2009 December — R James Taylor

Caveat Emptor: x-tremegeek.com

December 31, 2009 By druzziel

My girlfriend wanted to give me an awesome geek toy for Christmas this year. She ordered a USB Webcam Missile Launcher from x-tremegeek.com for me, which I have to say is a pretty darned awesome geek toy. Even now, I can imagine using it to drive invaders from my cubicle, guaranteeing the sovereignty of my personal space . . .

Alas, it is not to be.

When the toy arrived at her home, she opened it up and found not the USB Webcam Missile Launcher, but rather the USB Missile Launcher. No webcam. Which is still a cool toy, but it lacks the major feature of the webcam version, which is that it can be remotely controlled.

But the folks at x-tremegeek.com explained to her that the webcam version was on sale for the same price as the normal retail price of the non-webcam version, so this was an “appropriate substitution”. When she pointed out that they are, in fact, very different products, x-tremegeek.com said that she could return the thing that she did not order for a refund – minus a restocking fee. After several phone calls, she got them to waive the restocking fee. Since, you know, she was returning something that she didn’t order in the first place.

x-tremegeek.com has many things going for it as a company. It’s got an apt name, a great catalog of toys, and a decent web site. Unfortunately, their customer service is bollocks. When the zombies finally overrun my meager cubicle defenses, I will die cursing their name.

Filed Under: Customer Service, Guest Articles

Twitter-pwn’ed: the confessions of a lazy developer

December 28, 2009 By rjamestaylor

This is a hard post to write since it is absolutely embarrassing to me and may cause me to lose serious geek-cred. However, I hope this is a useful mea culpa for others’ benefit. This morning I spent a while revising a script that accepted external input which I borrowed (and modified) from someone else. The original script used the external input safely – my modifications made it a true security nightmare. Basically, the script took content from the Twitter API and rerouted it through Jabber (XMPP) protocol. My change also sent the content through email.

If I had used the built-in SMTP features of ruby this post would have been unnecessary. However, as I was in a hurry (the excuse of a scoundrel) I simply piped the output through BASH to the mail command via ruby’s system() function. Also, I took no precautions to escape the external input from being executed by BASH itself. System admins and top-notch developers are now crying with laughter.

Why did I do this? Besides being an idiot, I did this because this script was a “one-off” and not something I was paid to develop. I needed a feature and, in the spirit of a developer (not a system administrator or security professional), I looked for the path of least resistance. With the system() call I could use my knowledge of the Linux command-line to accomplish my task. Since the original script was written in ruby, a language I have not used much at all, previously, I was able to add my needed feature in minutes. A couple more minutes would be all that was necessary to find out how to use ruby itself to accomplish this result. Laziness won over thoroughness and correctness. Result: a *huge* security hole.

Here’s what prompted me to invest in learning to add this feature in the Right Way™: a friend of mine who is an überGeek realized that, based on a clue I gave out about my script’s performance, he could have his way with my server via Twitter. I was Twitter-pwn’ed. Here’s what he sent me (knowing I watch my tweets via this script):

@rjamestaylor $(touch /tmp/test)

@rjamestaylor $(ls -la /tmp/test)

After he sent these two tweets my script sent me an email with this:

-rw-r--r-- 1 root root 0 Dec 27 03:39 /tmp/test

Yes. BASH executed his tweet (!) and as ROOT! So, if someone had tweeted “@rjamestaylor $(rm -rf /)” my server would be a barren husk of hardware. Worse, someone could have used my script — via Twitter! — to setup privileged user accounts, send spam (though small), attack other systems, etc. Why root (or as my geek friends would ask, WHY IN GOD’S NAME “root”?)? Simple: I was in a hurry. Stupid.

Lesson: spending the little bit of extra time necessary to add features without violating security protocols is always worth it. Sure, I could have just bought some CodeOffsets to assuage my guilt, but it was actually better to (1) shut down my script until (2) I fixed the security issues.

Turns out adding net::smtp to a script in ruby is painless. Now I have my feature and no exciting side-effects from rushed, careless development. In fact, most security holes I encounter in others’ code is due to the same thing: rush to add features without a review of implications. Anytime one takes external input from a user or the Internet (or Twitter) one must sanitize the input from unintended effects. This goes for SQL injection (parameters, people!) as well as simple command expansion attacks, among many other possible vectors.

So, go ahead and tweet BASH-expandable tweets to me, my code is not just offset, it’s fixed.

Filed Under: How-to, Linux, Tech

Twitter Lists: Changing Everything about Twitter

December 13, 2009 By rjamestaylor

Twitter List support has been out for a while now but the impact of this new feature may not be readily apparent to most Twitter users. Yet, Lists have already changed Twitter in dramatic ways that you really need to know about.

Twitter Lists are user-created groupings of other Twitter accounts. This is somewhat like the client-side groups provided by TweetDeck, Seesmic Desktop, FriendFeed and others but since it is built into Twitter itself the impact is far-reaching. The biggest difference between client-side groups and Twitter Lists is that lists are public. User can “follow” lists others set up, for example.

Here’s a quick rundown of how Twitter Lists work. A logged in user can create up to 20 Lists containing 500 users each. The name of the List is up to the user and usually suggests the common trait tying the users together in the mind of the List creator. The list creator is also able to provide a description of the list created. The list can be public (default) or private (seen only by the list creator). However, users added to a list can see which list they are on regardless of the public/private setting of the list itself. That means users on a private list know who has listed them and knows the name of the list that they are on. [ed: Thanks to several people who have corrected me - I agree, private lists are private to the list curator and are not seen by those listed. My apologies!]

@rjamestaylor home page with count of Lists

When I log into Twitter I can see that I’m currently listed on 89 Lists (see above). I can also see the Lists to which I’m subscribed on the right most column of my Twitter home page.

Lists @rjamestaylor created or follows

Let’s create a list! The screencast below demonstrates creating a new list, adding users to the list, viewing the list and deleting the list. (Tip – watch in full screen mode)

The most obvious benefit of using Twitter Lists is to reduce the clutter in your reviewing of users’ tweets. By segmenting users into lists the “noise” of all the twitter users you follow is drastically reduced. But the game changing value of Twitter Lists is more subtle: following lists others make of interesting users.

Making lists and checking them twice

Since anyone can make lists of any (non-blocking) Twitter users and share these lists with the Twitter public a new way of discovering interesting users has come to Twitter. The impact is this: those users with special knowledge of other Twitter users can group otherwise unidentifiable users into easy to find categories. For example, if you’re interested in venture capitalists, you may have tried to find those VCs on Twitter you know of or can find through searching Twitter profiles for their own self-description as a VC. Yet, you may miss some key VCs without special knowledge. Twitter @Scobleizer probably knows more VCs on Twitter than most and he has faithfully created a list of VCs on Twitter: @Scobleizer/venture-capitalists. Now you can easily follow the thoughts, activities and actions (including locations) of the top venture capitalists on Twitter. Needless to say, finding trends among VCs is significantly easier for all of us due to Twitter Lists.

Let’s take this a step further. Say you are interested in a particular company for reasons such as news reporting, competitive intelligence, investment research, employment research, or even to follow the tweets of your own employees. Previously, finding Twitter users from particular companies relied on the self-reporting of each user. Now those with special knowledge of a company’s staff can make their own lists. So an employee of a company may not realize they have been listed by others as part of their employer’s Twitter users. Impact? Your personal intention to separate business from personal life on Twitter is compromised. More over, those companies that make their own list of employees who tweet make it very easy for the public to learn about the culture, sayings and doings of their employees. By having a public list of employees whether self-made or made by others with special insight, researching a company has been simplified. PR departments may think they control the public perception of the internal nature of their companies but Twitter Lists has busted this wide open.

Previously a Twitter user may have been followed by a handful of others. Such a user may have been careful not to related themselves to their employer but by being listed as an employee of their company they have become a de facto spokesperson on their company’s behalf. This is why I believe Twitter Lists have changed everything about Twitter.

For example, say a company is going into a quiet period required by the SEC. Because of Twitter Lists employees that believe they are speaking independently and privately now may give critical information to investors through tweets like, “Wow – just met our new owners – great company! Can’t wait until I can talk about this!” As part of a List of employees this may be an improper disclosure. This is an extreme example, sure, but a real one that could have employment and legal consequences for the employee.

Example two: an airline is facing inquiries from the FAA over possible maintenance violations. An employee not knowingly aggregated with his employer due to being listed on “Airline-X-engineers” list tweets, “finally the chickens are coming home to roost. Shortcuts we’ve been forced to make are getting exposed.” Oops.

Example three: a utility company suffers a public-affecting outage. Many people are impacted. Phone lines are jammed, customers are hurting. An unwittingly listed employee tweets, “Nothing to do at work so we’re catching up on World of Warcraft.” How do you think customers would react when the PR department releases a statement that everyone is working hard to recover power to each customer? Perhaps the employee works in accounting for the utility and their department really is at a point when the workers are able to catch a break. Think customers will understand that an accountant isn’t going to be manning the cherry pickers? Ouch!

Rethinking Twitter in light of Lists

Twitter has changed, dramatically, with the introduction of Lists. As a long time Twitter user I see that the former semi-anonymity associated with tweeting was seriously compromised by Twitter Search and practically eliminated due to Twitter Lists. I believe we all need to rethink some previously held assumptions about Twitter.

Should I tweet at all?

Previously I encouraged everyone to use Twitter. However now more than ever we must realize that tweeting can affect our personal and professional lives. Those with any concern that their tweets could jeopardize their livelihood should seriously consider not tweeting at all.

Those who continue to tweet need to remember that much is on the line with each tweet. Deleting a tweet is not guaranteed to remove it from the Internet (see: Once Tweeted, Never Deleted). Remembering to ask, “is this hurtful? Is this helpful?” before tweeting is necessary now more than ever.

I’m listed as an employee of my employer, what should I do differently?

First, make sure to carefully follow SEC and company policies with each tweet. Not sure what those rules are? Better read step one above and find out before continuing to tweet.

Second, before tweeting make sure that your company’s customers are not suffering on Twitter. How? Search for your company’s name or brands on Twitter using Twitter search. If your customers are suffering try to reach out to help them or consider not tweeting until the issues are resolved.

Third, remember that your company will be judged in aggregate through the tweets of listed company employees. Proud that your company provides expertise to customers related to technology? How about including relevant links every once in a while, or offering up a simple tip related to some area of your own expertise? That will positively impact not only the public perception of your company but help show you personally are a contributing member of the company to others. Conversely, if your company sells vegan products as its main product offering, tweeting about hunting trips and company outings that include baby backed ribs may have a negative impact on the company and your employment.

If I’m listed without wanting to be, what can I do?

Above I show how to tell whether or not you appear on any lists — check that frequently if you are concerned about which lists you appear. Currently Twitter users can add anyone that is not blocking them to a public or private list of their own choosing. So if you do not want to be on a particular list I recommend first trying to contact the list curator to have you removed. If that does not work, the more extreme step of blocking the list maker will remove you from any list you on which you do not wish to appear. Blocking is considered extreme and even rude, so use this as a last resort.

I want to use this new, powerful research tool – how do I get started?

Due to my concern over the average Twitter user I’ve focused on the worrisome aspects of Lists in this blog post. I care that people not be surprised about the changes to Twitter due to Lists and that’s my main focus here. However, Lists are powerful for reading as well. The best place I’ve found to begin exploring Lists is a third-party website specializing in Lists: listorious.com. On Listorious the top lists and list makers are curated and made searchable. Spend some time there to find lists that interest you. Once you find interesting lists and follow them think of the lists you would like to create and start making your own. Do be polite and sensitive to others that you list. Blocking may be considered rude but adding people to a list they do not want to be on can be hazardous to them, personally.

Filed Under: General, How-to, Tech, emerging media

CodeOffsets.com: A bad idea for solving a real problem

December 7, 2009 By rjamestaylor

CodeOffsets.com aims to assuage the guilt of programmers for bad coding practices by allowing offenders to contribute money towards quality open source projects. From their own webpage:

The Bad Code Offset provides a convenient and rational approach for balancing out the bad code we all have created at one time or another throughout our lifetime—even when we can’t go back and fix it directly.

As a programmer I find the idea of code offsets offensive and near to insulting.

The best way to solve bad code is to report it (if not open source) or patch it. If a project is unwilling to fix it, quit using/recommending it.

Some have suggested that Code Offsets are really a ironic joke about the similar fallacy of carbon offsets (or religious indulgences which predate both).

Better efforts included the re-write of Matt’s Scripts archive, which were security-riddled perl-cgi scripts popular in the early days of the web. The project called “Not Matt’s Scripts” aimed to be drop-in replacements for these buggy scripts used on sites everywhere. Matt even endorsed the project (mostly)!

I personally wouldn’t want to participate in a project that assuages guilt without solving the real problem! Fix the code or ditch it!

Filed Under: General, Tech, scams

noVIMber: VIM support for scripting languages

December 1, 2009 By druzziel

Thanks everyone for reading along. I hope you’ve enjoyed reading these
tips as much as I’ve enjoyed writing them.

For the last installment, I wanted to share a very cool feature in VIM
that I am just beginning to learn how to use. VIM provides support for
Perl, Python and Ruby so that you can use these languages to create
functions in VIM.

I’m most familiar with Python myself, so here are a couple of examples.
In VIM, try the following:

:python print "Hello world"

You’ll see ‘Hello world’ show up in the status line at the bottom of the
screen. Cool, but not all that handy (though you can use this as a
quick calculator, e.g. :py print 256 * 8 ).

To actually get Python to do something interesting with the contents of
your editor, you can define a VIM function that uses Python to do the
heavy lifting.

Here’s how:
:function! PySort() python << EOF import vim b = vim.buffers[0] x = b[:] x.sort() b[:] = x EOF endfunction

The :function! line begins a function definition. VIM has its own
internal scripting language, which is swell and all, but if you already
have familiarity with one of the other supported languages, you can use
that language to get a jump start on seriously tricking out VIM.

The line:

python << EOF

tells VIM that we’re defining a block of Python code. The block will
end with the line “EOF”. The enclosed lines are pure Python.

First, we import the vim module:

import vim

Now we have access to that module’s components, like the buffers[]
list. Just like in normal Python, buffers[] is zero-indexed, so
buffers[0] is the first buffer.

Next, we copy the contents of b as a list into the variable x:

x = b[:]

Then we sort that list alphabetically:

x.sort()

Then we replace the current buffer with the sorted context of x:

b[:] = x

And voila – you can now sort the current buffer alphabetically by
calling the PySort() function:

:call PySort()

This is just a trivial example, but hopefully it gives you some ideas of
what can be done with Python (or Perl, or Ruby) inside of VIM.

To get more information about using scripts in VIM, try the following
help commands in VIM:

:help python-vim
:help perl
:help perl-using
:help ruby-vim

Thank you all for reading. Anyone interested in exploring any of the
topics discussed in this or previous tips should feel free to contact me.

Happy VIMming!

- David Roth

Filed Under: Guest Articles, How-to, Linux, Tech Tagged With: guest, vim

R James Taylor