Some of my sites were hit by this recent Fast-fluxing SQL injection attack. Ugh. What a pain. I'm not sure it was through any of the older sites that I maintain or one of the newer sites I actively run. Searching my huge log files will be no fun.

I caught this the other day because I noticed that some of my sites had gone down with some strange cast errors. The cause turned out to be some foreign string data injected by a malicious remote attack in some of the configuration rows of my database. All through my db, various tables were comprised by a string appended to existing string data with variations on the theme "<script src=http://www.banner82.com/...>".

I cleaned up my data by doing the following:

1. Created a Search and SearchAndReplace stored procedure in my database
2. Searched for all variations on <script.... that were the result of the injection attack
3. Replaced all the found instances with nothing.

I think for the next few days I will run a few sanity queries just to make sure the attack isn't still ongoing while I look to cleanup the offending input.







technorati: fast-flux, virus, banner82, sql injection

Created 193 weeks, 1 day ago

I went to the Google App Engine hack-a-thon on Friday in San Francisco. I arrived around 10:30 AM and stayed until 8:30 PM or so. The following is a list of some of my initial thoughts on Google App Engine. Keep in mind that I am still coming up to speed in Python, and that I come most recently from a .net background.

---

1. The datastore is dead simple. I wonder about performance because of this though. I still have some confusion over the user object in the DB and how it receives changes when they are made upstream.
   
2. The developer documentation isn't as nearly as complete at it should be for actual open development. It seems to me that even python isn't as well documented as it should be and now that Google has added another layer to simplify things they need to do a good job of documenting error strings and some additional examples of code-usage. I am of course basing all of this on my experience and like of MSDN docs.
3. The hack-a-thon itself was quiet and the food was great, however the all-day presentation was hard to follow and the announcements and public itinerary didn't seem to match what actually went down. The staff had prepared a sample application to go through in order to explore the different parts of a web application and started the presentation early in the morning. I would say about half of the room arrived after I did and I don't recall anyone recapping what the itinerary was or what was going on until lunch-time. Also, I wish the staff would have broken the tables out into function and had each table work on some code together. With shared Google-docs and some file-system mapping, we could have been collaborating on something together.
4. I didn't arrive with a very good idea of what Google Application Engine was. I don't think that the presentation covered any of the basics, purpose of Google App Engine. However, after about 2 hours of intent analysis, I GOT it. And I must say that I am a bit excited by it. I really like the authentication scheme.
5. It was explained over and over that GAE only supports only pure Python modules. It would be nice to see a list of these published somewhere. Maybe I will look into that. Also, pulling these down has to be a manual process I think. No easy_install for that in a GAE project.
6. I did manage to catch and comprehend the quick walkthrough of using GAE with PyDev and now that is my preferred way of working with GAE and Python. Debugging is great. However, does anyone know how to trace to console with PyDev/Eclipse and GAE?
   

---

Thats about all I can think of for now. I hope to publish the application I worked on during the Hack-a-thon sometime early this week. Look out for the announcement and code soon


technorati: Google, GAE, Google Application Engine

Created 193 weeks, 4 days ago

About 2/3 of the clocks in our house are 'set' automagically by the WWVB time clock radio. Both (all) of our alarms use this feature. If someone were to jam or override the time signal locally in SF I wonder how many people would be late to work the next day? How many other services uses these types of clocks because of their convenience?

I think a better solution is a closed and protected system that uses NTP and then rebroadcasts it through the house across our 802.11g wireless network. Our clocks could just pick it up from there and I could protected it somewhat.




technorati: WWVB, Atomc clock, Radio, NTP, network

Created 202 weeks, 1 day ago

Today marks 21 days of dieting.

Week 1 archived results
(lost 6 pounds)

Week 2 archived results
(lost 5 pounds)


Week 3 calorie intake and results

---

Wed (31st)
1156

Thu (1st)
2615

Fri (2nd)
2020

Sat (3rd)
670

Sun (4th)
1085

Mon (5th)
1400

Tue (6th)
1265


It was my birthday on Friday, and on Thursday my company threw a holiday party at the Exploratorium so I had two back to back indulgent days. I was able to ride the calorie rush and had a really good energy day on Saturday with just 600 calories.

I lost only 3 pounds this week, for a total of 14 pounds lost over 21 days. I know my body fat index dropped by about 3% points over the week though, which hopefully means my fat weight was replaced by muscle weight gain.

My cardio and weight lifting continues however I would like to incorporate some swimming over the next week. I found a new gym that has a pool but it is expensive. There is a public pool north and south of me but they cost about 5 dollars a day to swim.

technorati: weight loss, dieting, diet, exercise



Created 221 weeks, 2 days ago

Got it! It arrived fashionably late, in a small box. Yet inside, was an awesome device. I took pictures of the unboxing and will put them online later tonight but first I have to get ready for my company party.

Two initial thoughts. First this chumby feels solid and the screen is lovely. Bright, colorful and easy to view. Second, it didn't find my network first try (I had read WEP was going to be a problem). Now I have to adjust my network to get another authentication method working.

Here is a teaser shot.




technorati: chumby, unbox, latte

Created 222 weeks, 1 day ago

I have 14 days of dieting under my belt now (ba-dum).

Week 1 archived results
(lost 6 pounds)



Week 2 calorie intake and results

---

Wed (24th)
920

Thu (25th)
1095

Fri (26th)
2005

Sat (27th)
1400

Sun (28th)
1445

Mon (29th)
1115

Tue (30th)
952


Overall, a good starvation week :/. That Friday I took on added calories from beers at a Halloween party, but I am okay with that.

I lost a total of 5 pounds this week, for a total of 11 pounds lost in 2 weeks. So what does 11 pounds equate to? Well if I have lost pure fat, than it would look something like 44 sticks of butter smeared all over me (imagine it).

I have been exercising more than normal as well. I have ramped up to about 1 hour of intense aerobics and weight lifting every day. I even rode my bicycle to work one day. I am feeling stronger and leaner that is for certain, but waking up in the morning is harder and harder (sore and tired). Once I get going at 7:30 AM, I seem to recover my stamina by 10 AM.

technorati: weight loss, dieting, diet, exercise



Created 222 weeks, 2 days ago

Nah.. this really makes me smile.

Usually the expiration screens for trial software are so marketing oriented. That is if they don't just close themselves and launch a web browser to their e-commerce cart with the product already locked and loaded waiting for you to click the "Buy now as fast as you can" button.

Virtual CD (it is Das Original if you didn't know) has a nice, polite message on the expiration popup.



I bet if wrote them to let them know that their software presumed wrong and that I actually only got to use it for about 5 days they would give me another 25 days to try it out. That's how nice this little message seems. I actually would have liked to try it out longer, I just wasn't home enough during the last 30 days to really get a full feeling of trial out of it.

Since I am on the subject of Virtual CD, if you need the most nifty software since .... forever, do check them out. The software creates a virtual cd / dvd reader and a virtual cd / dvd burner in your PC system.

What does this mean for you? For me it means all those CD's I was making from iTunes purchases can now be done virtually. I don't have to waste any more physical CD's or CD-Rs or even open my burner any longer. This is good software done right.


technorati: Virtual CD, DVD Burner, Virtual

Created 272 weeks, 1 day ago

Update: December 2006, the router has died. I think due to heat issues caused by the new radio power level - Caveat emptor.


I have been having some connectivity issues in this older, solid walled house I am renting. The xbox in the living room won't stream videos from the web without lots of hiccups and buffer setting changes. This wasn't a problem in my new house in Texas so it looks like I will need a more powerful router.

But, in an attempt to keep what hardware I have, I set out to see what kind of optimizations I could make without having to purchase anything new. I have had a few links in my del.icio.us roll that I kept meaning to act on but I needed a free weekend to try them out. This was the day.

Based on this article by Lifehacker, I set out to upgrade it with new third-party firmware. The dd-WRT was the recommended firmware to use, so I followed the suggestion. This post on the dd-WRT wiki was the walkthrough I used to install the firmware. For more options, this forum post (thanks to sblue on the lifehacker comments) has a large selection of firmwares to use as well. They seem to vary by design and function (Telnet, site survey ability, etc).

The upgrade went as expected, the only thing different I did was use the dd-wrt.v23_mini_wrt54g.bin version of the mini firmware and dd-wrt.v23_wrt54g.bin version of the primary firmware. I figured the tutorial was based on a newer version of router and I could rely on the model-specific version. I was right, it worked like a charm.

The first thing after loading new firmware was "boost" my wireless power. I am running my Xmit at 50 mW (up from the default 28mW) and I immediately noticed the difference. My xbox would now buffer and play an entire movie from Google Video or GameTrailers.com.

Also, this effectivly extended the range of my network out to my backyard and across the street at the Cafe. The dd-WRT software came with a hotspot setting and it looks like I might want to configure it to allow people to use my network during certain hours while I am at work. A way of giving back to all the slackers and dot.com millionares who don't have to work during the day.

Created 291 weeks, 5 days ago