Getting rid of banking trojans

Today the Finnish Broadcasting Company (YLE) had a story about online criminals routinely stealing money from customers of Finnish banks.

I believe so far the banks have compensated customers for their losses. Of course, sooner or later, the banks must stop doing that because it will become too time-consuming and expensive. What will happen then?

Are the customers left to fend on their own?

Will the anti-virus industry step up their protection efforts and the problem will go away as soon as everyone has an up-to-date AV software installed?

Will Microsoft manage to lock down Windows so well that only the people who run old versions of Windows are affected and at the same time find a really good reason for people to upgrade to a newer Windows version?

Both of the latter scenarios are just extrapolations of current events. Undoubtedly, Microsoft will continue to improve security of Windows in upcoming versions. Just as likely, anti-virus software will probably continue to evolve to meet the challenges of the new threats.

Is that all? Is this the best we can hope for?

I think there is another solution. A very simple one. Unfortunately I cannot think of any way to make money out of it, so it probably won't happen. I will describe it here anyway, just in case someone decides to implement it.

Here it is: Banks should create a bootable read-only USB stick and give one to each customer. The read-only memory would boot a small Linux and run a web browser. The customers would be told to insert the stick into the PC and restart the computer before banking over the Internet.

There are a lot of details that can be debated: Should it be a USB stick or CD? Which Linux should it use? Should the browser run full-screen or in a window? Should it be made easy to use the Linux for other purposes too? Should the Linux be able to save files on the hard disk? Should it support Macs?

Those are minor details. Interesting details, I'm sure. But the core idea appears above in bold. If the banks would do that, they could sleep easy. The customers would know their money is safe.

This is such a simple idea I'm sure it has a ton of problems I have not thought about and because of those it just isn't a viable solution.

Just in case any bank decides to be bold and implement the idea, go ahead. I'm not going to charge money or patent the idea. And the bank cannot patent it either because they cannot claim the idea is theirs.

Between iPhones

Since I cycled home in the downpour of last Wednesday, my iPhone 3GS has not turned on the backlight.  I don't know if you have noticed, but the screen of the iPhone is darn near impossible to read with the backlight off, even in good lighting conditions.

Given that iPhone 5 doesn't launch in a week, I find myself between iPhones.

Rummaging through the kitchen drawers produced a functioning Nokia 5000d-2 and a 4 GB iPod mini. Maybe I can pretend I'm just trying to be retro until iPhone 5 is available in Finland?

Some observations about the phone:

The first thing that strikes you when you pick up the Nokia 5000d-2 is it's feather-like weight, only 74 g. It is thin and light enough to lose in your trouser pockets. The battery, even though it is old, lasts a few days. That seems incredible to me because I am used to charging my phone during every night and often during daytime too.

The user-interface is slow and feels like it is from the stone age. 

There is very little on-board memory (12 MB of which about 9 MB are left to the user.) so uploading music files on it is not really an option. There is no slot for memory card. The headphone jack is too small for standard 3.5 mm plug. The phone has a built-in radio but it requires headphones to work.

The user-experience is riddled with annoyances like:

• The automatic key lock only engages if the phone is on the home screen.
• The backlight turns off automatically, but the next key press doesn't just turn on the backlight, the key press also takes effect. E.g. if you are in the middle of composing an SMS and get distracted, you'd better not press the biggest key on the keyboard. Yes, it will wake up the phone but it will also immediately send the message.

The web browser is terrible, but installing Opera Mini helps a lot. There is no 3G support, so browsing is slow. Email, even Gmail, is integrated in the messaging menu. Reading emails with this is not fun, but you could do it in a pinch. 

Facebook status can be updated by sending email and nowadays Tweets can be sent as SMS to Finnish phone number.

The only things I'm really missing are my calendar from work Exchange server and GPS support for Endomondo or a similar exercise-logging app.

Some observations about the iPod mini:

The battery is a bit old and tired. It took a couple of hours of charging before it woke up and iTunes connected with it. But it still works and seems fully supported by iTunes. But no new software updates available for it, I see.

The click-wheel was an innovative user-interface that still feels fresh. The screen is positively minuscule and monochrome. This device was built for listening music, period.

The 4 GB size means I have to scale down my music collection, but it was easy to do. On iTunes synching screen I checked my "Coding music" playlist and a new option "Fill available space with music". The last option was not available back when I was using the mini for real. A really useful option!

The iPod mini came with a belt-clip, which is good for cyclists during the summer months if all the cycling shirts (with large back pockets) are in the laundry. The clip is less useful now when the weather is so cold I'm wearing a jacket which has pockets big enough to carry any size of phone or iPod. The clip can actually be removed and the mini is much smaller without it.

All in all, I think I can survive with this setup with some time, weeks or even months. The rumors say iPhone 5 comes out on October 5th, so I will be OK, even if it is rolled out in Finland a bit later.

Browser resource usage

The other day I had Safari running all day and before going to bed I started Activity Monitor and checked what's going on. I was surprised to see my Mac was swapping. It usually isn't, not any more after I got a new Mac mini with 4 gigabytes of RAM.

The cause for swapping was Safari 5 taking up just under 1 GB. Eh!??!

I did a test. I opened Safari, Firefox and Opera and loaded each with 3 tabs: Twitter, Facebook and Gmail and let it simmer for 5 hours.

Browser	Version	Initial RAM use	RAM use after 5h	CPU usage
Safari	5.0	185 MB	301 MB	0.1%
Firefox	3.6.3	160 MB	157 MB	3.3%
Opera	10.53	205 MB	249 MB	7%

I don't think I can afford to run Safari now that it uses so much memory. Incredibly, Firefox used less memory after 5 hours than right after loading the pages! I think if anyone these days says Firefox is a bloated browser, they are badly mistaken.

I also followed the CPU usage of the browsers. It seemed to stay constant, so I did not include initial and after-5-hours figure in the table. To Safari's credit, it runs fast and causes practically no CPU load even with these Javascript-intensive pages. Opera uses so much CPU, it would start to be noticeable if all the 3 users on this Mac would use Opera.

Based on the figures above, Firefox is my new default browser.

Software Engineering Radio - the podcast for professional software developers

Interesting presentation of the new C++ standard. 

Kuuntele tämä podcast iTunesissa:

http://phobos.apple.com/WebObjects/MZStore.woa/wa/viewPodcast?id=120906714

-- Sami

Software Engineering Radio - the podcast for professional software developers

Kuuntele tämä podcast iTunesissa:

http://phobos.apple.com/WebObjects/MZStore.woa/wa/viewPodcast?id=120906714

-- Sami

The only sportscast I like

Kuuntele tämä podcast iTunesissa:

http://phobos.apple.com/WebObjects/MZStore.woa/wa/viewPodcast?id=78561049

-- Sami

Hudson iPhone app

http://hudson-mobi.com/

Usability of modern computers

Lately I have been helping elderly family members with their computers and other home electronics, so I have been offered some rare insights into the usability of modern-day gadgets.

Let me outline some use cases that seem to be common, at least to the elderly around me:

Printing photos

This is the most common use case. Digital cameras are cheap and lots of photos are taken in all the family occasions. The cameras are easy to use: Power on, point and shoot. It is the part that comes later that is problematic.

The user has shot the photos. The next step is to get them printed. The user has a color inkjet printer. The printer is connected to the computer. The computer also has a memory card reader.

The user needs to remove the memory card from the camera and insert it to the card reader. If the user is lucky, some software is automatically started that does something and takes the photos from the memory card and scurries them away somewhere in the bowels of the machine.

The user then removes the memory card from the reader and gets insulted by the machine that he has done something stupid.

Now the user has to find the correct icon to click, then find his photos somewhere in the windows on the screen and then find something to click to print the photos. Then the user also must remember to change the printer settings for printing on 10 x 15 photo paper, not A4 plain paper he printed yesterday's fish casserole recipe.

That was such a tiresome exercise! Why was it so difficult? What the user really wanted to do was to connect the camera to the printer and press a button titled "Print my photos"

When the photo is printed, the print is the end result. It can be enjoyed together with friends and family in the living room.

The user does not find any value in the digital versions of the photos stored somewhere in the computer. The user does not easily find his photos in the computer, they are difficult to view because they are so small and it is difficult to move from one picture to the next.

Luckily these days there are printers and cameras that can print photos without the troublesome computer making things difficult.

Watching camcorder videos

Camcorders are also cheap these days and what would be more fun than shooting moving video clips of grandchildren while they play and do many other nice things. These are also pretty easy to use: Power on, point and shoot normally works with these. Of course there are a lot of menus in strange languages but if one stubbornly ignores them, they will go away and stop bothering you.

Again, the trouble starts when these videos are to be presented on the big flat-screen TV in the living room.

The camcorder has a USB connector. The TV has a USB connecter in the back. How fortunate! The video is obviously going to be play on the screen as soon as a USB cable is connected between the camcorder and the TV.

Unfortunately it did not. It turns out the TV does not know how to play video. It can only show still photos from the camcorder's memory.

But it is possible to make a DVD disc from the videos. The downside is, it involves using the computer again and we already know from our past experience with printing photos how fun that was.

Sony has spotted a market in here and makes a product called DVDirect, a box you connect the camcorder to, insert a blank dvd and press a button. Simple and easy. Our user is going to get one of these so he does not have to deal with the troublesome computer.

Watching photos on the TV

From the previous exercise the user discovered it is possible to watch photos on the living room's big flat-screen TV if one can get the photos on a USB memory stick.

Obtaining USB sticks is easy. They are commonly sold at cash registers of convenience stores among candy, cigarettes and condoms.

Now the user needs to talk the computer into releasing some of the photos it is keeping hostage to the USB stick. The user has no idea how to go about it but the user knows how to call a young family member and get them to use remote screen sharing and export the photos on the USB stick.

Remove the USB stick from the computer. (Ignore the insulting message the operating system puts on the screen about doing something improper again.) Pull the power plug from the wall to quickly shut down the computer.

In the living room, the user inserts the USB stick into the slot on the TV. The TV complains about some pictures bring broken or unreadable. The user has to manually skip over broken photos with names like ".Trashes", ".Spotlight-V100" and a lot of them named "._IMGXXX.JPG"

After scrolling over dozens of broken photos there are finally some proper photos and the user can relax. But isn't modern technology difficult!

Photos on a digital picture frame

The user has a digital picture frame. It is a nice and modern way to enjoy the digital photos. Apparently it also requires photos on a USB stick. Lucky user, he already has a lot of photos on the USB stick from the previous day. (And there is always the "family IT guy" he can call.)

The user sticks the USB stick on the side of the frame and finally something works as it should! The frame begins showing the photos on a never-ending slideshow. And it was so easy to use.

After a while, however, the user begins to be irritated by the big blinking led at the top of the USB stick. It is kind of distracting.

A call to the "family IT guy." He tells the user he should manipulate some buttons on the frame and copy the photos from the stick to the frame's internal memory and then unplug the USB stick.

The user has no idea how to do that and because the family IT guy cannot connect remotely to the picture frame, he cannot help either. The user pulls the plug of the digital picture frame and throws it into the waste bin. He shoots some piccies on his digital camera, connects it to his printer, gets some nice color prints and hangs them on the wall.

Good discussion on sustainable living

How consumerism is killing us all and what can be done about it

http://ax.itunes.apple.com/fi/podcast/exploration-with-dr-michio/id353007502

-- Sami

Life, the universe and everything

Exploration With Dr. Michio Kaku:

http://ax.itunes.apple.com/fi/podcast/exploration-with-dr-michio/id353007502

-- Sami

A nice article on clojure Clojure

http://www.javaworld.com/javaworld/jw-05-2009/jw-05-clojure.html

Programmers of popular programming languages

Hmm... as some of you probably know, I collect exotic programming languages. This quote made me think:

If you program in the most popular programming language, your skill in that particular language is a commodity. If you program only in the most popular programming language, you have made yourself a commodity. A commodity can only compete on location and price, and location doesn't really get you much on the Internet. This means that only people with a poor understanding of economics program in PHP.

Lifted from http://gilesbowkett.blogspot.com/2009/01/why-hacker-news-thinks-php-won.html

What do you think?

How american health care works

Check out this podcast on iTunes:

http://phobos.apple.com/WebObjects/MZStore.woa/wa/viewPodcast?id=201671138

Thanks to Juha for recommending it to me. 

Come again?

From HP's customer service web site:

Note: You must have administrative privileges on your Mac computer to install the software. Click System Preferences, Accounts, and check Allow user to administer this computer.

Now let me get this straight: You should grant your account administrative access in order to install some software. But you need administrative access to grant administrative access, don't you, so why bother?

Learning XPath

Many of the Mac OS X command line utilities have a -plist option, which makes the utility do its thing in the "plist xml" format. I had the idea that maybe it would a good idea to use it and then use some of the xml tools to extract the information I want, instead of the usual pipeline of grep, awk and sed commands.

Specifically, I wanted to find out the mount point of a file system. I know the device file of the disk partition/slice.

I could try the mount command, but if the mount point directory has whitespace characters, parsing the output of the mount command is a bit fragile.

diskutil info is an OS X specific command that gives me what I want. After learning about XPath a bit, I came up with something like this:

diskutil info -plist /dev/disk0s2 | xpath "//string[preceding-sibling::key[1]='VolumeName']"

This is not yet perfect. The volume name is surrounded by <string> and </string> but I can live with that. The final insight for the XPath expression came from this post.

P.S. This post was written in Blogger's rich text editor in the Safari browser. This was the first time it worked well enough to be useful.

The best programming language, part 3

I wrote some time ago about my search for the best programming language. Now I have discovered a new language that meets a lot of the demands: Clojure.

Clojure is very much like Lisp. It runs on a Java VM. Java VMs are stable and either already installed on many platforms or easily available. All the objects you can import into Java are available for calling from Clojure. The Clojure programs can be deployed as .jar files and no-one needs to know you actually produced it with a high-level functional language.

Clojure also has good support for multi-threading and it does it with a new and interesting way by implementing software-transactional-memory, which apparently makes thread programming easier than using locks.

It is licensed under the Eclipse license. IANAL but it looks to me like it would be possible to use it for commercial software development without any major problems.

I'm still reading the documentation and I haven't written anything more complicated than a hello-world with it, but I'm liking what I see so far.

Parkkeeraus on taitolaji

Tämän BMW:n omistajalla on joko:

• niin huono näkö, ettei näe parkkiruudun viivoja tai
• niin iso ego ettei yksi parkkiruutu riitä tai
• ei vaan osaa parkkeerata

Myyrmannin parkkihalli, perjantaina 6.3.

Simple = good

Modern day gadgets, devices and equipment mostly suck and have bad failure modes. Let's illustrate this with some examples:

I have a digital TV receiver, Handan CV-3300 CNX. The picture and sound works. Subtitles also work most of the time. A few times a week the device turns on but there is just a black, blank screen on the TV and no sound. A power-cycle makes it ok again.

Like all digital TV receivers, it includes a feature called EPG or electronic program guide. This is supposed to be a display of past, current and future programming of all TV channels. When I press the EPG button on my remote, I get this information for some channels but the rows for other channels are empty. Sometimes it helps if the receiver is on for a while. Sometimes those rows stay empty for hours.

This is probably a bug in the receiver's software and will go away when the manufacturer makes a firmware upgrade available. I have had the box from 2005 and it has never found an upgrade. I have also navigated the device's menus and found the command to search for upgrades. Nothing there either. There are no upgrades on the Internet either. In fact, the manufacturer's web site has no record of this device.

My friend has a stereo set with a turntable. When we were listening to his LP records, we discovered the turntable was broken: when the arm reached the end of the record, it did not automatically lift up and return itself to the rest next to the revolving plate. The mechanism is broken. But one can push a lever to lift the arm and then push the arm to the resting position with a fingertip.

This got me thinking: The turntable is broken, yes, but not badly. It still plays the records and the small problem it has is easily amended with just a little flick of a finger. And even if the turntable develops more serious issues, it will probably still be able to play the records but with a loss in sound quality. The worse the problem, the greater the impact on sound quality. But the problem will have to be very serious indeed to completely prevent enjoying recorded music. To make it short: it fails gracefully.

Another example: Last week I got a coffee grinder. Not an electric monster but an old-fashioned one with a crank on the top. I have never used a coffee grinder. In fact, I have only seen them in films. The grinder came with a small sheet of paper on which were some hard-to-understand instructions. I could not figure them out. But the device was so simple and made from just a couple of pieces of wood and metal held together with screws, so it was easy to take it apart and figure out how it works, which way to turn the crank and how to adjust the coarseness of the grind.

It is a beautiful piece of equipment that is simple, does only one thing, does it well and is easy to understand, operate and repair. It also fails gracefully. (The device did not fail at all, the manual did.) And let me tell you: If you like coffee, you should grind it yourself. There is a remarkable difference in the taste. I did not believe it until I tried.

I am beginning to like simple things which I can understand and fix. Maybe I am getting old. Maybe it is because all day long at work I have to build and fix complex things that can and will fail in a lot of different ways. And all of those failures are bad, or very bad.

Is it even possible to build software that fails gracefully? I don't think I have ever seen such a thing...

Uusi ulkonäkö

Otin Bloggerin uudet ulkonäköasetukset käyttöön ja samalla muutin blogin pohjaa ja tein vähän muitakin pieniä muutoksia.

Best game in a while

World of Goo is a great game! It is very easy to learn. You can play a quick game when you have the time and come back to it later. It is addictive and fun. No obvious bugs. It is cheap ($20) and carries no obnoxious DRM. It does not need a powerful computer but still has attractive graphics. It is available for Mac, Windows and Linux (and Wii.)

At the price point of 15 euros it is starting to become questionable if it is even worth the time and trouble to pirate this game. For me it was easy to decide to buy it.

Get the demo, play it, then buy the full version. Support the couple of guys behind this piece of pure genius!