Planet North East

USRLab: What the user sees first.

Thu, 29 Jul 2010 13:30:35 +0000

Imagine the scenario. Someone out there is using Google. They’re looking for a company. They want to buy what you sell. Have you optimised your website for the key words they’re looking for? For the sake of argument, let’s assume you have. So your business is in the first few results. That’s brilliant. Except for [...]

1DayLater: Steve Job's a good un'

Thu, 29 Jul 2010 12:55:00 +0000

Last week we launched the first of 1DayLater’s phone applications, this one for the i-phone.

Die hard 1DayLater users will know that this has been a long time coming; mostly because the ‘bigger boys’ at the iphone store have kept returning our latest builds for picky reasons. But we’ve now squirmed our way in - hoorah!

The first of many phone apps which we will be releasing

To build the app we enlisted the help of a local web development and design house; Twisted Studio, earlier this year.

We asked Twisted to create us something which was purely for input purposes, no fancy graphs or analysis. Just a simple way of logging your activities on the go, whether that’s time spent with a client or mileage travelled.

The data then gets whisked away to each user’s 1DayLater account where the magic happens.

The app can be found here on the apple store. What’s more the app is free and we would like to keep it that way to benefit all of our users. However if you do want to pay us back then a kind review on the app store about the 1DayLater service would be hugely appreciated.

Further apps will soon be available for Google Android, Nokia N-Series and Blackberry phones.

Back Consulting: BACK down to street level

Thu, 29 Jul 2010 11:14:22 +0000

Please be brave and sign up to help our very good friends at St Oswald’s Hospice in Gosforth by participating or helping out with this fabulous opportunity to see Newcastle upon Tyne in a whole new way.

St Oswald’s provides hospice care for adults, young people and children. Situated in Gosforth, Newcastle upon Tyne, St Oswald’s purpose-built facilities offer a range of flexible services to North East families.

St Oswald’s follows a holistic approach that aims to address not just physical symptoms, but also spiritual and emotional needs too.

Families from across the region – Northumberland and Tyne & Wear – can benefit from their services.

St Oswald’s are a registered charity and their annual running costs amount to £8 million – of which £6 million must be raised through voluntary giving.

They make no charge for any of their services, ensuring hospice care is available to everyone.

Give Jayne a shout and get signed up to help this amazing cause.

[my][home][toon]: Slow baked ham with cider and spice

Thu, 29 Jul 2010 08:21:52 +0000

I’ve no pictures for this, because I was doing it as part of a dinner party, so you’ll have to just imagine. I should just the nod to Beer Reviews for pointing me in the direction of cider gammon.

Take a 1kg ham, or gammon joint. I used an unsmoked one, wanting to bring the spice flavour through, but a smoked one might be really good.

Pop it in a big pan, and run the cold tap on it for a good couple of minutes to remove remove the salt.

I stood mine end on in the slow cooker (a 3 litre job) and added 2 bottles of “rustic” cider (Old Rosie would be good, this was a Lidl bargin job in a glass bottle), totally 1.5 litres. Add a large clove of garlic, peeled and thumped to break it up a touch. I used a fat clove of smoked garlic because that’s what I had in after the Jerk Chicken experiment.

I ground a heaped teaspoon of black pepper corns and one “arm” of a star anise up in the pestle until all cracked through. I was tempted to add more star anise, but the liquouricy flavour was enough. Stick that all in the slow cooker too.

The liquid nearly covered the ham, but instead of adding extra liquid, I turned the ham ever couple of hours. I cooked on High for 3 hours, and low for 4 hours, then turned off and the meat left to cook in the liquor.

You could slice it finely once cold (lift it out of the cooking liquor once cold), but I flashed it in a hot oven without a lid for 20 minutes to warm the meat through and crisp the outside fat. You don’t want to crisp it too much, the velvet soft liquid-laden fat is one of the great delight. If you’re hot slicing it cold, cut with the grain to break of big chunks, and pretend to be a medieval king!

Possibly Related Posts:

Steve Woods' Personal Blog: New Project Launch - VatSimSigs!

Wed, 28 Jul 2010 23:52:00 +0000

<p><a href="http://www.vatsimsigs.co.uk"><img src="http://posterous.com/getfile/files.posterous.com/temp-2010-07-28/ganHgodgCeevxnagnwsGhcFJretotjnvbzJmioilCmtnlxhcltDDoFGqeyxf/vatsimsigs.jpg.scaled500.jpg" width="500" height="269"/> </a></p> <p>I'm an avid Flight Simulation fan, have been for years much to the mirth and merriment of the people I know. I enjoy nothing more (well, within reason) than filing a flight plan from one place to another and sitting online while I'm guided via live air traffic control - pretty much as real as it gets without setting foot into an actual plane.</p> <div>The live air traffic control is from <a href="http://www.vatsim.net">VATSIM</a>, or more specifically the people connected to the VATSIM servers who have nothing but a simulated radar screen on their PC's with which to talk to and guide us armchair pilots from one place to the next, over the internet.</div> <div> </div> <div>It's a lot of fun and it's the nearest I'll get to realising my childhood dream of being a pilot, because I have the worlds shittest right eye. I can see everything with it, only it's like looking through slightly frosted glass. So, Mr Woods isn't allowed to fly the Big Iron (though I *will* get my PPL one day).</div> <div> </div> <div>I've been a member of the FlightSim community since about 1993 or 1994, (back in the dark days of FS4.0b with the aircraft and scenery design addon!) and during the years I've learned a LOT about piloting, navigation, radio communications, etiquette and aircraft stats. All of which appeal to me.</div> <div> </div> <div>So it's my turn to give something back, no matter how trivial. Enter <a href="http://www.vatsimsigs.co.uk">VatSimSigs</a>.</div> <div> </div> <div> <a href="http://www.vatsimsigs.co.uk">VatSimSigs </a>is, as the about page will tell you, simply a web application that allows you to display a signature on forums, reflecting your connection status to VATSIM - that is, online or offline. This is especially handy for those who browse the forums and are interested in seeing whether or not their buddies are online.</div> <div> </div> <div>In addition, it also allows you to upload "sets" of images, which I have cunningly entitled "image sets" (genius!). These sets of images are a two-part group of signature images, one for online and one for offline statuses - but because the system generates HTML or UBB code links, you can have multiple different signatures running through your singular VatSimSigs account. </div> <div> </div> <div>What this means is that if you're a member of a virtual airline (and I am, I'm a First Officer rank on <a href="http://www.thomsonvirtual.com">www.thomsonvirtual.com</a> , defected from KnightAir ), you can have one signature for that forum and another for additional forums, such as BAVirtual or EasyJetVirtual or whatever other forum you frequent. All from one place, no administration necessary - VatSimSigs will do the processing and make sure the correct status image is served no matter which image is requested.</div> <div> </div> <div> <a href="http://www.vatsimsigs.co.uk">VatSimSigs </a>is also free of charge - so enjoy, tell your friends and have three greens!</div> <div> </div> <div>For those who are interested, It's built in <a href="http://ASP.NET">ASP.NET</a> MVC 2.0, and took about 19 hours to complete from start to finish including design / development / deployment - not bad going :)</div> <div> </div> <div><strong>Check it out!</strong></div> <div><a href="http://www.vatsimsigs.co.uk">http://www.vatsimsigs.co.uk</a></div> <div> </div>

Alistair's Blog: I am fine

Wed, 28 Jul 2010 22:20:20 +0000

Normally when I hear the words “I am fine” it is a fib, but really, I am okay. If you follow me or my friends on Twiter you may heave heard I was assaulted on Tuesday night on the way back home from a photo walk.

I am not going to say much about what happened now, both because the Police are investigating, and because all I want to do now is go to bed. I have been awake for over 38 hours and really need sleep. The summery is I was hit once by one of two lads who were drunk and looking for trouble.

Currently I am in a decent state despite falling badly. I have a fractured arm, but we are hoping it will not need a plaster putting on it. I am doing physiotherapy and need to keep popping to hospital to monitor this. I am slightly bumped and bruised but it could have been fare worse. No significant cuts but some grassing. The pain is well within my pain tolerances and I should be able to continue an abnormal in a few days. I hope to make a full recovery in 6 to 8 weeks.

I must say a big thank you to fellow photographer Brit who helped get me in an ambulance. Also a huge thank you to my friends and followers who have been great. I have pages and pages of public and private good wishes. My phone’s SMS inbox is full and the voicemail has given up. Several people from across the country have offered to jump on a train and keep me company. I have been welling up reading some of the messages. I am very lucky. I will reply to you directly soon if I have not done so already.

Finally I have to say that everyone, and I mean everyone I have met at the NHS and Police service have been amazing. I felt that my well-being was the most important thing to them throughout.

USRLab: Can SEO analytics backfire?

Tue, 27 Jul 2010 19:37:40 +0000

For those readers of this blog who don’t happen to read the Boston Globe I’d like to share a fascinating link: http://www.boston.com/bostonglobe/ideas/articles/2010/07/11/how_facts_backfire/?page=full The article is about how readers of political articles, when faced with the corrected facts about the article they’ve read, actually become more adamant and entrenched in their misinformed views rather than less as [...]

SuperMondays: SuperMondays UX – a review

Tue, 27 Jul 2010 19:30:54 +0000

Update 30/07/10: Added slide shares of presentations and also the speakers UX reading lists. Another interesting night at SuperMondays. I won’t say too much because David Coxon over at his blog has said it so much better! Much thanks goes to Joanne Richardson (@joanne84 and also on Posterous) from @orangebus. It was originally Joanne’s idea [...]

Back Consulting: BACKFlip Networking

Tue, 27 Jul 2010 15:25:36 +0000

BACKFlip Networking is the easiest way to promote your business to around 150 people in just a couple of hours. You can sell your products and services easly with either a flipchart space or a display table. If you’d like to exhibit at BACKFlip it’s really simple and inexpensive. All you need is a pile of Business Cards and yourself, no expert marketing knowledge is needed.

Tickets Now On Sale For Exhibitors, for more information visit: http://backflip.eventbrite.com/ for more information.

David Coxon: Supermonday UX

Tue, 27 Jul 2010 00:14:14 +0000

User eXperience or UX has to be one of the buzz words of the year, and it seems when it comes to creating the ultimate surfing experience everyone from marketing agencies and pr people to designers and developers wants to get in on the act.

Such a hot topic, had to the the subject of a Supermondays session soon or later, and Joanne Richardson of Orange Bus certainly did it justice this month. Not only did Joanne curate the session, arranging talks from Graham Morely of graphic.ly and Th_nk’s Director of Ux, Lee Alan, but she also presented herself, apparently presenting for the first time, although you wouldn’t have guessed it from her delivery to another full house, this time at Gateshead Colleges Baltic Campus.

The general messages that came from all three speakers was that User eXperience didn’t have to be expensive, but that it should be considered, and that it should be an iterative process, that is to say that it should be reconsidered and revised after each phase of design and development.

For me it was really refreshing to hear the speakers talking about adapting and simplifying, and avoiding feature creep. These days its all to common to see companies adding more and more bells and whistles to sites, without considering whether they actually add value to the user.

I’m going to leave you with Joanne’s closing comments UX is about user stories and about creating “Happy Experiences”, and a reminder from the team that if you missed out on Supermonday this month, then you have a second chance to get out and do a bit of social networking with SuperSummer this Thursday.

Presentations: Start up UX – Graham Morley , A day in the life of a UX designer – Joanne Richardson

Book Recommendations: The Design of Everyday Things - Donald Norman , Web Form Design: Filling in the Blanks - Luke Wroblewski , Don’t Make Me Think: A Common Sense Approach to Web Usability – Steve Krug ,

Online Resources: pivottracker , patterntap , iconfinder , konigi

transitlab: pingpong ball matrix (2x7x8)

Mon, 26 Jul 2010 12:13:26 +0000

pingpong ball matrix (2x7x8)

Originally uploaded by Dr Brian
@coldclimate and @sc_r making things during howduino

Howduino, what a great event/weekend at the centre for life.
So we had two days of 6 hours each to make stuff around arduino or electronics in general. There were a lot of matrix light projects from @coldclimates and @sc_r s ping pong matrixes, to lee and friends amazing skip finds (two great matrix displays). Another theme was that of remote controll, with @alistair controlling a servo over the internet, and another team a remote controll car from their computer.
There was also the hacking of an animatronic head(yoda like) and the control of housegold power sockets(peter) through a networked arduino. Sophie did a squigglebot, and there was a whiteboard drawer, thom did a dalek that found your face (using the webcam) and pointed his blue led laser gun at you. @oomlout contributed to a lot of the projects, and jim of @sonodrome demoed using a led as an input(light detecting) and output(light o) device, nice one
These are all the ones I remember, but it would be great to get a complete list.

What did I do?
Investigated using a ldr to get an idea of motor spin speed. In the future this will be great for getting an idea of how fast a centrifuge is spinning, or using it as a counter for bees entering and leaving a beehive.

Back Consulting: BACK welcomes new employee

Mon, 26 Jul 2010 11:30:28 +0000

BACK Consulting welcomes new starter Chris Metcalfe to the company. Having just completed first year Computer Science at Loughborough University, Chris is looking forward to gaining some experience in the field of IT. Chris, 18 and a former Maplin Employee said that it was really exciting to be working for a company like BACK and that he hope to pick up some invaluable experience.

At University, Chris passed all of his first year modules with an average of over 70%, despite finding time to go out most nights. He is a keen gamer and helps to run one of the UK’s largest gaming leagues. After the summer, Chris returns to Loughborough to continue with his degree.

Infosanity: Infosanity

Sun, 25 Jul 2010 12:48:05 +0000

This morning I cause myself a problem. Annoyingly it was foreseeable and avoidable, this is my excuse (not great, but I’ll stick to it). But as every problem is merely an opportunity in disguise whist I’m re-building systems I might as well document the process. The original InfoSanity guide for installing Kippo was based off of the latest stable version, but I rapidly migrated to the development SVN on learning of the MySQL logging capabilities, so this guide covers that.

Packages

As I’m using a Debian system a lot of the system pre-requisites are packaged, this aren’t all needed immediately but we might as well grab them all at once.

apt-get install subversion #for svn
apt-get install python-twisted python-mysqldb # Python and required modules
apt-get install mysql-server #

Basic Kippo setup

Grab Kippo direct from svn, at time of writing I got version 160. (latest instructions):

svn checkout http://kippo.googlecode.com/svn/trunk/ /opt/kippo-svn

Now we can start the honeypot system:

./start.sh

That’s it, all that is required to get the system running. To confirm you can ssh locally with ssh -p2222 root@127.0.0.1, unless you’ve jumped ahead and edited the config, password will be 123456.

MySQL

Log into MySQL via commanline, assuming you’ve not modified the kippo.cfg database directives build the database:

create database kippo;
grant all on kippo.* to ‘kippo’@'localhost’ identified by ‘secret’;

Next edit the kippo.cfg accordingly you database/user/password and uncomment the [database] configuration directives. REMEBER to uncomment ;[database] line not just the parameters, that has now caught me out twice.

Finally, build the database structure with the script that can be found in <kippo>/doc/sql/:

doc/sql/# mysql -ukippo -psecret kippo < mysql.sql

Restart your Kippo process and you should be good; re-test access to the shell and view the database tables to confirm that logs are being written to the database.

Happy Honeypotting

–Andrew Waite

Infosanity: Infosanity

Sat, 24 Jul 2010 11:42:44 +0000

When discussing some of my recent findings with Kippo I’ve been asked a few times for suggestions for how people can prevent their systems from being compromised via this vector. A quick Google search shows that there are already a number of good resources covering the options, including: Debian Administration Article and Securing Debian Manual. However, the high number of options can leave people unsure where to start so I’ll summarise some of those that are more common and can provide the highest return on investment for the time taken to make the change.

N.B. a lot of the suggestions below are valid for most/all remote access functionality.

Restrict access from unknown locations

If possible (it isn’t always) restrict access to only come from known and trusted sources. This can be down at multiple choke points in the network and system; perimeter firewall, host firewall (iptables etc.) or sshd config. For working with sshd the /etc/hosts.allow and /etc/hosts.deny, for example:

/etc/hosts.allow

#Corporate HQ gateway
sshd: 1.2.3.4/255.255.255.255

/etc/hosts.deny

#Generic Deny All
sshd: ALL

It doesn’t matter how insecure your system is, if an attacker can’t connect and communicate with a vulnerable service they can’t exploit it, period.

Restrict remote root access

Preventing remote access to the root account can reduce the damage that can be caused by a compromised. With SSH this can be achieved with a single configuration line:

/etc/ssh/sshd_config

PermitRootLogin no

Only allow access to specific accounts

Does every account on you system need to be able to remotely access the system via SSH? No? Then why can it?

Remote system access can be restricted on a per user basis. This can be either as a whitelist using the AllowUsers directive or as a blacklist with the DenyUsers directive. For example, if I only wanted to allow my own account access via ssh:

/etc/ssh/sshd_config

AllowUsers andrew

These capabilities can be useful with certain honeypot systems; if you create a weak user account linked with an ftp or pop3 honeypot (for example), then the same weak accounts can be prevented from gaining access to a shell with the DenyUsers directive, limiting the weak account to only access those services that are being monitored.

Run on non-standard port

Yes, this is ‘security by obscurity’; if this is the only change you make you haven’t really improved security any, but it is still useful as part of wider security posture. Attackers are continually scanning the internet looking for new systems to exploit, currently the ISC statistics show connections to tcp22 at around 100k targets; even moving to a relatively common alternative port of 2222 drops the malicious traffic by around 90%.

/etc/ssh/sshd_config

Port 2222

This reduces the number of malcious attempts targeting the service, which will both reduce processor/network load and ‘noise’ in the log. If you now get a burst of failed log-in attempts in the logs, then this may be indicative of a specific attacker rather than just the usual background noise of bots and worms scanning for new victims.

Summary

Implementing the above can drastically improve SSH security above the defaults, with a relatively small effort required providing a great ROI. So what’s your excuse? Go harden that SSH installation

–Andrew Waite

Richard Lane: It’s true: a sales process will increase your confidence

Fri, 23 Jul 2010 14:50:19 +0000

We have just finished the fifth and final workshop of our first Selling at a Higher Level blended sales training programme.

Part of this final session was spent reflecting on how the programme has helped to develop the attendees selling skills. One comment that was reflected around the room was how having a sales process has significantly increased their confidence. Whilst not surprising to me, what was interesting was that many of the delegates had not realised this was a likely output when they signed up to the programme. They now understand how vital confidence is to being successful in sales and how a sales process can help to develop and nurture this confidence.

We designed and developed the course to bring structure and process to sales peoples’ professional lives. We have had a wonderful mix of students on the programme – business owners, experienced sales contributors and people who are brand new to selling. Each of them has taken away a range of tools, technique and sales blueprints designed to help them sell more effectively. What’s more we have tried really hard to bring every tool and technique to life, to put it into context and to demonstrate how it can add value to the sales process.

The Engleby Associates Sales Methodology provides a backbone to the programme and over the five workshops we have moved from prospecting to identifying business problems and value propositions, to asking high impact questions, to qualifying, negotiating and closing. Perhaps most importantly we have discussed the importance of listening. Really listening. And trying our best to understand our prospects and customers. Being interested to be interesting. Always putting our feet in our prospects shoes.

At the end of the day though, the important thing to remember is that these tools and techniques sit within a process. If none of the tools are used but the process is remembered then that will be okay. At least they will have their sales roadmap and a sales plan. And we all know that with a plan the chances of attaining our goals increase dramatically.

As Elmer Letterman said;

Luck is what happens when preparation meets opportunity

I’d like to thank the group for their engagement, openness and willingness to get stuck in. Tracy and I have really enjoyed working with them and we wish them every success for the future.

If you are interested in the sound of our blended sales training programme feel free to drop me a line. I’d be happy to talk through how we could run a similar one for you.

transitlab: A nod to Joris (a UK perspective on DIYBio)

Thu, 22 Jul 2010 10:40:22 +0000

: Image by Dr Brian via Flickr

One of the great things about making the maker faire in Uk each year was catching up with Joris Peels. He speaks his mind, and this is refreshing. Formetrly of Shapeways (and not sure what hes hatching now), we have had a few discussions about what would be usefull for DIYBio.

Basically, how do we DIYBios make this a legitimate pastime, or pursuit, or calling. I welcome some regulation, but can currently see, that by not running a business, regulations do not necessarily apply, as most are dedicated to regulating WORKPLACE not homes.

At the moment I can’t see any regulations that apply, as we are not working with genetically modified organsisms, and keeping to type 1 (harmless) organisms. It does get interesting when people want to do GE in the garage. Next year the Biological agents and Genetically modified Organisms(Contained use) 2011 regulation comes into to force. This may impact on the iGem teams if they are working with organism new to the labs they are working in.

The problem with this hole in regulation I see, is basically, if not regulated to an extent, DIYBio may become illegal due to biosafety concerns.

A brief set of rules that I am working by

1) don’t bring persistant poisons into the house, look for the safest way of doing something, not the fastest. This is not much different to what is done with electronics in the house. If you want to etch using the ferric chloride way, you are left with a persistent poison. There are alternatives (http://hackaday.com/2008/07/28/how-to-etch-a-single-sided-pcb/)

MSDS tells you what poisons are, and their actions. there are many things in the laboratory that are incompatable with home labs. Ethidium Bromide comes to mind, its used to stain DNA, but now there are much safer alternatives. They may seem more expensive, but when you take into account waste disposal, i’d say they are much cheaper.

2) dont work with pathogens, its not worth it.

It does supprise me when people want to culture pathogens without the proper safety equiptment and risk analysis. There are so many other things to explore, like fermentation of beer, making yogurt, sourdough making, cheese making, that are all much more worthy of study and tasty.

3) cleaning hands before and after handling microbes. I have used bathrooms as a easy DIYBio lab for culturing glowing bacteria from seafood (see http://letters.cunningprojects.com/?p=97)

4) minimise waste, think about using slightly more expensive glassware than disposable plasticware

5) have a decontamination strategy, bleach and rinse

6) be very carefull about mixing strong chemicals, many are not compatible. (I would like to get a list of these)

DIY Bio.

Infosanity: Infosanity

Wed, 21 Jul 2010 18:03:08 +0000

So far my Kippo honeypot installation has recieved a number of successful log ins from maliciuos users, some of which have been helpful enough to provide some tools for further analysis. A lot of the archives which have been downloaded show that the kits have been in use for a while, with some archive timestamps going back as far as 2004 (of course this could simply be an incorrect clock on the machine that created the archive). Picking on the most recent download (2010-07-18) I’ve taken a look at the archive containing gosh.tgz.

The archive was downloaded from linux<dot>hostse<dot>com<slash>gosh<tgz>, system is down at time of writing but take care if attempting to investigate yourself. Before downloading the user checked around the system with commands: w, uname -a and cat /proc/cpuinfo, and archive was downloaded and extracted in /dev/shm/.

Once extracted, the archive contains a number of files:

1:	ISO-8859 English text, with CRLF line terminators
2:	ASCII text
3:	ASCII C++ program text, with CRLF line terminators
4:	ASCII text
5:	ASCII text
a:	ISO-8859 text, with CRLF line terminators
common:	ASCII C++ program text
gen-pass.sh:	Bourne-Again shell script text executable
go.sh:	ASCII text
mfu.txt:	ASCII text
pass_file:	ASCII text
pscan2:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.2.5, not stripped
scam:	Bourne-Again shell script text executable
secure:	Bourne-Again shell script text executable
ss:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.0.0,stripped
ssh-scan:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.0.0, stripped
vuln.txt:	empty

Interesting files:
Files 1 to 5, common and pass_file are password lists, totalling 235,523 potential passwords.
mfu.txt is a list of IP addresses, mostly in the 38.99.0.0/16 address space.
pscan2 is a fairly common and generic port scanner.
scam is a shell script that appears to be the core brains of the toolkit. It essentially looks through scanning a different ranges of IP addresses while periodically emailing the contents of vuln.txt back to it’s master (mafia89tm@yahoo.co.uk).
ss: appears to be another scanner used for looking for potential targets.
ssh-scan: appears to be a Romanian tool from the message provided if run without arguments, according to Google Translate (possibly NSFW), and as you would guess from the file name is a scanner for SSH services.
vuln.txt is blank in the archive, and will be the output of vulnerable systems located by the scanners.

All told this appears to be a kit for performing further scans for unsecured SSH sessions, and it is likely that a similar kit hosted on a different compromised machine was responsible for identifying my installation in the first place. Kits like this also quickly show the problem with tracking down the malicious user behind an compromise or attempt, it is rare for attacks to be launched from systems that can easily be traced back to the malicious user.

A quick Google search confirms that this kit (and user) has been seen in the wild attacking other systems, this posting on the Shell Person blog writes up the aftermath after a production system was compromised by the same kit.

–Andrew Waite

Infosanity: Infosanity

Wed, 21 Jul 2010 16:42:18 +0000

I’ve been running Kippo for nearly two weeks now (decided to live dangerously and go with SVN version) and have seen some interesting results.

Top 10 most common passwords attempted:

a (651)
123456 (495)
password (331)
12345 (302)
123 (224)
1234 (169)
1 (139)
12 (123)
root (105)
test (46)

Select count(password), password
from auth
where password <> ”
group by password
order by count(password) desc
limit 10;

Top 10 most common username attempted:

root (8510)
admin (144)
test (127)
oracle (96)
nagios (49)
mysql (47)
guest (43)
info (42)
user (41)
postgres (40)

select count(username), username
from auth
where username <>”
group by username
order by count(username)
desc limit 10;

Success ratio:

17065 attempts, 48 successful connections. (n.b. results skewed as account has purposefully poor choice of password)

select count(success),success
from auth
group by success
order by success;

Number of connections per unique IP:

202.99.89.69 (5212)
200.61.189.164 (1752)
78.37.83.203 (1043)
218.108.235.86 (848)
195.14.50.8 (628)
218.80.200.138 (271)
58.222.200.226 (238)
58.18.172.206 (158)
119.188.7.174 (128)
119.42.148.10 (113)

select count(ip), ip
from sessions
group by ip
order by count(ip) desc;

Number of attempts were relatively low IP address, in total 194 different source locations have attempted to access the server, with each typically only making 4 attemtps.

Packages:

Once exploited a number of attackers have proceeded to download various rootkits and utilities (thanks for these). Nothing too interesting yet, standard rootkit functionality, IRC clients and SSH scanners for further compromise. I still need to analyse some of these in more detail, so watch your RSS feeds for more to come.

One malicious user also attempted to create new user accounts on the server, if you have an account called ‘iony’ with a password of ‘ionyszaa’ then you may want to remove it…

If you’ve got a spare machine and public IP address, give Kippo a shot, setup is realitively easy; I’ve seen some interesting malicious user sessions and it turns out that some of those ’31337 haxxors’ that everyone fears really can’t type.

–Andrew Waite

Tmacuk.co.uk: Disaster Protocol – Episode 11 released

Wed, 21 Jul 2010 02:00:23 +0000

Go to the Disaster Protocol website – http://www.disasterprotocol.com

Ryan Tomlinson: Notify your customers of your product updates!

Tue, 20 Jul 2010 14:19:00 +0000

Every web app business should have a continual process of marketing their product. As with agile software development, digital marketing should be a iterative process to find out what is and isn't working and the same goes for user experience design. Your customers are using your products for a reason. Whether they like using them is a different matter altogether, but they are using them. Continual improvement, however, can only happen if you listen to the feedback from your customers.

Too many web app companies simply make an internal decision and release products/features before moving on to the next new feature and take it that not hearing a word about their new features can only mean that "it hasn't broken yet".

Be proactive and preemptive

Customers that are using your web apps, whether manager or not, will eventually lose interest if they aren't engaged or more importantly are hindered.

Make sure that they are aware of new features. Get their feedback and get it early. Make sure they know what is coming before it arrives. Provide screen shots, video walk throughs and help site documentation so that they aren't left stranded on the inevitable release.

We provide maintenance release notifications in our web app for every release cycle. This is a simple lightbox notification message that informs the user of the forthcoming release and what to expect with regards to new features/products. Once the user has seen the notification when they log in, they are no longer informed of the message and therefore is unobtrusive for the user.

SharePoint and other Microsoft technologies: Create Dynamics CRM entity mapping for lookup field

Tue, 20 Jul 2010 13:32:00 +0000

When editing attributes on CRM entities it is often necessary to pass that attribute through to the entity in the next stage in the sales process.

For example you add a contact name to the quote entity and you want that contact to be passed through to the order that is created from the quote.

To do this for standard fields it is simply a case of opening the customisation screen for the entity, adding a new attribute and then adding a new mapping to the relevant relationship. In the case of quotes and orders this would be the N:1 quote to order relationship.

Where things become a little bit trickier is if you want to create a mapping between two entities for an attribute that is a lookup. This is because it is not possible to simply add a lookup field as an attribute.

To do this for the case of the contact lookup being passed from quote to order do the following:

Create a new N:1 relationship on the order entity. The Primary Entity for the realtionship will be Contact.
Give it a display name of Contact and leave all the other fields as default.
Click Save and Close - this will have created a new attribute called Contact which we can now use to map the Quote Contact attribute to.
Edit the Quote to Order N:1 relationship and add a new mapping between Contact in the source and target entities.
Click OK.
Now you can add Contact to the forms and views where it needs to be visible.

USRLab: Waking NEDD

Tue, 20 Jul 2010 08:28:29 +0000

Over the 10 years or so I’ve had a keen interest in the development of software around the North East region. I was paid by companies in Sunderland and Newcastle to write a little of it. Much to my annoyance I found a huge amount of digital development work leaves the North East, outsourced from [...]

Jonoble.com, powershell, tech, stuff: Metro information displays and BGPS

Mon, 19 Jul 2010 16:23:14 +0000

For a while the Tyne & Wear Metro have had scrolling matrix displays installed in their trains, but until this morning I hadn't seen them switched on. On my commute to work today Nexus (the operators of the Metro) obviously had them in some kind of test mode, constantly scrolling the message "NEXUS METRO agps-bgps" as you can almost see on the rather rubbish photo below (it was moving text on a moving train and a phone camera, so it was bound to be bad):

Something like that isn't going to pass me by without a fair amount of curiosity.

Obviously they are going to be showing information based on the location of the train - that makes sense if the information is going to be useful. AGPS (Assisted GPS) is something that I know about - devices use data from a mobile (cellular) network to achieve a faster location fix from GPS satellites - but BGPS was a new one on me, so I looked it up.

Ordinarily I would expect there to be an article, or at least a mention in a bigger article, about something like this on Wikipedia, but I didn't see it. Instead I had to rely on a 2008 article from GPS World called Innovation: First AGPS - Now BGPS. It's a long article and assumes a knowledge of GPS that I don't have, but I'm pretty sure I understand the main points.

BGPS (named simply because B comes after A), is an adaptation of AGPS which gets round some of the limitations of AGPS. The Metro has underground sections, which do have some mobile network coverage, but obviously don't have line of sight with satellites, and when a train is in the great outdoors, it probably doesn't want to be reliant on mobile network coverage anyway - I know from experience that it's not great.

BGPS allows the side loading of the data that would come from the mobile network by using some other means. This is perfectly reasonable on the Metro network which is both tightly defined and linear, so beacons at some or all stations, or at signals, could talk to the BGPS hardware on the train and tell it where it is and the precise time; two things that enable a quick GPS fix via communication with the satellites, and could possibly enable the train to know where it is without the satellites with a good degree of accuracy too.

It all sounds incredibly sensible, so I hope that Nexus put the technology to good use. I'm certainly looking forward to seeing what they do with it.

While I'm talking about the Metro, if there's anyone reading this who is a regular Metro user and has an iPhone, I'd suggest you buy the incredibly useful Next Metro app. It tells you when the next train is due on your route so you know whether you need to run or can just saunter to the station. I hope they bring out an Android version soon!

Kristian Lunde: Zend_Input_Filter and the Alnum Validator

Sun, 18 Jul 2010 21:00:17 +0000

The Zend_Input_Filter is a very useful tool when you need to validate and filter the input to your application. It allows you to both filter and validate the input without a lot of hassle. One of the cool features it has is that it allows you to add the validators you need and meta commands [...]

Tsdbrown: Webdurance - Getting Charities Online in 24 Hours

Sun, 18 Jul 2010 15:44:01 +0000

I recently took part in an event called webdurance. The aim was to get six charities online within 24 hours. The following is my write up of the experience…

Getting There and Setting Up

Thursday the 15th of July 9am, buzz goes the alarm, quick shower, large breaky, bag packed and on the bus into town by 10. A snippet of tourist like GPS navigating and 10 minutes later I strolled into the webdurance room in the INEX building at Newcastle University. After walking into the room it was great to finally put a picture to the set-up, somehow it’s always completely different to how you imagine it. Everyone was setting up shop with cables, laptops, and other crazy stuff like huge touch screen tables being thrown around like balloons at a kids party. It was a cracking atmosphere and you could just feel the excitement in the air.

The Pre-work Necessities

Once settled in we spent an hour or so on introductions and getting to know our team members. We had a quick photo and listened up to the schedule, making particular note about when the pizza, sandwiches and possibly most importantly (especially for Kat) the red bull deliveries were due. Next up was probably the funniest health and safety talk I’ve witnessed and a scary tweet from onion2k about the interesting materials nearby. I particularly enjoyed the radioactive sign on the way past the loos! There were also reports of the odd guy or two running around in hazmat suits. Anyway none of that could phase us as we had an important job to get on with.

Meeting The Charities

Each team met with their charity and spent some time talking through the requirements. At this point Danny and Kat in particular started to shine getting in instant grip of how Azure is structured, the details of the work they perform and where they do it. From then onwards we were talking with Ken Addison and Julie Embleton from Azure about the objectives, the audiences and some ideas for what would benefit them. Ryan and Kat were busy working on the design brief, Ash was talking through copy, Lee and I were noting functional requirements and Danny was kicking butt on the flip chart (Watch the video to see him in action) making notes on the entire lot. With the guys leaving behind a few nice chocolate treats and the promise of bacon rolls in 21 hours they left us to it with a clear idea of what we were building.

Go Team Five

Danny, Kat, Ashleigh, Ryan, Lee and I made up team 5. Due to the intensity after just 24 hours I’m sure we all felt like we’d know each other for years. The range of skills was quite incredible. Unfortunately Ash wasn’t feeling too good as the night draw in and was still recovering from illness through the week, but Paul King and Wayne Smith stepped in to help us out. That was the awesome thing about webdurance people were just pitching in wherever needed, I wouldn’t be surprised if all teams owe an extra thanks or two to someone outside their initial six members.

Throughout the hours our productivity went up and down like a yo-yo as expected, but we all managed to get our heads down and battle through when it really mattered. “Headphones On” soon became a signal to leave people alone as they’re in that special place “The Zone”. Time seemed to shift occasionally, one minute we had loads of it left, next we’re asking was that really yesterday with only 3 hours remaining!? The funny hourly updates and the giant count down timer aided in bringing us back into real time. Finally I have to mention the genius of “the list”, anything and everything got chucked on it and although it was forever growing and never written down it definitely helped us focus on getting things finished.

The End Product

After looking at something for 24 hours I’m convinced that you start to believe whatever you working on isn’t good enough. The feedback from the team, the charity and others, plus the reflection after a lengthy sleep or two has completely changed my mind. All six websites produced at webdurance are top class. It’s likely some sites like ours are a little rough around the edges, but that’s okay, they are built and usable. Like the other teams we’ve committed to pitch in and help the charities out in the future. I know our site will be undergoing a small review from the charity’s chief exec and once approved we’ll be putting it live. I’ll add the link once that’s done.

Wrapping Up

Once finished each team gave a five minute demo of their site, with the charity representatives present this was a great time to reflect on all the hard work everyone put in. It was great to see what the other teams had been busy working on up on the big screen. Once complete, some cleverly thought up awards were handed out to the well-earned winners, our team won a couple of prizes including twitterholic (Kat) and loudest person (Ryan). So we’ll be shooting it out at paint-ball and avoiding Ryan at all costs after his James Bond training session. The last part of the story was naturally a quick visit to the pub for the few that could conjure up enough energy. After a couple of pints and a few more giggles it was time to hit to road home.

I’m proud to have taken part in the first ever webdurance. The King Brothers and friends, the event’s sponsors, all the volunteers and everybody else involved helped make it one incredible experience. I will most definitely be signing up next year!

A Little Bit of Jamie Hurst: Just a Bit of Local News…

Sun, 18 Jul 2010 12:27:56 +0000

Well this is a little bit of news I haven’t formally written about yet, but last Tuesday, me, Mark and Jonny officially graduated from Sunderland University, all with First class honours degrees in Computing, and needless to say, we’re all extremely pleased! Having three students at LINGsCARS.com was always a pretty special setup, but the fact that we all graduated at the same time with Firsts was definitely something worth celebrating! So much so, that we decided to contact a local journalist we have had past run-ins with (that’s a story for another day though…) and I contacted the university’s PR department to see if they wanted to make a bit of a story out of it, and as it turns out, they did!

We appeared in the Sunderland Echo and Shields Gazette on Thursday, Jonny even seemed to get his own special article in the Gazette, stepping into the limelight and chucking me and Mark behind him! We’re all extremely pleased, and I’m personally looking forward to getting recognised all over Tyne and Wear as a local celebrity! I’ve highlighted the parts of the article that either mention me or mention the specific disasters we seem to create… (We actually have over 320 database tables now, around 340 at last count, and we’re always improving the stability, contrary to popular belief!) Ling has put her own take on the events on her website too.

Incidentally, I am now a full-time web developer at LINGsCARS.com, and Mark and Jonny are both off to do Masters degrees: Jonny at Southampton and Mark possibly at Newcastle or Bristol! I’ve decided to bow out of the education system once and for all, I don’t think I could manage another year of juggling everything doing a Masters degree, and in my opinion I won’t really learn any more out of it, I’ll learn much more staying at the wacky company that I’ve been at for almost three years now!

So here’s to all of our futures!

USRLab: Webdurance

Sat, 17 Jul 2010 11:54:31 +0000

Webdurance, a 24 hour event to hack together a website for a set of local charities, and the idea of brothers Paul and David King from 1DayLater.com, damn near killed me. I haven’t been quite that tired in a very long time. I’m not consumed that amount of coffee, or sugar in so long either. [...]

Richard Lane: Trigger Event Selling – a webinar with Craig Elias of Shift Selling Inc [SaaHL programme]

Fri, 16 Jul 2010 09:14:52 +0000

Listen to this (unedited) recording of a webinar on ‘Trigger Event Selling’ with guest presenter Craig Elias of Shift Selling Inc. This online presentation is hosted by Engleby Associates as part of the Selling at a Higher Level blended sales training programme and is the third in a series of insightful presentations designed to help sales people be the best they can possibly be.

Last year I recorded two podcasts with Craig on Trigger Events (available here and here). If you have enjoyed listening to these then today’s webinar session will not disappoint. Listen to Craig guide you through his unique and hands-on approach to selling. Benefit from his expertise, his theories and his practical understanding of knowing when it is the right time to sell.

This webinar is a must for anyone interested in being a top sales performer.

Click on the link below to download an unedited recording of the session.

Download the presentation to your computer [duration 53 minutes, 42mb]. NOTE: Because of the size of the file it will take time to download – maybe faster, maybe slower than expected. Sort of depends on your connection speed.

Click here to hear Craig Elias present on Trigger Event Selling

[53 minutes duration]

Enjoy and feel free to leave a comment with any feedback or questions.

If you would like more details about the Selling at a Higher Level programme please call Richard on +44 (0)7545 881442.

Back Consulting: Dan the TV Man

Wed, 14 Jul 2010 15:52:53 +0000

Friend of BACK Daniel Newbould and his inflatable greenhouse product made it onto the TV recently. Listen to him work his magic:

To find out more about the inflatable greenhouse visit his website built by BACK Consulting: http://www.thegreensafe.co.uk.

USRLab: Statistics Fun With DNA Databases

Wed, 14 Jul 2010 08:15:00 +0000

The UK National DNA Database currently has about 3 million people’s biometric information stored in it. If DNA recovered at crime scene has a 1 in 50,000 chance of matching someone, what is the probability that a match will be found even if the actual perpetrator’s information isn’t in the database? 1 – (1 / 50,000) ^ [...]

At the end of the day, Gary...: TechHub Founder Dating

noreply@blogger.com (David Lavery) — Tue, 13 Jul 2010 20:49:38 +0000

Yesterday evening I was lucky enough to participate in Seedcamp/TechHub's Founder Dating event, and very good it was too. Held at the newly opened TechHub Towers, next to Old Street tube station in Islington, it was basically speed dating for people looking for co-founders for potential start ups. I met really clever and interesting people, with some great ideas, and I was thinking it would be great to replicate this kind of event up in my native North East - I'm sure there are enough potential CTOs, CEOs, and investors up here willing to give it a go.

One thing did strike me though: there is no fear of failure. Several of these people had had start ups fail on them in the past, and just carried on. The advantage of living and working in London is that they can just pick up a regular job until they recharge their batteries and build up a bit of cash for when the next start up beckons. There is just so much work around. That is one area where the North East doesn't compete just yet - we're perhaps not quite able to support that kind of job market flexibility, I fear, and that may hinder start up activity.

As for the rest... the beer was good, the wine was good, the pizza was good, and The Angel across the road is a proper pub.

For more information on TechHub, see techhub.com

SemiBad: Scared of the Ocean - Thalassophobia

Tue, 13 Jul 2010 14:41:30 +0000

A couple of weeks ago I posted this illustration, which I was hoping to develop as a full project. And that&aposs exactly what happened — as the artwork for the debut album from Scared of the Ocean, a band from my home town of Milton Keynes. Plenty of pictures in the full article.

Alistair's Blog: Upcoming July events

Tue, 13 Jul 2010 12:43:43 +0000

I ave just knocked up a quick list of events coming up in the next two weeks and thought I would post it here in case you found it useful…

Newcastle Coffee Morning, Newcastle
Wednesday July 14, 2010 from 8:30am – 9:45am

Our biweekly breakfast gathering in a local coffee shop. A great chance to chat with fellow creative people.

Webdurance, Newcastle
Thursday 15th to Friday 16th July 2010

A 24 hours coding event to create web sites for charitys. We need 3 more people if you are up for it.

NEBytes Virtualisation-o-rama, Newcastle
Thursday July 15, 2010 from 6:30pm – 9:00pm

A chance to find out about Hyper-V and more. Please note the new date.

Ruby Ground Newcastle Meeting, Newcastle
Wednesday July 21st 2010 from 7:00pm – 10:00pm

Talks on Active Relation in Rails 3 and Luke and Refinery CMS in addition to other discussions.

Big Ideas Summer BBQ and Technology Exhibition, Sunderland
Thursday 22nd July 3:00pm – 8:00pm

A chance to socialise and play with some retro 70s and 80s technology.

The Geekest Drink, Newcastle
Friday 23rd of July from 6:30pm

Just a group of geeks going down the pub for a drink and a chat.

Howduino NCL, Newcastle
Saturday 24th and Sunday 25th July 2010

A two day workshop about connecting the Internet to the real world. Free and open to everyone.

There is a SuperMondays pencilled in for the following Monday and several event after that. If you want to keep an eye on my events calender then it is published on the Maker Space events page.

[my][home][toon]: Give us this day our daily bread(maker)

Tue, 13 Jul 2010 12:03:27 +0000

A couple of years ago I bought myself a breadmaker, and I’ve never looked back. I love bread, I love making bread by hand, and take great therapy in kneading and resting, working to find that beautiful silky texture of the dough.

However, time is my master at the moment, and being able to wake up to a fresh loaf (and a house full the smell of baked bread) is worth the trade off. The weekend is kept for making real bread.

I can’t recommnd my Panasonic SD255 breadmaker enough. There were a couple of things that set it apart from the others I’d looked at, namely the dispenser (for dropping fruit/nuts/seeds etc into the dough part way through) and the timer. If you’re going to get a breadmaker then buy one with a timer or you won’t use it. I set it up before I go to bed, pouring all the ingredients in including the ater and oil, dial up when I want my bread, and toddle of to sleep. A perfect loaf awaits me once I get out of my pit.

One of the things I’ve noticed though is that the recipes that come with it don’t really make the greatest loaves. Often they were a bit too dense, with a tight fine crumb. Fine it you like it, but I prefer my bread to have a far more open texture.

I tend to add a bit too much sugar, at least atable spoonful, which is 3 times what is normally added, which kicks the yeast into being really gassy, opening up the bread texture hugely.

I also add a really good slug of olive oil, which results in a really crisp and flaky finish. It does make the outside of the bread a little greasy sometime (a bit like a focaccia) but it makes the bread much easier to slice when fresh ans I love the chewy flaky crust.

Of late I’ve also been adding a good handfull of mixed seeds into the mix, not using he hopper but just slinging them in with the flour. Flax, linseed, sunflower and punkin seeds have all gone in, and all been great. A big handful fo cheap green olives makes for a lovely Saturday lunch loaf too.

Possibly Related Posts:

USRLab: The Death Of Internet Advertising

Tue, 13 Jul 2010 06:34:00 +0000

Here’s an interesting number: 1.7 billion. That, according to the ITU, is the number of people who’ll be accessing the internet using a mobile device by 2013. Here’s a second interesting number: 70%. That, this time according to mobile ad and content provider Buzzcity, is the percentage of times that a mobile device is to access [...]

Back Consulting: Get Organised with E-Commerce from BACK

Mon, 12 Jul 2010 22:01:29 +0000

E-Commerce from BACK

Jonoble.com, powershell, tech, stuff: NEBytes Bytecast

Mon, 12 Jul 2010 17:19:44 +0000

Back in May I posted about starting a podcast with the rest of the guys who run the North East Bytes usergroup - the idea being that we would chat about some things that would be relevant to the folks who attend the NEBytes meetings, i.e. I.T. professionals and software developers working (mainly) with Microsoft products. Relevancy is a fairly subjective thing, but we're covering a fairly broad area from products aimed at corporates, to smartphones and other stuff that's more in the consumer space. It's not all about Microsoft since we're interested in a whole load of related (and less related) technologies.

We've now recorded four episodes, and while I wouldn't say that we've perfected the formula, it's definitely improving. We've increased the speed of editing and releasing, and we've gone from trying to cover everything that we've found remotely interesting to focusing on a few areas. It's so much better that I would suggest you just think of episode 4 as episode 1 and forget that the others actually happened! ;-)

We've also got our act together and sorted our a proper NEBytes Bytecast RSS Feed, so you can subscribe in your favourite podcast client. It's been submitted to iTunes, so hopefully you'll be able to find it there soon too.

[UPDATE] You can now get the NEBytes Bytecast in iTunes.

We're still looking for feedback to improve the show further, so please get in touch and tell us what you think.

Richard Lane: Fast track your sales with Sales 2.0 technology

Mon, 12 Jul 2010 15:20:44 +0000

I write a monthly column within the Science & Technology section of The Journal newspaper in the North-East UK. I thought it worth repeating June’s article here on my blog since the content is highly relevant to my readers.

Let me know what you think.

TECHNOLOGY can help you gain a rapid understanding of who your customers are and what they are interested in.

I was with a customer earlier this week who has implemented a live chat function across their website. This value-add service provides their prospects and customers with an opportunity to speak to a ‘real’ person quickly and easily – with the click of a mouse. However, it also serves up a set of high value benefits for the sales team to help them sell at a higher level.

One of the greatest challenges we have in sales is finding the right person and sparking a conversation. It is not enough to have done your research and found the right person. The next step is to engage them; and at a time when they are focused on solving the problem, or creating the future, your company believes it can help deliver.

As with much of technology 2.0 it is the data behind the service that makes live chat products so exciting. Successful selling is about asking questions you know the answer to in order to gauge your prospects’ interest and buying position. It is about building rapid rapport by focusing on what is important to them. It is about always qualifying interest and spending time with prospects who have the need and ability to buy from you (assuming you are able to help them, of course).

Imagine how much more confident you will feel when speaking to a prospect if you know that they have already spent time on your website, not to mention how much more focused and effective your questions will be if you know exactly which sections they have visited. However, I believe the real power lies in the immediacy of the information becoming available to sales. We all know that the best time to speak to a prospect is when they are thinking about an area where your expertise can help. Intelligent use of the data behind this type of technology adds science into your sales effort. Gone are the days when we wait a week (or more) for a ‘hot’ lead to filter through from Marketing to Management for assignment to Sales to action, only to find the requirement has fallen down the priority list and our company has been forgotten.

This availability of real-time data should lead to a win-win result on both sides of the buying table. Sales people empowered to target prospects that have shown an interest in their product or service; potential customers being assisted in a timely manner and with a higher degree of personalisation and accuracy.

Alistair's Blog: Someone is pretending to be me

Mon, 12 Jul 2010 13:20:42 +0000

It might surprise you that anyone would want to be me online, but apparently someone does.

I stared getting suspicious when I stared receiving password reset emails, but then it went to a whole new level when they started lodging support emails. They were using an old email address of mine to try and gain access to various accounts, implying they were me, and trying to use facts from that email address to prove it. Fortunately I did not use this address to register on any sites, and would not do this from a domain I do not control.

Fortunately I am reasonably well known in this world and someone guessed what was going on fairly early. I think I know who is behind this and am taking steps for the domain with the email address being abused be suspended.

If you get a request calming to have come from me to reset a password then please treat it with suspicion and contact me thought my web site.

Jonoble.com, powershell, tech, stuff: Free iPhone 4 cases from MobileFun

Mon, 12 Jul 2010 09:45:47 +0000

[UPDATE] Since Apple have now decided to give away a Bumper or other iPhone 4 case themselves, MobileFun have stopped their free case offer. They'd given away nearly five thousand in the week that the promotion was running - wow!

I mentioned the iPhone 4 reception problems in a previous news roundup post. It seems that Apple aren't going to be giving away free Bumpers to solve the issue, but my friends at MobileFun.co.uk have announced that they are giving away a free iPhone 4 case to cancel out the "death grip" effect.

The free case is like a transparent bumper style band round the sides with cut-outs to access the buttons. It's listed for £7.49, but their blog post has a code to discount that down to zero until the end of July or until stocks run out.

If you want a case that's a bit fancier, then they've got a whole shed load of other iPhone 4 cases to choose from.

USRLab: Are you starting something?

Mon, 12 Jul 2010 08:55:44 +0000

I consider myself to be a chronic procrastinator. Left to my own devices I make “to do” lists, lists of “to do” lists, project plans, plans for project plans, lists of plans for plans of project plans; essentially, I’ll do anything but actually start working. I willfully make my life more difficult than it need [...]

Differential Progression: Abandoning Twidroyd

Sun, 11 Jul 2010 12:08:41 +0000

Twidroyd/Twidroid is a Twitter application for the Android platform. I really quite liked it, until they were bought by Tweetup. Why? Well, during the name change they added a huge EULA. However, the important part is (highlighted part by me):

CONTENT You shall retain ownership rights in information or other content that you upload, post or otherwise transmit to or via your use of Twidroyd (“Submissions”); however, by making your Submissions through Twidroyd, you grant Licensor a worldwide, non-exclusive, royalty-free license (with the right to sublicense) to use, reproduce, edit, translate, reformat, distribute, modify, transmit, prepare derivative works of, publicly display and produce the Submissions in connection with the enhancement of the Twidroyd service or otherwise in connection with Licensor’s business. You agree that these licenses include the right for the Company to make your Submissions available to other companies, organizations or individuals who partner with the Company for the syndication, broadcast, distribution or publication of such content on other media and services, subject to our terms and conditions for such content use. Such additional uses by the Company, or other companies, organizations or individuals who partner with the Company, may be made with no compensation paid to you with respect to the Submissions. We may modify or adapt your Submissions in order to transmit, display or distribute it over computer networks and in various media and/or make changes to your Submissions as are necessary to conform and adapt that content to any requirements or limitations of any networks, devices, services or media.

This is a bit like Microsoft saying, “If you use Word to write something then you grant us a license to it.” Or Bic saying if you use their biros then they get a license. Or perhaps your paper manufacturer.

It’s also really sneaky. They don’t do it upfront and tell you that they want this right; they hide it in a EULA and in the Terms and Conditions.

So, this was happened when they were bought by Tweetup? So let’s look at their Terms. Sure enough, hidden in their Terms is:

You agree that these licenses include the right for the Company to make your Submissions and, if applicable, User Content, available to other companies, organizations or individuals who partner with the Company for the syndication, broadcast, distribution or publication of such content on other media and services, subject to our terms and conditions for such content use.

Again they are hiding this. I guess they want to use all the ‘tweets’ to try and sell them or the intelligence/analysis that they contain. And they are a commercial company and so want to make money. I have no problem with that. My problem is that they aren’t being upfront about it. And I guess they aren’t being upfront about it because they suspect that most people don’t really like the idea that their stuff (even if it has no individual value) is being sold.

Perhaps we should start paying for these services and really know what is happening to our data, rather than thinking everything is for free, and thus effectively forcing companies to do this type of thing?

Now I just need to find an alternative. And ideas?

A Little Bit of Jamie Hurst: PHP Tutorial: Validating Forms with Veto

Sat, 10 Jul 2010 10:35:10 +0000

Validation is one of the basic uses of PHP, and one of the things we learn first as PHP developers. However, it’s basic doesn’t lend itself to the fact that it is both time-consuming, and can be difficult to implement when concerned with more advanced uses. When connecting it to a JavaScript validation instance, for example, the simple task is made much more difficult, as you effectively have to code the validation steps twice to achieve the same effect!

Veto, a joint PHP and JavaScript library written by Jonathan Scott, is a solution to this problem. It combines the server- and client-side validation setups in an attempt to provide help and guidance to a user presented with a form, while also protecting the data inputs from any untoward entries. I have been involved in active development on this project from the start, and can safely say that this is a unique solution in the form of a joint library, otherwise it wouldn’t have been written in the first place! Now, before I continue, I must stress that Veto is currently still in active development, and is not recommended for a production environment, however the library itself is stable and workable.

I’ll start with a bit of background. Veto is the newest version of a piece of software originally built onto a custom framework at LINGsCARS. We needed a quick solution to coding a lot of forms with validation included that was both flexible and secure, and so LavaForms was created, and first deployed on the brand new quote form we had just finished writing. However, LavaForms was lacking a lot of features, and was relatively problematic when it came to Internet Explorer. We needed a more advanced version of the library that supported separate sets of form elements, effectively subforms, and which supported Internet Explorer more readily. So, we started from the ground up and built Veto.

I’ll provide a quick example on how to use Veto to create a form which includes automatically validating elements, and which provides both client- and server-side protection for the form itself. This example will not be using Sets, one of Veto’s more advanced features, and will be just a simple comment entry form. The easiest way to get Veto is to clone the repository from BitBucket and use the source code provided from there.

First, start by requiring the Veto library files and creating the form object itself:

require_once 'veto/veto.php';
 
$form = new vtForm('contact', array(
	'error_display_section'	=>	true,
	'error_display_inline'	=>	false
));

The vtForm constructor takes two parameters: the name of the form, which will be used to prepend all HTML elements created, and the configuration options that can be set, which are detailed on the Veto wiki on BitBucket. Here, I have set Veto to display any errors at the top of the form, and not inline next to the problematic elements. You can also set the method and action properties of the form element, which defaults to POST to the current page.

Next, we create some validation options to set on some of the fields. We will require a name and email, and make sure the email address is valid:

$form->add(
	vtField('name')->required('Please provide a name with your comment.')
)->add(
	vtField('email')->required('Please provide an email address with your comment.')
			->email('Please provide a valid email address with your comment.')
);

This creates two fields with require validation. The name field is required, and an error message is provided, and the email field is both required, and must be a valid email address. Validating emails is just one of the many features built into the Veto library in its default implementation.

Now that the validation for the form is setup, we can output the form in HTML using the provided helper methods:

<body>
	<?php echo $form->tag(); ?>
		<?php echo $form->errors(); ?>
 
		<label for="name">Name:</label>
		<?php echo $form->textField('name', array('size' => '30')); ?>
 
		<label for="email">Email:</label>
		<?php echo $form->textField('email', array('size' => '50')); ?>
 
		<?php echo $form->textArea('comment'); ?>
 
		<input type="submit" name="submit" value="Send Comment" />
	</form>
</body>

OK, so there is a lot going on here. First, we display the correct form tag and mark the spot in the HTML document we want to Veto to display its errors if there are any. Then we display the fields, first the two we created that have validation attached, and then a new textarea that has no previous validation. Finally, we place the submit button for the form and close the opened form tag.

To add JavaScript validation to the form as well, make sure a script tag similar to this one is included at in the head section of the HTML:

<script type="text/javascript" src="veto/veto.js"></script>

And that’s it! That will get you underway with the Veto validation library. There are a lot more examples and explanations provided with the free download of the library, but feel free to include any problems or observations in the comments as normal!

Alistair's Blog: Freeview EPGs – A brief history

Thu, 08 Jul 2010 13:27:24 +0000

With the recent switching off the the Multiguide / 4TV service there has been some confusion on several forums and Twitter about what EPG services there are and have been. This does not surprise me. In the past created the link between Unique Interactive’s EPG solutions the the BBC systems for feeding the EPGs, and I still get confused. In total we have had about 5 EPG services and today, after the loss of the Multiguide service, we still have three. This is my attempt to summarise what has happened from memory. If there is anything you would like to add or if I have recalled wrongly then please comment on the post.

Now and Next

The original EPG was and still is a now and next service that is still transmitted today. It does exactly what it says by saying what is on now and what is coming up next. This information is transmitted on every multiplex. Originally the information sent appeared to differ on the different multiplexes but today the information seems to be the same.

NTL Interactive

The name implied to me that this was supposed to be part of NTL’s push in to the interactive TV market, but I remember it solely as a 1/2 day TV guide on On Digital. This was available on all boxes that supported MHEG, that was most at the time.

I vaguely remember this service being overtaken by a Teletext EPG (TV Navigator) with comparable functionality, and then this was upgraded so it did not function with my box. For the sake of this blog I am regarding all these as one EPG, although I fully acknowledge they were two completely different EPGs utilising the same technology in the same way.

Multiguide (4TV Interactive)

Originally introduced by 4TV and later maintained by InVision. Originally a 7 day service it was expanded to 14 days around the same time the Freeview 7/8 day guide (below) was launched. As a result many devices that are labelled as supporting 7 days that would actually support 14 days worth of listings. The service was funded by receiver manufacturers.

Sadly for those of us who used it the service stopped in June 2010. As soon as a free and open Freeview EPG service was launched the Multiguide days were numbered and the last box was allegedly manufactured in 2006.

Freeview 7/8 day

When ITV Digital (formally OnDigital) failed in 2002 there were several groups that offered proposals. The winning group were the people behind Freeview (including BBC, BSkyB, and Crown Castle). As part of this plan a native Freeview EPG service was created and is used by most devices today.

Teletext Extra

This is a 14 day service launched in April 2007. The service funded by adverts that are shown on the listing page and is generally accessed by the guide button on a comparable device’s remote control.

SemiBad: Mano a Bydo

Thu, 08 Jul 2010 01:09:38 +0000

A quick remix of a vector illustration I did last year, for a blog post that I never finished.

On a related note: Dobkeratops is my favourite video game boss of all time. I think that was basically what I was trying to say in the blog post, although I had it padded out over about 1500 words. That, and that you should probably play an R-Type game in the next few days.

[my][home][toon]: Home-brewed time-lapse fungus growing 101

Wed, 07 Jul 2010 20:31:32 +0000

That last post was because I could hardly contain myself. Messing about with hardware, scripting and growing things all on the same project was right u my street and I couldn’t resist. I’m working my way up to producing a much bigger and high-res time-lapse project later this year, and this was something of a trial run.

The idea was simple…

Take a mushroom growing kit from gourmetmushrooms.co.uk
Use it to turn a fairly racist and crap novel (which upset me because it’s written in Robert Ludlum‘s name, and not half as good) into mushrooms
Eat them in a meal where I’d grown or made everything
Film the whole process and release the film and the scripts that built it.

The Mushrooms

The instructions that came with the kit are pretty good. You soak the book in warm water, wring it out so it’s not sodden, scatter spore impregnated wheat through the book and then rubber band it up nice and tight. It sits somewhere for a couple of days (about a week) until the mushrooms root system has developed and once the whole book has gone white you pop it in the fridge for a couple of days. This shocks the mushroom system into growing, a bit like a cold patch of weather.

Once you take the book out of the fridge and open up the plastic bag it’s just a matter of keeping it warm and nicely moist. A plant mister is perfect. Spray a couple of times a day and you should be about right. I went to a wedding for 2 days, so soaked it well before leaving and it survived ok.

Once sizable mushrooms had formed it’s justa matter of breaking them off and getting cooking. With a bit of luck the book should produce another run, if not, it’s compostable (hell, it’s half way there).

The technology

The original plan was to use an old Sony laptop running Linux, connected by USB to a digital SLR camera, taking a photo every 15 minutes and backing these up. After talks with Ken Murphy about his History of the sky project at MakeFaire this all sounded pretty easy. However after a lot of messing about with gphoto2-lib and my old Fuji S7000 I found them to be incompatible, one could see the other, but not take photos. Bummer. My Nikon D40x works with gphoto2 brilliantly, and takes better photos, but you can’t power it externally easily and the batteries only last for about 24 hours taking a photo every 15 minutes.

To top it all off, the laptop I had picked out turned out to not have an ethernet port (how old was it, no idea, 10 years +) , so it was back to the drawing board all round.

So ended up with the following rig…

My old G4 iBook running OS X
A webcam from PC World for a tenner (Logitech)
Wacaw running to take the photos
DropBox* being used for remove backup and public viewing
Cron calling
A bunch of BASH scripts to hold it together electronically
A bunch of duct tape to physically hold it together

Wacaw was a complete find and saved my bacon. It’s a command line utility that will ket you call multiple cameras and save the images off that it gets back. It did on Mac what gphoto2 was going to do for me on Linux. You run it with a -L switch to get a list of available devices, and then run it again calling the input device you wish to grab from. Ideal if you want to do multiple angles with multiple cameras.

The scripts that make al this happen are nothing special, just a bit of date wrangling to get a unique id for each photo, and then some copying around to ship the files to DropBox. A second script runs once a day to create a daily video file.

This first script captures a new image ever 15 minutes, between the hours of 5am and 7pm. Here’s it’s crontab entry

0,15,30,45  5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 * * *  /Users/me/grabber.sh

And here’s the script…

#!/bin/bash
DTS=$(date "+%y_%m_%d_%H_%M")
HOME=/Users/me
#/Applications/wacaw -d02 /Users/${home}/Documents/grabs/one_${DTS}
/Applications/wacaw -d02 /Users/${home}/Documents/grabs/mushroom_${DTS}
rm ${home}/Documents/grabs/mushroom_current.jpeg
cp ${home}/Documents/grabs/mushroom_${DTS}.jpeg ${home}/Documents/grabs/mushroom_current.jpeg
cp ${home}/Documents/grabs/mushroom_${DTS}.jpeg ${home}/Dropbox/Public/mushrooms
cp ${home}/Documents/grabs/mushroom_current.jpeg${home}/Dropbox/Public/mushrooms

And here's the daily crontab entry that makes a film...

58 23 * * *  /Users/me/filmer.sh

#!/bin/bash
set -x
DTS=$(date "+%y_%m_%d")
/Applications/Mencoder\ OS\ X.app/Contents/Resources/mencoder "mf:///Users/me/Documents/grabs/mushroom_${DTS}_*.jpeg" -mf fps=10 -o /Users/me/Documents/grabs/${DTS}.avi -ovc lavc -lavcopts vcodec=msmpeg4v2:vbitrate=800
cp /Users/me/Documents/grabs/${DTS}.avi /Users/me/Dropbox/Public/mushrooms

And here are the results, which if you look closely, you can see that I picked them two days too late.

12 days of mushroom growing time-lapse from Oli on Vimeo.

Also, the photos (and the final destination)

*Disclosure: if you use the link for Dropbox on this page, you’ll get an extra 250mb and so will I because it’s a referral link. I’ll not make any money through.

Possibly Related Posts:

1DayLater: A chance to party in Gateshead new creative workspace 'The Shed' before its new tenants move in

Wed, 07 Jul 2010 12:44:00 +0000

‘The Shed’ is a former Bed Warehouse in the UK city of Gateshead. After it’s former occupiers met some unknown fate (bankruptcy perhaps) the building was scheduled for demolition in around two years time. So the council, rather cleverly, have decided to turn the place into an open-plan workspace for creative companies.

And what’s more, 1DayLater is going to be one of them! Being surrounded by a host of different interesting people will no doubt inspire us with new ideas, new drive and motivation (not that we really need it mind) - so we’re very excited.

Our soon-to-be neighbours will cover a myriad of different disciplines, comprising of artists, web designers, software companies and even a troupe of actors called Unfolding Theatre - I’m not sure whether they have an actual unfolding theatre or if it’s just a clever name but I can’t wait to find out.

The Shed space itself needs to be managed by the community, with everyone pitching in to help with fixtures and fittings etc. And some other enterprising tenants have already arranged a fundraising party in the empty space we will soon be occupying to help pay for all these things.

If you are local to the area I would urge you to come along. There will be live music and lots of interesting people to meet. Hope you can make it!

[my][home][toon]: Jerking it

Wed, 07 Jul 2010 11:58:08 +0000

I love jerk chicken. In fact, I love Jamaican food. Jerk chicken, curry goat, popperpot stew, Saturday soup, I love it all. There’s something ever refreshing about cooking without cream or thickened sauces, avoiding thick and sticky glazes and having hot food without it being nose-pinchingly spiced.

Ideally jerk should be cooked on a half oil drum barbecue, but whilst I hunt down and build one of these, I use a bog standard BBQ. This time annoyingly the rian started just as a lit up, so this chicken was cooked in the oven.

I followed this jerk chicken recipe from the from Helen Grave’s brilliant blog Food From the Rye, which I’ve been addicted to for a little while. The only modification I have was to drop the dark sugar and molasses, and to replaced it was a big tablespoon of golden sugar, and about 50ml of dark rum. I didn’t have dark sugar in, otherwise I’d have used it, but I would still keep the rum in. Lots of things are soluble in alcohol that are not soluble in water, so using rum not only adds to the smoky and sweet flavour, but I believe also helps carry the flavours through the meat better.

I took a whole chicken, spatchcocked it to help fit it on the BBQ, and kept it in a tight plastic bag with the marinade for a full 24 hours before cooking. The bag holds the marinade against the meat and excludes the air. You need to pick up the bag and squidge it about to made sure all the chicken gets exposes, and turn it so that the top is not left out of the fun. I also slashed the chicken deeply a few times to help get the flavours into the meat.

On the day of cooking I took the chicken out of the fridge for a few hours to come back to room temperature, and opened the bag to help lef the meat dry off a bit. Ideally I’d have BBQ’d it indirectly over the coals (push them to one side, and put a tin tray under the meat to catch the drips). This time however, I had to use the oven, 180 degrees for an hour covered, with 30 minutes on the end uncovered, and then resting for 20 minutes.

Possibly Related Posts:

Infosanity: Infosanity

Tue, 06 Jul 2010 20:48:15 +0000

As I started life as a Linux server admin I’m only too aware that many attackers see remote access functionality as a way into a system, and as SSH is the de facto standard for Linux access it is a prime target for attack. The stats collected by DShield give an indication to the extent of the problem.

As a result I’ve had the Kippo honeypot is something that I’ve had on my radar for a while. For a number of reasons I hadn’t found time to implement the system in a live environment, but a recent post on the Diatel blog suggested that installation may be quick and pain free.

Kippo is described by it’s author (Desaster) as:

Kippo is a medium interaction SSH honeypot designed to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker.

Kippo is inspired, but not based on Kojoney.

Installation for me was painless, running a Debian system I downloaded the latest archive to disk, unpacked and installed the pyton-twisted package (I hadn’t read Mig5′s comment until after install so now need to go back and live on the bleeding edge…). I did hit a couple of problems when trying to start up the system, which is as simple as invoking ./start.sh

First, I was logged in as root when I first tried to start the system (not clever I know, was testing…). Kippo encounters an error when started by a root user. As Desaster rightly states, it’s not wise to run Kippo as a root user anyway and running as a regular user resolves the issue.
Second, when running as a normal user I got a ‘meaningful’ error of “Failed to load application: ‘NoneType’ object has no attribute ‘get’.” A quick piece of Google-fu lead me to this ticket, which explained Kippo was missing the file kippo.cfg, as explained copying kippo.cfg.dist to kippo.cfg correct the issue and produced a fully functional system.

There are a couple of key files that can be edited to change the feel of the system that is provided to malicious users:

kippo.cfg contains runtime information including log location, fake hostname etc.
kippo.tac contains an array ‘users’, which lists the username/password combination which the emulated SSH login will accept as ‘valid’.
The honeyfs/ directory goes so far as to allow you to create a ‘real’ filesystem for the malicious user to interact with, potentially copying a live server’s filesystem to the directory to help camouflage the emulated system (after sensitive data is removed/sanitised obviously….). I haven’t tried this myself yet but is definitely on my to-do list.

From initial testing I’ve got high hopes for Kippo becoming a mainstay in my honeypot toolbox; the interaction session provided to a malicious user is reasonably convincing at first glance, and I particularly like the trick to keep users logged in after they think they’ve sent an ‘exit’ command to close the session, it could get some interesting results.

For post compromise analysis Kippo also provides some an interesting utility, utils/playlog.py. This allows you to replay a malicious terminal session in real-time, typos and all, to truely provide a feel for the malicious users interaction with the session. To help whet your apetite whilst I wait for someone to target my kippo installation, Kippo has a few demo’s of the playlog capabilities from compromise attempts. Get your demos here.

–Andrew Waite

Richard Lane: Understanding Social Networks – a webinar with Jason Brownlee of Dollywagon [SaaHL programme]

Tue, 06 Jul 2010 18:55:00 +0000

Listen to this (unedited) recording of a webinar on ‘Understanding Social Networks’ with guest presenter Jason Brownlee of Dollywagon. This online presentation is hosted by Engleby Associates as part of the Selling at a Higher Level blended sales training programme, and is the second in a series of insightful presentations designed to help sales people be the best they can possibly be.

Jason will guide you through his presentation, allowing you to benefit from his expertise, his theories and his practical understanding of the power of Social Networks.

This webinar is a must for anyone interested in the power of networks and networking and for those who want to maximise the online reach of their business.

Click on the link below to download an unedited recording of the session [Note - at one point during the presentation viewers are encouraged to visit YouTube to watch a series of short videos - we suggest you do this. It will certainly be better than watching a blank screen for a few minutes].

Download the presentation to your computer [duration 1 hour 05 mins, 118mb]. NOTE: Because of the size of the file it will take between 10-12 minutes to download – maybe faster, maybe slower – depending on your connection speed.

Click here to download the Understanding Social Networks webinar

[1 hour 5 minutes duration]

Enjoy and feel free to leave a comment with any feedback or questions.

Random Thoughts of an ASP.Net Code Monkey: Awarded Microsoft Most Valuable Professional Award for 2010

Tue, 06 Jul 2010 12:25:20 +0000

As is the case with most of my blog posting of late, it’s well.. late and in a big queue, but seeing this is relatively time sensitive and the fact that I’m over the moon again. I thought I’d jot a quick post.

Last Thursday (1st July 2010), I was very pleased to receive an email from Microsoft to inform me that I had been awarded the Microsoft Most Valuable Professional Award for 2010 – Internet Information Services (IIS). This is the third consecutive year I have received this and as I’ve mentioned before I am extremely humble to be associated with a great group of technical people around the globe. I’ll be aiming to continue my efforts to help the community and deliver as much content as I can to aid and spread knowledge.

SemiBad: Observations on a month spent kind of holding the future

Mon, 05 Jul 2010 00:56:25 +0000

["I held an iPad in my hands today and it was kind of like holding the future. The future is expensive and has a glass front."]

As far as first impressions go, these (by Gavin Logan on Friday&aposs Geekest Drink) are pretty much on the money. It might seem a little late in the day to be writing up thoughts on a new device — after a month here and several in the States, some would perhaps feel that the topic is a little stale. But as many initial observations of the device seem to be based on shininess or pricetag, I thought it would be a good idea to hold off until I&aposd seen how it works in the real world for a non-trivial period of time.

SuperMondays: SuperSummer, 29th July

Sun, 04 Jul 2010 12:49:20 +0000

To celebrate what has been a great year for SuperMondays, the team behind your favourite lo-fi hi-tech monthly get together have decided to throw a SuperSummer Soiree we are sure you are going to love. It’s a great opportunity for us all to celebrate making this year such a success and to our headline sponsors, Northern Film [...]

Ethicalhack3r: [Interview] The Jester

Sat, 03 Jul 2010 22:35:19 +0000

It’s not often I interview people for the blog however when some one catches my eye and raises my interest I like to find out more about them and share it with my readers. This time I interviewed ‘The Jester’. The Jester has been in the media spotlight recently for taking down Jihadist terrorist web [...]

Ethicalhack3r: Why Johnny Can’t Pentest

Sat, 03 Jul 2010 15:48:40 +0000

A white paper released recently (not dated) by the University of California titled ‘Why Johnny Can’t Pentest: An Analysis of Black-box Web Vulnerability Scanners’ evaluates eleven commercial and open-source black-box web vulnerability scanners. The three authors of the paper (Adoupe, Marco, Vigna) test the black-box scanners against their custom vulnerable web application they called WackoPicko. Their [...]

A Little Bit of Jamie Hurst: PHP Tutorial: Introduction to MySQLi Prepared Queries

Sat, 03 Jul 2010 13:48:45 +0000

PHP MySQL Support

Using MySQL with PHP has traditionally been one of the most flexible and most used combinations of server-side languages and database engines. PHP and MySQL were quickly tied together when PHP caught on, and the relationship has continued ever since. Originally, when PHP was an entirely procedural scripting language, the MySQL functionality was accomplished using the mysql_ set of functions, such as mysql_query() and mysql_fetch_array(), but these have been superseded at least twice thanks to the standard inclusions in newer versions of PHP that make use of it’s newer object-oriented nature, and third-party libraries that try to establish more of an object-relational framework and standardised abstraction layer than was previously available. The bottom line is, you shouldn’t be using the mysql_ family of functions anymore. If you are, get them updated!

The object-oriented MySQL library is called MySQLi (or MySQL improved), and is fully object-oriented. Rather than using a resource link, a database connection is returned as an object which can be queried, and queries return result objects, where results and information can be fetched from. The MySQLi library is much more optimised than the previous incarnation, and is a lot quicker in the more up-to-date versions of PHP. For quick selects, inserts, updates and deletes, the MySQLi library is perfect… but there is one more recent incarnation provided in PHP, attached to the MySQLi library, to make applications requiring large processing a bit quicker, the MySQLi prepared queries.

Prepared Queries

Preparing a query by marking where parameters are going to be inserted allows PHP to optimise the query before it is executed, and grants a bit more speed than just executing the query fully ad-hoc. These are the functions and objects you need to be aware of when preparing and executing prepared queries:

mysqli->prepare($query) – Prepare a query for execution. This takes query with insertion points for parameters marked out with ? characters. The query will be prepared and a mysqli_stmt object will be returned.

mysqli_stmt->bind_param($types, $param1, $param2, …) – Bind parameters to the query. This will insert the parameters at the marked insertion points inside the prepared query statement. The types can be string (s), integer (i) or double (d) (and binary (b) if you want to be technical) and must correspond with the number of parameters the query expects. There is full example of using prepared queries below.

mysqli_stmt->execute() – Execute the prepared query with the given parameters. This will return the result of the query as a true/false boolean, but the results are not fetched in the normal manner if you are performing a select.

mysqli_stmt->bind_result(&$data1, &$data2, …) – Bind the result set to be fetched to a given set of variables. When fetching results from prepared queries, they are fetched into pre-established memory space, meaning no memory space will be wasted in while() loops while getting a set of results.

mysqli_stmt->fetch() – Fetch a row into the bound result variables. Standard MySQL fetching method, but mapping the fields returned from the query into the pre-defined result variables. So, as with execute, this only returns true or false depending on the outcome of the fetch.

Example

The following is a full, but very simple, example of how to use prepared queries for a simple set of data, outputting it using a standard while loop:

// Establish database connection
$db = new mysqli('localhost', 'user', 'password', 'my_db') 
          or die('Could not establish database connection');
 
// Prepare a query
$stmt = $db->prepare('SELECT name, address FROM staff WHERE YEAR(dob) > ? AND YEAR(dob) < = ?');
 
// Set up variables for binding later
$name = $address = '';
 
// Build a loop for the years to output (10-year segments)
for($year = 2000; $year >= 1950; $year -= 10) {
	echo '<p>Years: ' . ($year - 10) . ' - ' . $year . '</p><ul>';
 
	// Bind the parameters
	$stmt->bind_param('ii', $year - 10, $year);
 
	// Execute the query
	$stmt->execute();
 
	//  Bind resulting variables following the execute
	$stmt->bind_result($name, $address);
 
	// Loop through each result
	while($stmt->fetch()) {
		echo '<li>' . $name . '<br />' . $address . '</li>';
	}
 
	echo '</ul>';
}

And that’s how easy it is! Using prepared queries can save memory, and speed up the entire database structure when used effectively. Please bear in mind that this tutorial is supposed to be a very simple introduction to MySQLi prepared queries, and I highly recommend that you use PHP’s excellent website, as long as some other tutorials, to acquaint yourself fully with the process if you feel at all confused.

Other Options

Of course, prepared queries aren’t the be-all and end-all either. There have been some new recent developments in PHP that make database querying even faster. The PDO (PHP Data Objects) interface MySQL adapter supports transactions, a feature of the InnoDB engine, and is further optimised to make use of MySQL’s internal caching and prepared query structure. The PDO MySQL adapter is what is now commonly used with the Zend_Db section of the Zend Framework, and enables quick object-relational mapping features to be coded and utilised.

Doctrine is another option, which is based on the ActiveRecord section of Ruby-on-Rails to support a lot of object-relational features. It allows the creation of models based on MySQL database tables and more!

I ended up building a quick and VERY dirty PHP MySQL library for use at LINGsCARS, called DBlib, because up until recently the main MySQL access method was still using the old mysql_ function set, not a pretty sight. The idea behind DBlib is to standardise the entire LINGsCARS administrative codebase so that caching, error notifications and MySQL support can all be rolled out from one central location without causing an entire rewrite for every new feature. When DBlib isn’t in such a dirty format, I intend to release it free-of-charge to the general public, but that hasn’t been possible yet due to time constraints and involvement with other projects.

Alistair's Blog: My PVR will stop working :-(

Thu, 01 Jul 2010 23:42:54 +0000

Today I learned the annoying and sad news that the Freeview PRV (Personal Video Recorder) will stop working after the 7th July. I have blogged about my PVR before and still love using it today. It is not perfect, but it is not far off. Unfortunately the device is based around the 4TV Electronic Programme guide (EPG) and this service has not stopped.

Inview, the company who have been running the 4IP service stated the following on Digital Spy…

As you know we have had to bring to an end the broadcast of the 4TV 14 day guide.

Unfortunately this has been caused by circumstances beyond our control – simply put the bandwidth contract has run out and we have been unable to secure a new arrangement.

As you know Inview has tried hard over the last few years to keep this service running but it seems that its time has now passed. We do hope you will manage to find a suitable new arrangement.

Just to clarify one point – when the current listing expire on your Thomson/Digifusion devices both will revert to a simple now/next guide.

Best regards, Inview

So if I still want to use my PVR after the 7th I will need to programme it like an old video recorder. I will stick with it for now but suspect I will have to replace the recorder that I have grown fond of. Another loss is that the other EPG services are only for the next 7 or 8 days instead of the 14 days that I have found most useful. I might opt for a PVR that is more customisable or that supports HD, but that is a decision for another day.

[my][home][toon]: Getting Redis and CodeIgniter to play together

Thu, 01 Jul 2010 20:39:30 +0000

I’ve wanting to play with Redis, a super speedy key-value pair store, for a while, but there wasn’t readily available way for me to bolt it into my PHP framework of choice CodeIgniter. There was however a good PHP client for Redis in the form of Rediska through, so I decided it was time to roll my own library.

Assuming you’ve installed Redis (on Ubuntu for me it was as simple as “apt-get install redis-server”, follow these steps to get Redis and CI working via Rediska.

Download Rediska and copy the content of the library directory to your system/application/library
With your favorite text editor replace all of the “require_once” includes in each of the Rediska files so that the path uses CodeIgniter’s path variables, for example “require_once APPPATH.’libraries/Rediska/Exception.php’;” TextMate let me do this with a cunning regex
Drop the following code into a library file in system/applications/libraries called Rediska_connector.php. I hand rolled this, so it’s probably “sub-optimal”.

<?php

class Rediska_connector {

public $rediska;

function __construct()

{

$options = array(

'namespace' => 'Application_',

'servers' => array(

array('host' => '127.0.0.1', 'port' => 6379)

)

);

include(APPPATH.'libraries/Rediska.php');

include(APPPATH.'libraries/Rediska/Key.php');

$rediska = new Rediska($options);

}

Include this connector library in your controller with $this->load->library(‘rediska_connector’);

Access Redis as follows in your controller…



$key="username";

$value="password";$store = new Rediska_Key($key);

$store->setValue($value);

// and not to get it back again
$key = "username";
$store = new Rediska_Key($key);
$retrieved = $store->getValue();

If you need to investigate whats going on there’s no equivalent to a GUI mysql client of phpMyAdmin, so if you want to work out whats going on in your store, you’re going to need the command line. I’d recommend reading Simon Willison’s slide deck.

Possibly Related Posts:

SuperMondays: SuperFreelancers…a review

Thu, 01 Jul 2010 16:43:21 +0000

This month we were back in the Culture Lab at Newcastle University. The event was really well atended by over 120 people and we had four excellent speakers, including: Paul Easton Laura Maddison Rob Lavender Lee Simpson We are very grateful to the Culture Lab, Newcastle University and our platinum Sponsors Sunderland Software City and Northern Film & [...]

Tmacuk.co.uk: upSploit – Press Release

Thu, 01 Jul 2010 09:00:28 +0000

What is upSploit? upSploit is a free service to the IT security industry to enable vulnerability and exploit advisories to be distributed between the founder, vendor and other security professionals easily. This Vulnerability Advisory Gateway (VAG) should break down the barriers for security researchers and professionals to pass details of vulnerabilities to vendors in a structured [...]