them but many people do. This is easily demonstrated through A/B testing.

Dave Johnson, President of Working Software told me the reason that so many advertisements say "BUY NOW! DON'T DELAY" is "because it works".

  "Ask my mother why she likes advertising." -- Karen Salzman

   "Why do you like advertising?" -- Me

   "It tells me what to buy."

I swear I'm not making this up.

For me, just about the most effective call to action I've ever seen is a developer blog linked from here at HN. At the end of each article it said "Read This Next" then linked another technical article.

I read every article on that guy's site.

I find it helpful that someone notes the "Reading Time" at the top of each of his developer blogs; I plan to add that.

Yes.

I started at WSI about seven months before System 7 was introduced. At the time the documented limit was 32 kB. Yes applications could call SetApplLimit but Desk Accessories could not, QuickLetter's stack was on top of the application's stack. We had no control over that.

I expect the System always ensured that DAs could have 8 kB of stack on top of whatever the application had; that is, app+DA defaulted to 40 kB.

MacCLint was such a skanky program I don't think it would have done it a whole lot of good to increase the stack.

A common problem in QuickLetter before I fixed it was that it had very large local (stack) variables - big arrays and structs. My first fix was to malloc() anything larger than a couple dozen bytes.

MacCLint was a piece of work; I would be unsurprised were it to have local variables that were megabytes in size.

That is I don't know the depth of recursion but I do know that it blew out the 32 kB limit by megabytes.

MacCLint is also the reason why I always use explicit returns in C-like languages. It would crash - which on Mac OS System 7 would drop my box into MacsBug - if I just fell off the end of a void function.

Dave Johnson, the owner of Working Software, had already advised me to use explicit returns because he once used a compiler that generated incorrect machine code if he didn't do so.

Even without buggy tools explicit returns are handy for setting breakpoints. Some debuggers enable you to break just before return even if you fall off the end but not all do.

It is common for executables to have these permissions:

rwxr-xr-x

maybe this is better:

--x--x--x

what that means is that you can run the program but you cannot read it as a regular file.

To delete or create a file you must have write permission to the directory it is or will be found in.

Yes it's a PITA to take away your own permissions but your server is not the box you take with you when you hang out at Starbucks.

Classic Mac OS applications had 32 kb of stack. Desk Accessories had 8. Much of my effort to fixing Working Software's QuickLetter went towards reducing stack consumption. My predecessor had apparently not read the fine manual.

We spent a lot if money to purchase MacCLint but it overflowed the stack by megabytes and so corrupted the heap. The author wasnt receptive of my advice to remove all its recursion, he asserted rcursion is necessary for compiler-like programs.

Recursive algorithms di not require recursive implementations. The pricedure fir converting recursion to iteration is documented by Robert Sedgewick in "Algorithms".

Really you do have a stack but its not the runtime stack.

A simple easy way to keep a lid on privelige escalation is to remove all the files that you computer does not absolutely require to do its job.

Especially the development tools: the Morris worm enabled portability by distributing itself in source code form then building its binary on its target hosts.

My sister once read a novel about some very traditional, strictly religious people who fastened their shirts with string ties as they felt buttons were hooks that the Devil could use to grab hold of you.

I feel much the same way about files. I dont know what tomorrow's zero-day will look like but the chances are quite good that it will depend on a file that is installed by default. Cliff Stoll wrote in "The Cuckoo's Egg" of a subtle bug in a subprogram used by GNU emacs for email. Had the Lawrence Berkeley Laboratory used vi rather than emacs they would not have been vulnerable. ;-D

Yes it is a step in the right direction not to run daemons or windows services you dont need but its even better to remove them.

In 1990 I wrote an A/UX 2.0 remote root exploit to drive home my objection to one single file having incorrect permissions. Its source was about a dozen lines. That particular file was required but our default installs have many files we dont really need.

Also if you can read - not just execute - the binary to any program or library then your malware can load it into its memory then execute it. We have no way of knowing who is going to do that tomorrow but we do know there are many binaroies we do not really need.

If you develop code for your server, install the same distro in a vm on your desktop box then compile it there.

Because Linus Torvalds actually believes that userspace processes have "infinite stack".

I swear I'm not making this up.

My interview by Jonathan Goldstein for "Wiretap" was the second of my two CBC interviews, I also appeared in 2004.

I was interviewed by Rick Sanchez for CNN in 2010 when Andrew Joseph Stack III burned down his own home then crashed his airplane into the Austin, Texas IRS building, to draw attention to Internal Revenue Service Section 1706 - I got a call from a CNN producer about twenty minutes later because she found my own essay about 1706 in a web search.

I have an article about that as well that I'll submit real soon now.

Matt was a Cal State University Northridge student. CSUN's Psychology of Creativity class gave him the assignment of finding a creative person on the Internet then interviewing them.

Mostly I discuss my writing, art and music.

Richard Feynman's second wife divorced him for among other reasons he was "always doing his calculus".

If I permanently cache the image or block the server with my hosts file then the web analytics services will not track me.

If I randomize the query parameters then they will not track anyone because they won't provide useful information to those who presently purchase it. Of course that will require far more people then me to also randomize their query parameters.

I use LinkedIn to locate former coworkers but then I keep in touch with them through regular email.

I dont see LinkedIn as being able to do much that personal websites would not do better. I use LinkedIn because many people, even coders do not have websites.

Most online child pornography is not hidden nor encrypted in any way. Just search Bing; you can get the keywords from wikipedia then follow bing's suggested queries.

Microsoft claims that they remove child abuse links from their index upon notification by such organizations as the National Center For Missing And Exploited Children but clearly they dont.

There are some imagehosts that either have no way to locate their images from their homepages, or whose search forms dont list child pornography in their results, however its all indexed by bing.

The videos at the filesharing services commonly have obvious or easily brute-forced passwords. There arent that many different passwords in widespread use; I expect a list of the 100 most common passwords would decrypt 99% of the videos.

The passwords and lightly obfuscated links are mostly posted to dead forums. If you operate a forum yourself the simplest way to defeat this is to disable posts in threads older than a month or so.

If you want to find these posts on your server look for a large number of occurrences of the word the word "password".

I have even seen this at last.fm.

A UC Santa Cruz student wrote her dissertation on the culture of elementary particle physicists by infiltrating the Stanford Linear Accelerator Center.

She reported that the scientists at SLAC "wear t-shirts and blue jeans".

I don't recall or name or the title but someone at http://anthro.ucsc.edu/ should be able to tell you; if you actually want to read it you should be able to get it through interlibrary loan at your local library.

Rather more seriously, in UCSC's Anthropology of Religion I read a book by an anthropologist who read a UFO cult leader's proud announcement of the specific date upon which aliens would visit the earth to bring peace - save us from nuclear war, etc.

Knowing that a vital peer-reviewed publication was at hand, the anthropologist joined the cult.

I don't recall that book's title or author either but I will post it in an edit or reply if I can dig it up.

Just last night it occurred to me to write browser add-ons that would scramble those query parameters, also send bogus user-agent headers but only for the web bugs.

That is, the add-on would discover one-pixel transparent gifs, take note of what query parameters they used, then every time it found that same gif in the future it would issue a GET with randomly selected parameters drawn from the instances of that same gif it had seen in the past.

For extra crispy electronic warfare, that same add-on could issue GET requests at randomly selected intervals. If those intervals were reasonably far apart (say one hour apart for any one gif) then it would not obviously be an attack on the analytics server.

What it would do is to make it completely useless to correlate your visits to different domains.

The easiest way to spot web bugs is to use a very old build of Safari. There are many other ways but if you have an old Safari select Window -> Activity then leave it open as you browse a few different domains.

You will see some 43 byte documents with huge long URLs full of query parameters, also one byte javascript sources. I block the ones I find in my hosts file:

   127.0.0.1 www.hosted-pixel.com

On some operating systems it may be better to use 0.0.0.0 but I am not completely clear. Alternatively block them in your firewall.

Among the reasons I dont install any other mobile apps other than those I absolutely require - not even free ones - is mobile analytics. The developer SDKs are all free as in beer but I have seen a photo of one of their data centers. Data centers are expensive; someone must be paying for all that.

You can edit the hosts file on iOS with iFile from the Cydia app store if you jailbreak, alternatively you can maintain the hosts file on your box then install it on your device with scp.

Similarly for Android but I dont know what text editors you can use to edit system files. Some Android devices enable you to install your own firmware build but I dont have a current list.

I am concerned about the impact analytics may be having on democracy. Its not really a secret ballot if the candidates all know what pages I read.

Make it unlawful for javascript source to contain nothing but whitespace.

I expect that some people mark a message as spam because they personally dislike the sender or because they disagree with them.

Say if Told you that your mother wears Army boots.