reCAPTCHA

After code reviewing some large number of files, I took a slight detour over to BoingBoing to an article on an alternative CAPTCHA mechanism. Instead of using a normal CAPTCHA system, typing in known words that have been graphically altered so that a computer couldn’t interpret it, you type in unknown words gathered via OCR that no computer has interpreted, but that the reCAPTCHA system has a pretty high liklihood index on knowing what at least one of them is. You type in two words. You get the “known” one right, and you get in, and your submission for the other word is kept to help determine what the other word is. It’s a pretty interesting idea. Plus, they’re using it to help digitize documents in the public domain that have been scanned, but that OCR has been hard pressed to convert them–a good cause.

In my playing around with the example on the site, I noticed some oddities:

• You can fudge at least one of the words. There was an instance of “1980” and another word. I guessed that the other word was the “known” word, typed that in verbatim, and passed in “1988” instead. The reCAPTCHA system said I was in like Flynn.
• You are likely to get partial or multiple words instead. Since it’s OCR that’s already known to not interpret it correctly, it may not even get the correct word break and when you are instructed to enter “two words,” you may have to enter in three or four words, or partial words.
• Sometimes there are odd symbols in the older texts. There was a word that had an ‘æ’ in it. I dutifully asked the International menu to show me my Keyboard Viewer (since I never remember the Option-key combination for those diareses), found the character, and submitted the word exactly as written. It called me correct, but I wager that normal people won’t bother to use those high-falutin’, old-fangled characters, and just type “ae”. It might be close enough, but is it right?
• Use of alternative symbols might get you an error. There was a word that clearly had a right-side closing single quote character used as a possesive or a contraction. However, I dutifully entered in the curley-quote version and was rebuffed! I guess the straight quotes is what they wanted.
• Older texts have spelling mistakes or perhaps older or alternative spellings. I wonder how many people are going to bother making sure they type that extra ‘t’ that doesn’t belong; will it be enough for the verification code to preserve the original text’s spelling?
• Some of those OCR documents are hard to read as it is, and blurring it makes it harder. There were several times where I had to refresh the reCAPTCHA many times in a row because it was just impossible to read. I wonder what their mechanism is when many, many people have avoided making a claim, or made irreconcilable claims as to what that word is. Does some poor shmuck have to go back and look at it manually? Or do they start limiting the blurring? Hmm…

All in all, though, it still seemed like it provided a very reasonable security while providing a nifty public service.

Standard User (UAC) + Network Home Folder = #)$(*@%

I am in month seven of using Vista, having installed Beta 1 on my sole Windows development box as a part of being a Good Dogfooder™.¹ As a self-styled security afficionado, I elected to have my regular domain account be a Standard User account, using a local machine account as the administrator account. Now, when I want to do anything that requires administrator access, I’m prompted with a request for credentials.

When I first saw these, I felt comforted. I was used to seeing the same on my Mac OS X boxes when an application was requesting admin or root privileges. However, the sheer number of times that I needed to actually acquire administrative access to my machine surprised me. I would often think, “Does this thing really need administrative privileges to work?” In a lot of cases, the answer was, “Yes,” but in some, it seems that some more work could be done to either allow an application to install/run with user privileges (e.g., browser plugins) or to isolate preference options according to whether they need the dreaded “elevation”². Ultimately, though, that work can be done, and application developers and IT folks have some Microsoft-provided tools that can help them make their applications/plugins/whatever behave well in this environment.

Later, I would increase my Good Dogfooder™ karma (or reduce it, depending on whether you subscribe to the only-negative-karma idea) by enrolling in a pilot program to try out redirecting user folders to a network share. It pretty much works as advertised. Everything that would be in C:\Users\nathanh.000 gets redirected to a network volume that my domain account has read/write access to. It takes a bit of time to log in, but no matter where I log in, I have the same information. Similarly, there a few applications and products that don’t handle this gracefully... applications that like to install shortcuts on the Desktop, for instance, are annoying unless they’re installed somewhere on my user directory (which is rarely, if ever) or installed in the same location on every machine I log in to. Again, I can report back my woes and, at least with Microsoft-written applications, have a shot at having them work better in that environment.

Alas, as is usually the case with living on the bleeding edge, there’s the blood. Dogfooding at Microsoft is de rigeur, and there will always be some annoyances, though the product teams do a lot to keep them to a minimum. My problem is the confluence of elevation in the presence of the network home folder.

Let’s review: My domain account is my main account, and is a standard user, not an administrator. My administrative account is a local machine account, and has no domain privileges at all. My home directory is a mounted network drive where my domain account has privileges, but not my local machine administrative account. Do you see what’s coming?

Situation #1: Installing from a network share.

I can browse to some UNC path from my domain account, and click on an installer. The installer, UAC-aware as it is, puts up the elevation dialog, since it has to install into some machine-wide areas. I enter in my local administrator account and password. Voilà, the installer now runs as if it is the local administrator account, and instantly no longer has access to the network share, since my local administrator account doesn’t have privileges. Fortunately, this is usually only an annoyance, as most of the time, I am presented with a dialog complaining that the installer doesn’t have access to the share, and could I please enter in credentials of someone who does. I find it odd that I have to enter in my own credentials when I’m already logged in as myself.

Situation #2: Installing into the home directory

In the case where an installer needs to install into some machine-wide area as well as the home directory, I’m more stuck. I have to elevate to run the installer, but as soon as I do that, the installer loses access to the home directory. For some reason, in that case, it doesn’t present the network-access dialog, and things just fail to work.

In one such case, a program installed most of its items, but then failed to create a startup shortcut for me. “No matter,” I thought, “I’ll just copy it over myself.” I noticed that the shortcut I needed was already in my Start menu, so I browsed to it and copied it. I then browsed to the All Users startup items folder and tried to paste it as a shortcut. I then get the following dialog:

Windows cannot create a shortcut here. Do you want a shortcut to be placed on the Desktop instead? [Yes] [No]

“Hunh,” I think, and choose, “Yes.” Personally, I thought it should have just brought up an elevation dialog and let me paste the shortcut, but no matter. There is more than one way to do it. So, I then try to drag the shortcut nicely pasted onto the Desktop to the All Users Startup Items folder. Happily, I get the elevation notice. I think, “Great! Now I’ll have access to put this item here.” But I had not thought it through, for while I gained access to put the shortcut there, I simultaneously lost access to its source. Thus, after another elevation dialog (I don’t think that one should be necessary), I get the following dialog:

You don't have permission to copy files to this location over the network. You can copy files to the Documents folder and then move them to this location.

I take issue with this dialog on two accounts. (1) I have permission to copy files to this location; I just got it. I just lost permission to copy files from the source location. “to” is a little unclear. (2) Copying files to the Documents folder is not going to help me, since my Documents folder is also on the network share location that my Desktop is.

The sad part is I could have elevated, and copied the shortcut directly, without ever having to place a copy on my network home directory. But I wasn’t thinking through the ramifications.

Unfortunately, neither will our users. Furthermore, they’re not going to understand why these things don’t work “right” or “just work.”

I am not part of the UAC team and have definitely not considered all the ramifications of the implementation of extreme credential isolation, but I am certainly enjoying the authorization mechanism on Mac OS X which allows me as my current user (with all the access that implies) to do specific other tasks requiring a higher authorization level by supplying administrative credentials, and still have access to the secured resources my user should have access to.

I expect the UAC edges will get smoothed out, as will network home folder redirection... I mean, hey, why else do we do this dogfooding anyway?
--
¹Actually, it was at that point that all Microsoft employees were exhorted to all use Vista as our desktops–even though no official effort had been made to ensure that our group’s build environment and tools would still work–so that we would make sure the experience would be good for our customers. Our woes were noted, and some were addressed in time for Vista and associated tools to be released to manufacturing, so our pain was not in vain.
²Originally, I thought “elevation” was just a synonym for authorization. Alas, it is not. When you “elevate,” you (or rather your process) becomes owned by another user with more privileges than you. That user may also have fewer privileges than you in other realms. This can be a problem.

Collections

Take thrice the daily intake of caffeine, a frustrating problem at work that needs some back-burner cogitation, and a recent revisiting of eBay, and that’s all that’s needed for a seriously long stint of late night web browsing for the purposes of collecting.

I would expect there’s a coincidence of collectors among people who write code, largely because I believe that both are ventures that jibe well with people who are “detail-oriented,” which is my polite way of saying obsessive-compulsive. In my case, I’ve gone through several iterations of collecting, starting with an aborted attempt at stamp collecting back when I was maybe 10. To some extent, it seemed to me that collecting was just a specific form of being a careful pack rat–you take care of your belongings to help them to last, even if you don’t need them at the moment, just because someday you might–a last vestige of handed-down Depression-Era values.

I switched over to collecting coins, but not expensive ones… just some interesting U.S. coins I had come across. One of my favorite finds was a glass jar of pennies that my father had saved when he was a kid. I was so excited to find some “seriously” older coins (e.g., from the ‘50s rather than the ‘70s or ‘80s).

I have since taken to dumping my pocket change into jars: one empty Glenfiddich metal canister for the quarters, aka laundry money, and one empty plastic jug that formerly contained olive oil for all the rest. Maybe someday my kids might find it as exciting, if these containers survive that long. The first attempt at this involved storage in an empty poster tube, and during the Nisqually quake, the tube herniated and broke; my wife (then girlfriend) decided to “clean up the mess” by taking all the coins to Coinstar! Coinstar of all things! Not only did I not even get to see six years worth of savings churn through the machine, but I get to pay 8.9% for the privilege! AIEE!

Ultimately, I didn’t do much in the way of collecting coins as a kid. I just kept a few dollar coins and some examples from various years. Another short-lived collection was that of Star Wars trading cards (even as a kid I eschewed sports-related things); I don’t even think that lasted through a full summer before I traded them away for something else.

In college, though, I started collecting for real. I fell victim to this newfangled idea–a card game where you collect the cards. This was, of course, Magic, the Gathering™, around the Alpha/Beta transition, and before I had even heard of the CCG acronym. My college roommate, Naval, would purchase boxes of card, sell the packs, and then trade with the people as they opened their packs. Well before Kyle MacDonald hit the trading scene, Naval turned one island into a Shivan Dragon. I did my own purchasing and trading. Even now, I have a Fleer binder of nifty cards and a white box of extra cards in my office, for lack of a better place for them. My friend Brian, who has alternative names for most everything, refers to Magic as cardboard crack. I’m pretty sure I was addicted or close to it while in college; any extra money I had from my computing jobs on campus would go into it. Later, I’d try out Jyhad and Middle-earth, and to a lesser extent Dr. Who, Star Wars, Star Trek, and BloodWars, before I ultimately swore off investing in any new CCG.

After college and after collectible card games, I got found myself back into coins by what I would have considered to be an unlikely source for me buying anything, Shop At Home TV. I usually just tell my TV to omit those shopping channels when setting it up for the first time, so I’m not sure exactly how it was that I came to be staying up, late at night, watching the Coin Vault. Somehow I got drawn to buying a whole slew of silver coins (mostly brilliant uncirculated), and only later discovered that there was a hefty markup. Nonetheless, it piqued my interest again, if only mildly, for numismatics. I certainly enjoy getting each year’s silver eagles for depositing into my Dansco album.

In addition, my prediliction for Zeppelin¹ paraphenalia, which is a collection² in its own right, bled into coins with regard to the 1930 three- and five-reichsmark coins, which feature the dirigible and laud its 21-day circumnavigation of the world in 1929. I have to say, it’s pretty difficult to find those coins on this side of the water. With some rusty college German, I can partially navigate some internet sites and eBay sales. Ron, of germancoins.com, has been a good resource, both in terms of coins and how to bridge the gap between US gradings and German gradings. One of my early morning tasks today is to perform my first international wire transfer, to pay for a recent winning auction bid for such a coin.

It still seems a little crazy to be trying to guess whether or not an online vendor is trying to gouge you (and by how much) without a price reference guide, or even without necessarily many vendors selling the same items. It makes for some hefty search sessions (and my browser tabs increase to the point where you can only see the first three letters of the title of the page), and even then, it still sort of feels like jumping off the deep end, especially in the realm of coins, where you’re trying to double-check the quality grading by inspecting a grainy submitted picture, that isn’t particularly zoomed in. Nonetheless, I’m trying it out, and we’ll see how well it all turns out.

--
¹ The airships, not the band.
² I had always been a fan of airships, as long as I can remember. But it was only during the collecting of some material for a game of Nobilis–entitled Means and Ends, it had a chancel which was a modified version of Seattle Center circa 1962 during the World’s Fair–that I branched out from Life magazine copies and into Zeppelin books. Of course, the geekery doesn’t stop there; I’m also a member of the Lighter-than-air society, and I regularly wear a Save Hangar One t-shirt in the hopes they don’t dismantle Moffett Field’s historic hangar.

iPhone envy

Well, I was wrong. My friend Jon asked me what was going to be offered up this morning, and I said, “Whatever it is, it isn’t going to be an iPhone.” This because Cisco owns the trademark to it… In the back of my head, I was really hoping for a phone/iPod combo, not just because it would be cool, but because my i-Mate SP3i Smartphone is starting to drive me crazy, and I am looking for a replacment.

This isn’t to say that the SP3i wasn’t nifty at one time. When I was willing to spring for the $20 extra a month it cost for insanely slow wireless internet service, it synchronized nicely with my Exchange account at work, which was pretty much the only way I ever used its connection. Trying to do anything other than load an extremely simple page (usually one written to be displayed on a Palm) (1) took forever and (2) required scrolling all over tarnation with the dinky joystick of intermittent operation. Said joystick came out of the phone multiple times, and could never quite be put back in correctly, and right now I’m operating with the plastic stub instead. Still, the difference between me knowing I had a meeting to get to and/or to look up where it was or what someone’s number is in my 400+ contact address book was huge.

On a parallel note, the implementation of as-needed-synchronization in Windows Mobile™ 2003 Second Edition’s Pocket Outlook depends not on the ultra-slow network that I paid $20 a month for at all. Instead, the Exchange server sends invisible SMS messages (ones that don’t show up in your text message section) that get interpreted by Pocket Outlook to let it know there’s something new to synchronize. I didn’t have a text plan when I first got my smartphone, and after two months of $150 charges in text messages that I had no idea where they were coming from, I finally switched to mode of synching to just every 30 minutes. My comrades in Windows Mobile ultimately changed the behavior of this in a later edition of Windows Mobile™, which is great, but unfortunately, they weren’t willing to upgrade my phone (they were OK upgrading the SP3, but the SP3i was just too… something… (new? freaky?) And as far as I can tell, the manufacturer won’t upgrade it, presumably because it was already an older model.

As time went by, I gave up on the Internet connection, trying to settle on desktop-synchronization. Unfortunately, it was about this time that I played Good Microsoft Employee™, and dogfooded beta candidates of Vista, for which there was no ActiveSync. Now that Vista has released to manufacturing, there’s now an ActiveSync, but it doesn’t sync contacts or events anymore. “The synch status is on the device.”, only it’s not. Add all of this to the device no longer responding to right button clicks, and taking on the order of 5 to 20 seconds to respond to left button clicks when it hasn’t been used in a while (is it paging things in?), I’m starting to take a hard look at new cell phones.

One of the most annoying things about bar phones, IMNSHO, is the requirement of locking them. Yes, I know it’s not a strict requirement, but I put the things in my pocket and then they auto-dial someone in my contact list. I’m still waiting for an accidental call to 911 to happen. Strange things happen when it is locked though. If I get a reminder, sometimes I cannot dismiss it because it wants you to unlock it first, but the reminder is on top, so you don’t get the unlock UI. There might be some kind of lock timer I could use, but that doesn’t preclude me pocket dialing people, and I don’t always remember to lock it. I was thinking I would have to go to some kind of flip or clamshell phone to avoid that nuisance. I spent some time over the holidays looking for a relatively cheap phone (since I’d have to buy it as an “upgrade” through T-Mobile or get a compatible unlocked phone, as I already have a contract), but hadn’t come up with anything.

And then Steve Jobs shows off the new iPhone.

Something tells me the Exchange support might not be all that great. As it stands, Mail.app has never once been able to synch with the Microsoft Corporate Exchange servers. (In the past, that’s meant that I’ve been even more tied to Entourage and/or Outlook, and had a vested interest in fixing/reporting bugs in those products.) I somehow doubt that the iPhone is going to do better than Mail.app. But still the idea is alluring. The iPod I got as a ship gift for shipping Microsoft Office 2004 ended up going to my wife who lives for her podcasts, and her old iPod had ended up with battery issues. (NB: She recently got it re-batteried and now I have an ancient iPod that I really should load up with some tunes.) Having a newer model iPod that can show video and call folks and can fit in my pocket sounds great. And maybe I can even leverage Entourage’s Sync Services integration to get my info onto the phone…

I guess I’ll keep an eye on it, and if/when it comes out, figure out whether it’ll be worth switching to Cingular or whether it could be purchased unlocked for use with T-Mobile. Until then, I’ll live with my ailing smartphone.

P.S., What would be really cool, would be if it had a slot for not just a SIM card to enable the device, but extra SIM cards to serve as generic smart cards. Then you could use it as your physical token for authentication on machines. Can you imagine walking up to your machine and have it auto-negotiate credential sharing, and have a keychain show up on your box?

Intel inside / Herring v2

Time seems to get away from me when diving into new work. It’s been a few months since my last speculative post, and since then, as I’m sure you’ve noticed, the Core 2 Duos are now in the MacBook Pros. I bought mine the day it came out. But like the rest of my old machines, it wasn’t so easy to part with my old Titanium. First, it was a matter of not having brought everything over (like some applications who keep data in strange places and as such didn’t get copied over when I copied my home directory and data drive), and secondly, for the first time in a long time, I had some PowerPC-only work on my plate!

Digging out the old 601 manual and peering through its pages, I realized that I missed dabbling in assembly. I say dabbling because I know just enough to be dangerous, and not enough to wring the performance you’d want from, say, an optimizing compiler. Fortunately, all I had to do was play with stack frames and arguments placement. Mmm… Nothing like screwing that up and getting a completely broken stack trace at the point of a problem. Well, anyhow, as it turns out, whereas it’s possible to use my new shiny MacBook Pro to do this work, it’s quite difficult to debug in Rosetta, and Rosetta seems to not be too happy about programs generating their own code (it quickly runs out of memory—perhaps it doesn’t know where the data ends and the generated code begins?). Thus, my old PowerBook was going to have its one last hurrah over Christmas, so I could work during downtime while visiting family.

I greatly overrated the downtime, which ultimately didn’t matter, as for some reason gdb on my PowerBook wouldn’t load the symbols of the code I was debugging, so it was even more difficult than it was going to be back at work. I gave up on working over Christmas and focussed it on my and Miller’s family.

As an aside, it seems that around my birthday, Miller and I “spawned a new process”. I don’t think it’s Intel inside there, but according to the doctor, it’s set to release in late July ‘07. Both of our families are quite pleased.

Now that the last vestiges of a reason to keep the old workhorse is gone, I finally used the photos I snapped of it several weeks ago, and put it up on eBay. <shameless_plug>If you’re looking for an old MacBU warhorse, replete with a Moby sticker, bid away.</shameless_plug>

Machine speculation, redux

A couple of recent articles about Intel's new quad-core Core 2 offering coming early (in late 2006 rather than early 2007) from SFGate and the Washington Post reminded me that I didn't really act upon my previous machine speculation.

I had posited there was an outside chance that they'd update the laptop line for WWDC '06. It was much more likely that they'd release an Intel desktop, and they did. (I had given it a release date of December +/- 6 months, so it definitely came in on the early side.) Nonetheless, I was (and am) holding out for the low energy versions to get put into the machines for better battery life (and less cooking of the lap), and hoping that they'd be able to cram in a second two-core processor in. Well, with the announcement that availability of quad-core chips this year, with low energy versions "early next year", I might get (effectively) both. Unfortunately, since there's usually some lag time between chip availability and adoption, I may end up waiting another nine months until they could get put in the MacBook line. Ultimately, this comes down to when Apple updates the line and what they're going to do with it. I've got my fingers crossed.

Not just licking my wounds

I should have known better. I'm not particularly thin-skinned, but every time I end up going to an Apple conference, instead of being able to purely enjoy the new technology (and at WWDC, the camaraderie of other Mac developers), I find myself plucking daggers out of my (well, Microsoft's) back.

Yes, I know that the Reality Distortion Field is going to promise great things on the platform. But, having never been to a PDC or TechEd, do the Windows conferences heap the same load of scorn on alternative OSes (and by inference, developers on and for that OS)? I'm sure there are cross-platform developers who are just itching for the new technology who think, "Yeah, yeah, now tell us what's cool about your stuff!" There are probably such Mac stalwarts that don't care a whit about what Microsoft is doing or would rather not hear the name mentioned in their presence, and referring to "Redmond"¹ repeatedly is just as bad.²

In any case, having been to WWDC 2003, and having had access to other MacBU folks' DVDs for '04 and live streaming for '05, I didn't get as much out of it as one of my new coworkers, who was roughly introduced to the society surrounding the technology. Instead, I enjoyed talking to several Apple developers working on the technology areas of my interest (mostly security-related), and put bugs in their ear about future directions. Secondly, I did not just throw away all those Microsoft daggers–omitting the ones that were purely spiteful, there were still several that complained of real problems in MacBU products that I was able to give feedback to the team about, not all of which were known issues.

The reason I've been quiet recently is not that I'm licking my wounds from WWDC, but that I'm diving headfirst into a bunch of new-to-me technology. Although my coworkers have some good insight about what sections of the technology have analogs to what I had been doing previously, it is still a little like drinking from a firehose. I hope to spend the next few months coming up to speed, and then when the product specs settle down and we can go public about it all, have some more technical blog entries about what I'm actually doing here in CoreCLR.
--
¹ A quick search of software companies in Redmond, Washington turns up quite a number of results. Perhaps they're repeatedly referring to WildTangent? No? Maybe Hipsoft? Crick Software? Something tells me they're just afraid of mentioning Microsoft, in case it increases Microsoft brand recognition to their own detriment.
² I've often wondered what purpose it serves to mock Windows at these conferences. I don't think it's going to dissuade Windows developers from developing for Windows OSes. Is it dissuading current Mac developers from leaving the platform? Or is it just patting them on the back for having made "the right choice" of OSes? Hmm.