Solutions for my unique needs
From Navision.com:
Use Microsoft Solution Finder to search for solutions developed by Microsoft Certified Partners to meet the unique needs of your business or industry.
Well, if my need is unique, it does not seem likely than anyone has developed a solution, does it?
I love marketingspeach.
the vulnerabilities that might be exploited by the threats
In BS7799-2:2002 4.2.1.d.3 I read the following:
d) Identify the risks
- Identify the assets [...]
- Identify the threats to those assets.
- Identify the vulnerabilities that might be exploited by the threats.
The standards document does define a few terms, but not threat
, vulnerability
and exploited
.
Now, my computer is an asset that is threatened by interruptions in electric power supply.
But it does not make sense to say that the power supply exploited a storm
to stop my PC?
Is BS 7799-2:2002 written on the assumption that all risk is caused by deliberate attacks?
Looking at Security in Computing by Charles P Pfleeger, ISBN 0-13-799016-2 section 1.2:
[...] an exposure is a form of possible loss or harm [...] A vulnerability is a weakness in the security system that might be exploited to cause loss or harm. A human who exploits a vulnerability perpetrates an attack on the system. Threats [...] are circumstances that have the potential to cause loss or harm; human attacks are examples of threats, as are natural disasters [and] human errors[...] a control [BS 7799-2:2002 3.11 risk treatment] is a protective measure
By BS and Pfleeger definitions, my power line is vulnerable to sabotage, but not to storm damage.
Hardly a useful definition. I can't say that the storm is a threat that exploits the vulnerability of the power line.
I need a new word. the storm is a threat that xxxes the vulnerability of the power line
.
Any suggestions?
I want to remove exploit
from the definition:
- vulnerability
- a weakness in the security system that might cause loss or harm
tags: BS 7799-2:2002 threat exploit vulnerability security ISMS Information Security Management System security ISBN 0-13-799016-2
sitemaps.org
Sitemaps.org - very much less than RDF
It does e.g. not seem possible to state that two URL's return the same resource? That is how I read the FAQ, anyway?
Several different loc elements in one url element should be the obvious way to do that. Then again, if you were thinking like me, you would use other element names, I'd say that one page element should contain one or more url elements.
Much less is this protocol able to say that the different sizes of the same image is indeed the same image.
tags: RDF sitemaps.org metadata
AKG Hearo player SE
My comment to on the Hearo Player SE:
OK. But I really don't want a PC dangling from my earphones. What about a version that can convert .wav or .mp3 files to headphone friendly format, for playback elsewhere?
![]()
tags: AKG Hearo binaural headphones earphones dolby headphones surround headphones virtual speakers
CMS language management
Sansir.net sprogstyring describes that they can manage different content for different languages. To me, that sounds like isolated sites for each language, rather than 'management'.
If you don't read Danish, clicking the Union Jack will illustrate my point. You will not be taken to an English description of their language management, you will be taken to the home page of the English site.
To me sprogstyring
(language management) implies that pages with the same content in different languages
are linked to each other.
tags: Sansir sansir.net CMS content management system internationalization content negotiation language negotiation language management sprogstyring málstýring
Sender ID Ineffective Against Spam ?
Research Determines Sender ID Ineffective Against Spam
They determined that e-mail coming from an IP valid for the sender address may well be spam. Of course it may - the SPF record is only useful in connection with a white list of addresses or domains. But once white lists can be trusted, we can apply stricter filtering on email from non-verified addresses.
They further complain that validating the sending IP yields 8.6% false positives. Maybe so. But these false positives are mainly from large organisations - they are the ones who send mail from an IP different from the one listed in their MX record. Once a significant number of receipients require IP validation, the senders will get their SPF records in place within hours.
tags: SPF record SPF Sender Policy Framework spam anti-spam IP validation Sender ID OnlyMyEmail
RDF and http: URIs
I just had a look at the RDFa Primer 1.0 working draft.
I generally appreciate this plan for embedding RDF data in XHTML. But I still have a problem with RDF's use of http URIs to identify non-digital resources.
E.g.
<p class="contactinfo" about="http://example.org/staff/jo">
to indicate that this is contact information for the person described at
http://example.org/staff/jo.
The URL http://example.org/staff/jo retrieves a digital web page,
not a living person. Thus, the URI http://example.org/staff/jo
identifies that web page. Not the person.
Using http://example.org/staff/jo to identify the person, is at best ambiguous.
(Common sense may tell us that the contact information is for the person, but all this
is about interpreting data without common sense.)
We are in bad need of some way to specify if
http://example.org/staff/jo is to identify the retrieved resource,
or if it should be further de-referenced to identify the subject of that resource,
in this case Jo Smith.
Trackbacks and the semantic web
Trackback links define the structure of blog entries that are commented, and the entries that comment them. This is usually a small tree structure. (In principle it is a directed graph.)
There are three kinds of links involved:
-
The trackback URL of the commented entry. In this blog, it is not even coded as a href, but as text. The machine semantics are well defined: This is where the commenting blog's application reports to the commented blog's application. But the machine will usually have to rely on the human to find the trackback URL
The trackback URL has no other meaning for the human.
-
The link from the comment to the commented entry. Not always present, but it usually makes sense to say what you are commenting on.
Mainly for human use, but would also be useful for applications that map the comment structure in a database.
-
Links from the commented entry to the comment. Automatically created by the trackback ping, but might be subject to filtering.
Again - mainly for humans, but could also be useful for spiders.
I suggest that these three kinds of links should carry semantic attributes:
-
The trackback URL could maybe have
rel="trackback". A new link type is needed, it does not fit in with existing link types listed at W3C. More link types are available at Dublin Core's DCMI Metadata Terms, but nothing that gets close to describing a trackback ping URL. -
For the link from the comment to original entry, I suggest
rel="dc:references". That is a more general term thancomments
, but that should not be a problem -
The link from the original to the comment, is the same type, but in the opposite
direction, so
rev="dc:references"is a natural choice. (dc:references has an inverse, dc:isReferencedBy, but I think arel/revpair is more elegant. dc:references is also a more direct property than dc:isReferencedBy)
What to gain:
- Third party applications could supply the tree structure found in on-line forums to the - usually linear - discussions found in blog comments
-
Verification: Pretty much anyone can fake a trackback ping from anywhere.
If the pinged blog can find a
rel="dc:references to itself in the comment, that is proof that the trackback is intended by the comment's publisher. -
Vanity:
It the comment does not link to me, I will not link to the comment.
-
Deletability: If the commented application demands a
rel="dc:references link, the commenting application could delete the trackback by removing therelattribute, and re-ping.
Tags: trackback trackback url semantic web link types DC:references
HaloScan trackback encoding problems
Technology Evangelist has a trackback to Of Paddles and Planes.
But the HaloScan.com page that keeps track of
Frogma's trackbacks
has encoding problems. In the
original post
there is an en dash: home base ? Salina, Kansas
. In the trackback list,
this is represented as the windows-1252 string home base â?? Salina, Kansas
.
(The trackback list is declared as iso-8859-1, but that character set does not include the Euro-sign.)
I have two error reports for blogspot.com
I have two error reports for blogspot.com. As I don't know where else to send them, I post them as comments.
- http://frogma.blogspot.com/2006/03/of-paddles-and-planes.html is XHTML, but it is not well-formed XML. The problem is that the system lets you write unescaped ampersand, "fast & manueverable" rather than escaped: "fast & manueverable".
- The trackback page is declared as iso-8859-1, but contains invalid characters. In iso-8859-1 the hex bytes 80 and 93 are control characters. In windows-1252, they are the EURO SIGN and the LEFT DOUBLE QUOTATION MARK. But in this case, they are probably the result of failure to decode UTF-8 ?
Could you please forward this somewhere?
(I discover such nerdy stuff because I am considering an ASP.NET/xml application for mapping trackbacks as an exercise.)
Submitted to Google Groups: Mal-formed XML and unescaped ampersands Trackback contains iso-8859-1 control characters
A strange F-16
Frogma has an article on aircraft wings and paddles. With a photo of a strange F-16:
Does not look like the F-16s roaming
my native Norwegian skies, they have
a cropped delta along with horizontal tail surfaces
.
Might be the F-16XL. Not that this affects her argument in any way - the delta-winged aircraft in her photo is a better illustration than the 'normal' F-16 would have been.
Publicity photo from the Royal Norwegian Air Force:
Scraping our own site
Scobleizer tells about Feed43.
Took a bit head scratching to get the patterns right. But as long as the CMS behind the page does not supply feeds, landsbank-fo.xml seems a reasonable alternative.
more feeds:
Art by accident
In IE6, I feel like output.xml is art by accident. (IE6 does not quite handle the CSS table styling defined in table.css.)
Looking at Steganos Internet Anonym
I have had a look at Steganos Internet Anonym. Some remarks:
- You have to trust Steganos itself; if Steganos is corrupt, you are better off without it. But small fry need not fear - if they out too many customers, their cover will blow.
- It is terribly slow. Which again means that Steganos use is an indication that you really have something to hide.
-
I tried to use an echo script
to see what happens to e.g.
COOKIEandREFERER. But the response was so slow, I did not hang around to see the response. Update: After a602LAN SUITE è limitato!
error, I finally found that cookies, referers,user agents etc. are still present in the HTTP header. - Steganos is incompatible with my HTTPLook sniffer. So I suspect that a http request travels unencrypted from my browser til the Steganos server. If so, that leaves me vulnerable to net based sniffing in the local ethernet or wifi. Which is where spouses and bosses usually lurk. As spouse & boss will probably not tolerate the presence of Steganos, there might be a market for a version running uninstalled off a USB memory stick? (Anyone with a net based sniffer care to comment?)
- I suspect that Firefox RSS bookmark requests somehow slip around Steganos, I'll have to look into that.
- The Steganos servers will attract intelligence services like honey. They don't even need to infiltrate them, they can just watch the request traffic entering the server. Or - if requests are SSL-encrypted, they can still learn a lot by comparing the traffic in with the traffic out.
- If I ran an intelligence service or were fighting child porn or just terminally curious, I'd offer a service like this to collect information. And I'd make sure it was slow, to improve on my signal-to-noise ratio. (I once had a summer job that included listening in on phone lines for diagnostic purposes. Believe me: random eavesdropping is not very entertraining.)
- Steganos is running a HTTP server on the client. I fail to see the wisdom of that. Not that I suspect malice - they can spy on their customers at their servers, and need not install spyware. But running a server is always risky - one risk is that people may scan it and see that you run Steganos.
To conclude: Probably OK to stay anonymous at the server side. But maybe less effective when hiding from The Spouse or The Government. Could be useful for congressmen's aides who engage in Wikipedia edit wars? No, Wikipedia would block the IPs.
Exporting Excel graphs
The graph in graf.xls is jagged on screen, but looking OK when printed to PDF or paper. Even at 800% zoom, it looks OK in PDF. But if I export it from Acrobat to PNG, it gets jagged again.
A screenshot from Acrobat is a lot smoother than the Excel screen. But it is not perfect, and it is quite a detour to get a graph image from Excel.
Is there any easy way to extract good images of graphs from Excel?
The graph in graf.xls is jagged on screen, but looking OK when printed to PDF or paper. Even at 800% zoom, it looks OK in PDF. But if I export it from Acrobat to PNG, it gets jagged again.
A screenshot from Acrobat is a lot smoother than the Excel screen. But it is not perfect, and it is quite a detour to get a graph image from Excel.
Is there any easy way to extract good images of graphs from Excel?
Update 1:
Xara Xtreme exports nice GIF-graphs. from WMF copied and pasted from Excel.
But Xtreme can't handle all Excel metafiles, it can't paste the metafile that is pasted into metafiles.doc in WMF and EMF versions.
Update 2:
Incredibly fast response from Xara, the answer arrived on the heels of the autoresponse. They tell me that there are problems with older Excels too, but that OpenOffice Calc works fine.
I tested Excel 97, and that didn't work. OpenOffice 2.0 worked fine, but Calc does not display all our graphs like we are used to from Excel.
Update 3:
Adobe Illustrator loses the styling of the axis. The graphs are soft and nice, but so are the characters.
Update 4:
The solution is probably to wait for Excel to render smooth curves on screen. (Or for the displays to get enough resolution to render fonts that are meant for paper.)
tags: excel graph excel image image extraction aliasing Xara Xara Xtreme WMF
Memory stick cap
I still have the cap of my USB memory stick. But I will probably lose it quite soon.
At least since the Duofold from 1921, pen caps have been parked at the other end of the pen when not in use.
Moving that idea to the memory stick should be quite a nobrainer? Or is someone sitting on a U.S.patent for "Structural adaption of electronic computer memory stick to prevent accidential loss of protective connector cover"?
tags: Memory stick cap US patent
Frappr! Friends map (β)
Frappr! is a web site for mapping friends, e.g. friends of Qajaq USA.
But my attempts to add
Greenlands Nights at Flatoyri 2003
fails, because Flatoyri is invalid city
.
Fair enough, they can't possibly list the names of every little place where you
can have a kayak.
But I know that Flatoyri is at 66ºN 23º30'E, and I have coded that information in the HTML head. When Frappr! comes out of beta, I hope it offers at least one way to use that information. I could type it directly in the form, but I'd prefer Frappr! to get the position directly from the HTML head, like geoURL does.
tags: Frappr Qajaq USA Qaannat Kattuffiat Flateyri Friends map
http://af/
Åge Utnes told me to look at the workings of http://af/ in various browsers. The results will probably vary with user configurations, but here are the results for my account on this PC:
IE6
Does not find the host af, and does no HTTP request at all. Surprisingly clean behaviour for a Microsoft application, but that is because I have configured IE not to search from the address line. Even an ayatollah like me could accept a silent retry at http://www.af/.
Even with address line search enabled, IE will not search when
http: is specified. Good!
Firefox 1.0.7
Firefox 1.0.7 used Google to figure out that AF means Arbejdsformidlingen.
I'm pretty sure I disabled that once, but I can't remember where to do it.
On another machine, I ended at the U.S. Air Force, which has a certain perverted relevance.
Opera 8.5
The slightly outdated Opera 8.5
makes a guess at www.af.com, without warning me.
I think http://www.af/ would be a much safer guess,
because the host www.af is under the authority of the domain af
Yes, I said safer guess, having a browser silently going to another place than the one
I asked for, is a security issue. But in general, substituting www.[domain] for
[domain] should be safe, if the administration of the domain is doing its part.
What does http: mean?
Unlike IE, both Opera 8.5 and Firefox 1.0.7 will search, even when I explicitly type http:.
Even worse, they start searching silently on the link to http://af/, that is incredibly stupid. If I want to link to a Google search, I do so.
In this respect, Internet Explorer is clearly the serious browser. Maybe too serious, in not suggesting http://www.af/ as an alternative to http://af/.
tags: Internet Explorer Opera Opera browser Automatic+search Firefox Security Islamic Republic of Afghanistan Åge Utnes
Cleaning up my 10MB corner of the world
- Xenu's Link Sleuth (Find local orphan files)
- zFtpEx from zTools
Flash and SVG
Adobe
buys
Macromedia.
What does that mean for SVG and
Flash?
Maybe Flash will use the open SVG format?
Maybe Adobe will kill its
SVG support?
Fahrkunst
This little animation is my contribution to the public's
understanding of the noble
Fahrkunst.
Who's Got My Keys?
In Who's Got My Keys?, Newsweek's John Sparks hopes that
By the end of the decade, biometric security measures could put the keyloggers out of business
Sorry - biometrics are of little use in protecting transactions from a home PC. You can steal the input from a biometric device just as easily as from a keyboard.
While my password is secret, my biometrics are more or less public. My fingerprints are all over the place, my DNA can be picked up from my coffee cup.
I do not use the same password at my bank and on suspect discussion boards. But I only have two eyes, once I have used my retina to identify at one site, that site can impersonate me at another.
While we wait for a total remake of input device security in the operating systems, one-time passwords provide a low-tech, but much safer solution than biometrics. One-time passwords can be stolen by hand, but not wholesale by spyware.
tags: keylogger security biometrics one-time password one-time pad
Spot the error in the Fahrkunst
Spot the mechanical error in the Fahrkunst. (You will need to look at the full size animation.)
tag: Fahrkunst
128 milligram memory stick
The lightest USB memory yet:
BARENAKED ON A STICK!
... is a USB flash memory drive containing songs, videos, and exclusive content from the Barenaked Ladies, and will go on sale November 22, 2005! Essential for any BNL fan?s collection, the 128mg USB flash memory drive (about the size of your pinky finger) is a fast and easy way to share music, videos, pictures and other data.
Google Base v. microformats
My comment on Google Base v. microformats
tags: semantic web base.google.com RSS Atom
base.google.com: invalid Atom
One of Google's
example Atom feeds is not wellformed XML because it contains
<g:label>Staffing<g:/label>
The correct code is of course
<g:label>Staffing</g:label>
tags: base.google.com
rev-tags
Microformats.org
defines the
rel-tag: links with
rel="tag".
When you define a rel link type, you automatically define it for rev too. From W3C:
Consider two documents A and B.
Document A: <LINK href="docB" rel="foo">
Has exactly the same meaning as:
Document B: <LINK href="docA" rev="foo">
So when I tag this entry with Tags,
Technorati could use rev="tag" on the link back.
And I think they should. Because the
Tags page contains many links.
Some are links to pages with the Tags tag,
others are not. A human can see the difference from the layout, but robots don't read layout.
It would be useful for a search robot to know that all links with rev="tag"
have something in common with each other, and with the last segment of the page's URL.
At Technorati, anyone can get a link back when they tag their own page.
At sites like Hoppa, anyone can also tag their page as
e.g. Search Engines.
But that will not give an automatic link back, because Hoppa is edited.
In such cases, rev="tag" would be even more valuable to search engines.
But to be tag compatible, the URL shuold probably have been
http://hoppa.com/Search+Engines/.
Still, Hoppa is better off than DMOZ, where the page that is listing
weblog search engines
has the tag Search_Engines
, which is far more general than the content of the page.
Microformats for Micropublishing
All the blog location services I have seen assume that the entire blog is about the same place.
That does not fit this blog. Most entries, including this one, has no geographic significance. Those who have, refer to different places. Generally in about the same corner of the world, but I have also refered to both Tórshavn and Phnom Penh in the same sentence.
So I'd like the blog location services to look for microformatted positions in each micropublished blog entry, rather than finding the position in the head element of the HTML page.
Micropublishing
Micropublishing: Publishing small pieces of information that do not get their context as part of a larger document?not as part of a larger text, nor pointed to from the previous part, of from a table of content. Rather, piece gets in context from indexing, tagging and searching.
This blog entry may serve as example. It is part of a blog, but is unrelated to most of the other items. The context is given by the Micropublishing tag and whatever search result or other link that might have led you here.
Trustable TLDs ?
We may need more TLDs because there may be some level of trust in a TLD. You can trust a .fo second level domain to use only ASCII letters, you can trust a .no second level domain to use only English, Norwegian and Sami letters.
But what if ICANN grants something like the sTLD .сом? That would open for for funny domains like microsoft.сом
ICANN of worms
ICANN
is said to have opened a can of worms by
approving the 'language'
top level domain .cat
application.
However, I do not find any such approval in the official
ICANN announcements page.
The reality of this seems to be the the nation of Catalonia tries to get itself
a kind of
country code Top Level Domain
under cover of the language code .cat.
What can I say? I live in the Faroe Islands, another stateless nation,
but one that has its own
ccTLD:
.fo. So I find it very reasonable that Catalonia should have its own
ccTLD too.
Spain may be opposed to the idea, but so is Norway to the
ccTLDs
.bv and
.sj.
(The Bouvet Island is uninhabited. The unilaterally claimed Norwegian military base at Jan Mayen
shares the .sj domain
with the demilitarized Svalbard, which is under Norwegian control by
multilateral treaty.)
I foresee a lot of creative applications for my.cat,
everything.for.the.cat and
everything.but.the.cat.
More interesting is the rush of political TLD
applications to come. The Commanche nation will try to reclaim the
.com domain. The Basque may settle for the
.eus language domain, or try to reclaim the
.eu domain.
There is no general ISO language code for Sami, only codes for each
language: sma, sme,
smj and smn.
Thus, the Sami clearly need the .sami
TLD.
non-ASCII domain names
With the introduction of
IDN and non-ASCII characters in domain names,
there is a case for language based domains.
Under .com, you can use the
homoglyph pair
c
and с
to mimic a famous software company:
Miсrosoft.com.
ccTLDs are generally safer for IDN domains.
E.g. .no specifies that only English, Norwegian and Sami characters
can be used. Mixing Norwegian and Sami in one domain name is allowed, like in
besøk-kárásjoga-biblioteahka.no.
(IBM's demo page does not detect that the á
and the ø
are from different
languages, because they are both from ISO-8859-1.)
Homoglyphs betseen Norwegian and Sami is hardly any problem. But the .us domain may have
a hundred or so native languages, and the .com has to deal with the entire UNICODE set.
So language based domains may reduce the danger of homoglyphic fakes by
restricting their sub-domain names to one language. However, these language domains need not be
top level domains. They could be
sme.no,
com.us,
ca.es or
no.no.
(Many of these domain names are of course already taken.)
tags: Internationalized domain name Català Catalunya Top-level domain Country code top-level domain .cat Homoglyph .sami






it.kelkoo.com
