Merry Christmas!

As with last year, Kristen and I are going part-green by sending a virtual card to the most tech-savvy of our friends and family members. You can now enjoy our Christmas Card from the comfort of your computer, phone, or other electronic gizmo!* A higher-quality version is also available if you have some bandwidth to spare.  Merry Christmas, and a Happy New Year to you all!

* Assuming, of course, that one reads this blog. :)

Defenders of Science

This afternoon, I read a great article regarding climate change deniers and their influence in American politics.

Franken, Whitehouse Expose Climate Deniers on Senate Floor

I wholeheartedly agree with Sens. Franken and Whitehouse regarding their testimony, who plainly and clearly address the claims of climate detractors in an accessible -- and at times humorous -- manner. For example, consider this analogy presented by Sen. Franken, taken from the Congressional Record:

Let me illustrate this with an analogy. Say you went to a doctor and the doctor told you: You better start eating more sensibly and start exercising, because you are tremendously overweight. I see that you have a family history of heart disease, and your father died of a heart attack at an early age. You have to go on a diet and start working out a little bit.

You say: You know what. I want a second opinion. So you go to a second doctor and he says: OK, you have a family history of heart disease. Your father died of a heart attack at a young age, and you weigh over 300 pounds. You smoke three packs a day. Your cholesterol is out of control, your blood pressure is through the roof. It would be irresponsible of me as a doctor not to immediately send you to this place at the Mayo Clinic that I know. I think you have to go there.

You say: Thanks, doctor, but I want a third opinion. So you go to the third doctor and the third doctor reads the chart and looks at you and goes: Wow, I am amazed that you are still alive.

You say: You know what. I want a fourth opinion. And then you go to the fourth, fifth, sixth, and seventh doctors. They are all saying the same thing. But you keep asking for more opinions.

Finally, you go to the 25th doctor. The 25th doctor says: It is a good thing you came to me, because all this diet and exercise would have been a complete waste. You are doing fine. Those other doctors are in the pockets of the fresh fruit and vegetable people. He says: Enjoy life, eat whatever you want, keep smoking, and watch a lot of TV. That is my advice.

Then you learn the doctor was paid a salary by the makers of Twinkies, which, don’t get me wrong, are a delicious snack food and should be eaten in moderation. Am I making sense here?

You certainly are.

Almost Done

In less than one week, I will be defending my PhD thesis.

I have been working towards this goal since July of 2004, but my mind has been set on it for longer yet. It took the writing of my acknowledgments section to realize that in full. I decided to particularly thank my high school science teacher who first encouraged me to aim high -- and why not fusion?

Fifteen years later, here I am. An honest-to-God fusion researcher, about to receive a terminal degree.

Wow.

Cool as that is, I'm looking forward to being done with the defense. It's been a long road to get here, and while I'm not quite out of the tunnel yet, the light is getting brighter at the end!

GoG, How I Love Thee

I recently learned of Good Old Games, and had an opportunity to try them out over the weekend by purchasing a re-packaged version of Heroes of Might and Magic II, one of my favorite strategy games of all time.

This evening, I got it up and running again, and the memories have started to flow back to the summers of 1996-1998!

Even better: the game was on sale, and I was able to pay seamlessly via PayPal.

I strongly suspect GoG will be getting more of my money in the future for this excellent service targeted at exactly my market segment. :)

Classic Ultima Resurrected?

My jaw dropped today to learn of some very exciting news: Classic Ultima games are going to be commercially available once again!

Electronic Arts, the giant game corporation that absorbed Richard Garriott's Origin, has apparently struck a deal with Good Old Games to introduce Ultima to a modern audience.

I can't wait. I also hadn't heard of GoG until today.

So... I'm probably going to be spending some hard-earned money on modern variants of Ultima, if only to be able to play Pagan on modern hardware. As a bonus, GoG is bundling the EA cluebooks -- a very rare commodity these days!

In other Ultima news that wouldn't interest those who are not total nerds on the subject, I stumbled across a link containing juicy details regarding the Bob White Plot which was rejected in favor of a hastily-produced Ultima 9 that broke much of the wonderful story continuity between Ultimas VII, VII:Serpent Isle, and VIII:Pagan.

I know what I'm going to be reading for fun this weekend!

Time for Some Maintenance [Macintosh SpinRite]

My home Mac has been acting up lately. Very slow to boot, occasional spinning beachball while hard disk activity is taking place... all signs of HDD weariness.

Today I finally bit the bullet and screwed up enough courage to delve into the disassembly of my iMac4,1 so that I could get access to its hard drive and run the ever-venerable SpinRite upon it.

It is a pain in the behind to get access to that hard disk. I needed Torx screwdrivers, in addition to prying the lid of the front face (taped down to boot) and making a big mess on my floor.

It was enough to get access to the SATA interface with my nifty SATA-to-USB adapter. My PC laptop can then safely SpinRite the Mac disk nearly in-place.

Of course, I'd much rather be able to run SpinRite natively. Perhaps that will come in SR7... :)

A Letter to My Representative About the Debt Ceiling

In my opinion, this whole debate about the debt ceiling has gotten completely out of hand.

Tonight, the President issued a request to all Americans to contact their elected representatives. Here's my shot at it:

Dear Representative Ryan:

This evening I am writing you per the President's request for concerned citizens to contact their elected representatives regarding the need for Congress to pass legislation that raises the debt ceiling.

As you are well aware, failure for Congress to pass such legislation in time for the President to sign it into law by August 2, 2011 would induce the first default in American history. Such an unprecedented, reckless action would mar the full faith and credit of the United States, increase the interest rates on future borrowing, and has a very strong likelihood of severely damaging the US -- if not the world -- economy.

I recognize the House has passed symbolic "Cut, Cap, and Balance" legislation, which was subsequently rejected by the Senate.

Such political theater is unacceptable to me, given the gravity of the matter and the impending deadline for action.

I strongly urge you to use your influence with your peers to craft compromise legislation that is capable of clearing both the House and Senate to promptly address this issue of national import.

I support the most ambitious initiatives put forth by the President to address the separate, but related issue, of reducing our structural deficits using a combination of spending cuts and increased tax revenue; in particular, broadening the corporate tax base by elimination of "loopholes" while reducing overall tax rates.

Please, do not ruin the impeccable credit of the United States by refusing to compromise. Use your position and influence to its fullest to avert the insanity of a self-inflicted default by raising the debt ceiling.

Respectfully,

Here's hoping that this falls on non-deaf ears. :/

LaTeX Goodies

I just found out the joys of the showframe package while working on figure sizing.

My issue is to ensure that all my thesis figures, etc. fit within the Blessed Margins set by the Graduate School.

Now I can view the placement and sizing *right away* without resorting to opening things in Acrobat and making page-specific layout guides.

Now, back to the trenches...

Note to Self

While recovering from a back injury, do not slip and fall on stairs.

It hurts your back. >:-/

Deadites! On my iPhone!

One of my favorite movies is Army of Darkness. As such, I was delighted to see that the Army of Darkness iPhone game was available for free today.

Deadites about to meet my chainsaw-arm and shotgun!

The gameplay is easy to learn, and the challenge mild. Where this game really wins is in the music and the fun (and faithful!) movie quotes that are liberally interspersed in normal gameplay.

It's not fair that all these great games are coming around to distract my writing. :)

A Post From the Road

Recently, I have been dealing with back pain and temporary carpal tunnel syndrome. Fortunately, I am recovering well.

The experience, however, has left me with the need to explore technologies that can assist with the transcription of text. This message, for instance, is being transcribed by the Dragon Dictation application for my iPhone.

Personally, I find the quality of the transcription to be remarkable. I am still getting used to using such tools, but I believe that I will be able to use them more effectively (and efficiently) on the road or
on my frequent walks.

Now, if only this transcription software could handle mathematical symbols!

PvZ

I have been, and am presently addicted to Plants vs. Zombies for iPhone following its recent update.

It is very fun, and I highly recommend it on any of the many platforms it is available upon.

That it all. Back to thesis writing!

Password Activism, Part II

I have received a response from my medical representatives regarding password security, and am pleasantly surprised by the response rate.

Thank you for your feedback, and as it appears you already know it is industry standard to store a hash value of the password.  I assure you that your password is not in fact stored as is in our database, it is stored by some type of hash value.  I am not entirely sure by which standard our software vendor encrypts this data, but it is protected.  If you lose your password our standard procedure is to have you reset it, because we are unable to retrieve your old password information from our database.  If you have any further questions or concerns please do not hesitate to contact us.

Grammatical errors aside, there is an assertion that a hash is used in password authentication. If that's the case, then why enforce an upper character limit on the passwords? The nice thing about a cryptographic hash is that -- by design -- will reduce an arbitrary-length input to a fixed-size, obfuscated token that can be stored for purposes of authentication.

Let's just say that if the third-party vendor that performed this implementation knows this and enforced such a limit anyway, I hope that a fourth party was responsible for implementing the encryption practices for the actual medical records! :P

Given the invitation to reply, here's what I fired back:

Thank you for your prompt reply.

In light of your assertion that a password-derived hash is what is used for purposes of authentication, I have a website enhancement request that I would appreciate you forwarding to the appropriate technical or vendor representative.

In particular, please remove the upper limit on password length that is presently enforced at 15 characters. (The minimum password length requirement remains a good idea.) This should not pose any technical burden, as a cryptographic hash function, by design, can take an arbitrarily-long input and produce a fixed-size, obfuscated output that is suitable for storage in the authentication database.

Such an improvement would significantly enhance the overall strength of the website's password system, and bring it in-line with practices used at financial institutions.

Thank you once again for your responses. I appreciate your assistance in forwarding this suggestion to the appropriate representatives, and would appreciate a response should action be taken to address it.

Hopefully the message can go up the chain and fall on the right person's desk.

A Little Password Activism

My medical professionals have recently upgraded their websites to provide an e-portal for secure messaging, sharing test results, and the like.

I think that such electronic access is a fantastic idea. However, I had a bit of pause with the user registration process, which required me to have a limited-length password.

This irks me to no end, especially when this password is supposed to guard access to medical or financial records. Here's why: such a restriction implies that a database field is being used to store the password for purposes of authentication checks (or worse, password recovery!)

I wrote the following to the webmasters, and fully expect it to fall on deaf ears. At least I've tried!

Hello,


Thank you for providing me secure online access to my medical records, test results, and service providers.


I am writing to let you know of a potential security issue regarding password storage for the system's online authentication. In particular, during the user registration process, a password must be created consistent with a length of 6 to 15 characters containing at least one number and one letter.


Such a length restriction implies that the password itself is being stored in your database(s) for purposes of validating authentication attempts. This is an insecure practice. A secure approach -- and industry best practice -- is to store a salted cryptographic hash of the password that does not require the actual passwords itself to be stored, but instead something derived from it. Please see the following document from the National Institute of Standards and Technology for more information on this subject: http://csrc.nist.gov/publications/drafts/800-118/draft-sp800-118.pdf


I would appreciate your comments regarding these issues at your earliest convenience.

The nice thing about the salted hash approach is that one can still store a fixed-length field in the database, but the password itself can be of arbitrary length. Plus, the authentication system doesn't know what the password is -- just something that is derived from it.

Here's hoping that letters like this can start making password storage more secure -- especially in light of epic failures like the Sony breach!

The Courage of Rick Santorum

Yes, Rick Santorum is running for President.

Will he win? Of course not.

Why waste valuable blog space then? Because I was very surprised (and slightly amused) to see him being described as a "frothy, third-tier candidate."

It's good to see that the left leaning media can get away with that one; here's hoping that more media outlets ask him about his true namesake!

Insomnia Thoughts

So, it's another night without sleepiness and, so it seems, time for some more blogging.

I haven't posted for a while over here, and as such I reviewed the last few posts.

It turns out I use the word 'fun' a lot. Especially in titles.

Methinks I should come up with some better adjectives!

Coding Fun

This evening, I got something to work that I've been trying to get to work for a couple of weeks now.

I've implemented a flux and field solver for determining the predicted time evolution of magnetic measurements inside our machine's vacuum vessel as a function of sets of time-evolving external current sources and vessel resistivities.

Fun!

The not-as-fun part comes next: cleaning up the code and actually using it to improve our modeling of the vessel.

As Seen on the Internet

I would like to be finished with my PhD thesis.  It can be done.

Tonight I came across the following snippet, which encapsulates some of my feelings right now:

A PhD is a completely solo effort. There is no one you can ask advice of. No one can help you. ... You are alone. Think Frodo without the Fellowship.

Sure, it's depressing, but only because there's a grain of truth to it. It certainly feels that way sometimes.

I think I'd feel better if I had a Ring of Power, though. :)

Sleep

It's 2:30 AM, and here I am typing away at a blog post.

It seems like there are just some days where I struggle to fall asleep. Tonight's one of those nights.

No, there's nothing obvious, like excessive amounts of caffeine. I had a later dinner, but that isn't usually an issue for me.

I sure don't think it has anything to do with my State's new governor and legislators. Not unless my subconscious is out to get me...

Here's hoping for a good night's sleep, and more frequently!