Due to reasons unknown to me (but undoubtedly involving politics and gerrymandering), when the light rail was extended to Hillsboro several years ago, everything west of the zoo was put into zone 3. There are no zone 2 stops between the last stop on the west side (Sunset transit center) and the zoo stop halfway through the west-side tunnel (which is in zone 1).

What this means is that anybody buying a ticket out in Hillsboro is going to need either a one-zone ticket or a three-zone ticket. There are no possible destinations from Hillsboro that would require a two-zone ticket.

However, the ticket machines at these stops only sell two- and three-zone tickets! I hope there's some other explanation, but it certainly seems like Tri-met is ripping people off. The amount is small (the one-zone ticket is only five cents cheaper), but the principle of over-charging is the same nonetheless.

I need to purchase a three-zone ticket anyway so this doesn't affect me directly. But I am curious as to why such a blatant error/oversight persists.

Many people think that manual verification hurts usability unnecessarily since, in their eyes, MITM attacks are very difficult to do. Their reasoning is as follows: It's extremely unlikely that an attacker would be present at the exact moment in space and time when the end user performs the security pairing. Therefore we really don't need MITM protection.

However, the more paranoid members of our team correctly pointed out that it would be trivial for an attacker to simply jam the transmission of one of the devices. The connection would then stop working. When faced with this situation, most users "reboot" the devices and perform the pairing ritual again.

We ended up including fairly robust protection against MITM attacks. Which is a good thing, since a recent article discusses how easy it is to force a Bluetooth device to dump its pairing data and initiate the rekeying process. This attacks the protocol directly and is even easier to accomplish than the denial-of-service-type jamming attack that we were concerned with.

First: MySQL only supports constants in default clauses. In other words, this is forbidden:

 create table times ( time1 datetime default now(), time2 datetime default now() );

Things are even more complicated when you look into why MySQL has the very confusing situation of a datetime type and a timestamp type. And, in my opinion, the MySQL documentation on the subject is poorly formatted, at least in comparison to PostgreSQL's documentation.

Second: MySQL date/time fields don't support microsecond resolution! Aye-yah. Yet another feature that needs to be handled in application code when it really belongs in the database.

Third: The MySQL time zone support seems very clunky to the point where it's easier just to store everything as GMT and handle conversions at the application layer.

PostgreSQL handles all of these issues no problem.

Up until now, the venerable gmaps-pedometer had been my favorite way of conveying this information, but I'm switching to Bikely! It has a few areas for improvement (such as its search) but development seems active so I'm sure they'll get resolved.

I am hooked after using it for a couple of months. When I free up some project time, I am going to contact the author and see if he is interested in some collaboration opportunities. One thing I could help out with is a Windows Vista sidebar companion gadget.

At first, I didn't understand what exactly EC2 was. The Amazon promotional material could be a little more clear in this area. It's a virtual machine (what I refer to as a slice, Amazon calls it an instance) that is billed out by the hour (real world time, not CPU-used time). It has an impressive set of client command-line tools that let you control your slices from any Windows or Linux box on the Internet. Everything uses public key cryptography.

To get started, Amazon has an online forum that offers free, pre-configured instances. They have all of the Linux flavors, Solaris, OpenBSD, etc. I found a slimmed down version of Gentoo enabled with PHP and Apache2 and was up and running in under 5 minutes.

Another cool concept that Amazon has is the ability to purchase IP addresses and them route them to any machine on the EC2 network. Amazon calls this concept "elastic IP addresses". All of your instances run with private IP addresses on the Amazon network. For them to be accessible to the outside world, you use the client tools to connect your public IP address with the private one. One of the obvious advantages of doing this is that it makes it extremely easy to re-route your traffic to a different instance any time you want with zero DNS downtime.

Getting back to instances, they are ephemeral in the sense that when you shut them down, they are gone forever. I figured this out the hard way when I configured an instance to serve up a custom web page, shut it down, and then started it back up again and discovered that my changes were gone. If you want to preserve any changes you made to the pre-configured image, you need to store them on Amazon S3. Luckily, Amazon provides tools to make this very easy to do.

In addition to getting up and running very quickly with minimal capital, AWS provides essentially unlimited scaling. Read this blog post about Animoto's launch of their Facebook app for a case study. SmugMug is another good case study.

One interesting facet of Amazon's web services offerings is the ecosystem that's starting to build up around them. Look at RightScale as one example of a company offering value-added services to AWS.

All in all, a very impressive offering: compute, storage, queue, database, and (with third-party help) scaling. Everything you need to launch whatever you want to.

But you do pay for everything: Instance time, data transferred in/out of AWS, storage. I estimate the minimum monthly cost of a basic instance at around $100. Still dirt cheap compared to buying your own equipment for colo, but not as cheap as Slicehost or some of the other VPS vendors (around $20 including quite a bit of bandwidth and a fair amount of storage).

Interested in starting your own EC2 instance? These may help: link1, link2

Next up on my to-investigate list: Google App Engine.

Unfortunately, like all Firefox upgrades, there are quite a few of my favorite add-ons that are no longer compatible. Hopefully they will be updated soon, because now that I've used FF3 for a few days, there's no going back now!

Navigon 2100 GPS

Two unique Navigon features are lifetime free map updates and an awesome highway interchange mode that makes it easy to determine which lane you should be in. It also has an excellent three-dimensional "reality view" which is extremely intuitive.

This unit pretty much does everything that I would want a GPS to do. Some more points of interest would be nice, but at this price point, I really can't complain! Highly recommended if you are in the market for a GPS unit for your car.

Update: Oops, my bad. Turns out the Navigon doesn't have free map updates after all. It does have free software updates, but probably most of the other GPS manufacturers offer that also.

Trek's bicycle warranties are great, but I'd recommend against buying any of their accessories due to this very poor warranty policy. Other companies (like SunLite Cycling Gear) have lifetime warranty on all of their products. Either that, or buy the Trek stuff at REI so you can return it when it breaks :)

Overall, a very well-organized event. I would definitely ride it again (although I should probably do a little more pre-training next time). This ride was an eye-opener for me that the Seattle-to-Portland ride is less than two months away. I really need to up my training game if I'm going to make it in one day.

We saw shorts on kite snowboarding in Finland ("Entropy"), crazy mountain biking in British Columbia ("Trial and Error"), rock climbing in England, and ice climbing in abandoned Swedish mines. The feature was a documentary called "20 Seconds of Joy" on a Norwegian woman's addiction to base jumping.

Although quite long at almost an hour, I thought "20 Seconds" was an excellent insight into adrenaline addiction. The other films were fine, but I missed the fun-loving/humorous element from previous festivals (anybody remember the rock climbing dog?).

I wish the Banff folks would find a way to publish an annual DVD series so we could see more of the submissions! One night is not enough...

I always knew this was possible, but I was surprised by just how easy it was.

This is probably a good time to extol the virtues of encrypting your data...

Unfortunately, I'm already falling behind the recommended training schedule...

We use Yahoo Groups for our condo messages, so I checked there to see if it had something that could do the job. Yahoo Groups does offer a "monthly periodic e-mail feature", but it is fatally flawed in two ways. First, it doesn't appear to work. Second, it doesn't let you specify when the message will be sent.

Fearing that I might have to write something up myself to solve this problem, I first started searching around for a solution. I was pleasantly surprised to find Letter Me Later. It's great! Perfect solution, very configurable, yet still easy to use. Check it out if you ever find yourself needing an automated e-mail scheduling service!

In any event, it's available on the WiMedia web site if you're interested (unfortunately there is a click-through license agreement that you must fill out to read the spec). I worked on the security sections, sections 6.6 and 7.2 and annexes A and C.

The Prestige ***** : Highly confusing but ultimately very rewarding film. Told in reverse, Memento-style. A second viewing is revealing and enjoyable.

Phase 1, the original sites: Static content only.

Phase 2, not long after phase 1: Script-generated (usually Perl) static content on my home machine, pushed by cron job to my web host. Still no Javascript.

Phase 3, about five years ago: As little Javascript as possible, but heavy reliance on server-side scripting such as CGI, Perl, and PHP. I used to feel that Javascript support in browsers was too inconsistent to be used effectively. Then Google Mail and Google Maps came along and showed everybody how things should be done.

Phase 4, about two years ago: Not wanting to become locked in to a particular toolset, I eschewed Javascript frameworks like Prototype. I coded all Javascript myself. This was often a laborious task given the lack of good debugging tools and also the infuriating inconsistencies between browsers (of which IE6 is far and away the worst offender).

Phase 5, about one year ago: Finally bit the bullet and adopted the Prototype framework. Life got a lot easier, but Prototype itself doesn't do all of the Ajaxy things that I like to do (like auto-complete-as-you-type, light boxes, fade effects, and so on). So I started layering different libraries, including Scriptaculous and MooTools.

Phase 6, about two months ago: I've found religion, and its name is JQuery. JQuery's elegance is so beautiful that it almost makes me want to cry. The documentation is outstanding. And it encourages community support through plugins, which quickly become indispensable -- stuff like auto completion, rounded corners, table sorters, tooltips, calendars, etc. And because the plugins are all based on the common JQuery foundation, they usually play nicely with each other. I'll be posting soon about how JQuery has made life much easier for me. In the meantime, I'm busily migrating all of my sites to it.

Related links: Why JQuery's Philosophy is Better, JQuery - Javascript that doesn't suck!

My 2007 in cities (in approximate chronological order):

• Las Vegas
• Jackson Hole, Wyoming
• Palo Alto, California
• Barcelona, Spain
• Brussels, Belgium
• Hannover, Germany
• Beijing
• Waterloo, Canada
• Toronto
• Montreal
• Los Angeles
• Bend, Oregon
• Government Camp, Oregon
• Smith Rock, Oregon
• San Francisco
• Amsterdam
• Scottsdale, Arizona
• San Jose, Costa Rica (*)
• Agujitas, Costa Rica
• Monteverde, Costa Rica
• Fortuna, Costa Rica
• Montezuma, Costa Rica
• Howey-in-the-Hills, Florida
• Palm Beach, Florida
• Jacksonville, Florida

One feature I really like is the ability to make local commits to a repository and then ship out all of the changes at once to other users (or to a central repository) in a single changeset.

Another cool feature is being able to rollback mistakes. And having an automatic repository wide id with each commit eliminates the need to tag all the time like in CVS.

This presentation at Google from a Mercurial developer is very good. Also, this talk from Linus on his revision control software, git, is good at explaining why you should upgrade if you are still using CVS or SVN. I wish I had switched a lot sooner.

Here's another good piece on git vs. Mercurial vs. SVN.

Venus Prime 1

To Sail Beyond the Sunset ** : Heinlein is either a genius provocateur or just a dirty old man. Either way, this book didn't take for me.

Revolt in 2100 *** : Classic Heinlein space opera pulp fiction. Overly simplistic and unrealistic solutions to social problems, but it's fun reading.

Boondock Saints **** : Willem Dafoe shines in this zany retribution movie.

Man on Fire *** : Denzel does a nice job in this kidnap-thriller-whodunit based in Mexico City.

After much experimentation, I finally figured it out:

import getpass, imaplib

M = imaplib.IMAP4_SSL( 'localhost' )
M.login(getpass.getuser(), getpass.getpass())
M.select( "INBOX.GmailMirror" )

typ, data = M.search( None, '(SENTSINCE "1-Jan-2007")' )
for num in data[0].split():
  typ, data = M.uid( 'FETCH', num, '(BODY[HEADER.FIELDS(FROM)])' )
  try:
    print data[0][1].strip()
  except TypeError:
    print data

M.close()
M.logout()

Speaking of astronomy, Mars is in opposition right now, which means that it is as bright as it is going to get for 26 months. Go outside on a clear night and take a look!

My position is that the future of global pollution control lies solely in China and India. In order to fuel their economic ascendency, these countries are trashing the environment. A New York Times article entitled Pollution From Chinese Coal Casts a Global Shadow is over a year old but still provides a good summary of the situation.

J.S.'s position is that it's hypocritical to judge China and India when we in the United States are flagrant abusers of electricity. Further, we are tacitly implicated since our addiction to low-cost imports from China provides the demand that fuels their consumption.

Recent numbers on global electricity generation from the Energy Information Administration do support J.S.'s claim. In 2004, the United States produced 3.979 trillion kWh of energy for 303 million people, or 13,405 kWh annually per capita. Europe's population of 492 million people consumed 3.443 trillion kWh, or 7,089 kWh annually per capita. Which means that Europeans use about half the power of Americans per capita. And at 1,795 kWh annually per capita (2.080 trillion kWh for 1.320 billion people), China uses about one-seventh the power that the U.S. does per capita.

But none of this math really matters. In the US and Europe, both the population and manufacturing base are well established, stable, and slow-growing. This means that power consumption won't grow much either. And while it may be hypocritical to tell others that they need to curtail their power consumption while not following that same advice, it doesn't change the calculus. If China and India don't change their plans, then what the US and Europe do is irrelevant.

So what do we do about it? The NY Times article makes some suggestions. Subsidizing coal scrubbers and more efficient power plants in China and India is a good place to start. Nuclear power is an oft-overlooked but balanced solution that unfortunately will probably fall victim to politics. A tariff on imports from countries with poor energy generation practices would certainly be controversial. Certainly reducing our own per capita energy consumption in the US as a symbolic gesture wouldn't hurt.

But we do need to start the conversation... soon!

Collateral *** : Decent enough movie, but it's no "Leon". I just can't see an assassin even accepting a job like this.

911 In Plane Site * : Wish I could give it a lower score, but one star is the lowest in my system. What's most scary about this movie is its incredibly high IMDB rating.

8-Mile **** : Eminem's early days.

Derailed *** : Ransom movie with a twist, watchable if you can cope with highly unrealistic behavior.

In an attempt to minimize this debugging time, I set out a while back to find a lint program that would check for bad coding practices. I found JSLint, but quickly learned that it is far too picky on what it reports as problems. For example, it will report the instantiation of a class if it hasn't been assigned to a variable:

 new Ajax.Updater( ... );

 var j = new Ajax.updater( ... );

This is perfectly legal Javascript and often a good idea. For example, when using Prototype, the Ajax.Updater class doesn't return anything useful. There were numerous other bogus warnings from JSLint.

I also wanted to integrate Javascript checking into my local build environment. Since JSLint appears to be online only, this was not convenient.

Recently I found JavaScript Lint, a command-line tool that does exactly what I need. It comes with an extensive configuration file that lets you control exactly which warnings you want to suppress. So, for example, I don't like warnings complaining about missing semicolons at the end of lines as this is perfectly legal in Javascript! But I do want warnings about variables that are used without being declared first.

Check it out if you program Javascript!

This is a classic example of a bad class action law suit. I feel bad for Seagate. They are no different than every other hard drive manufacturer in representing 1 GB as 1000^3 bytes instead of 1024^3 bytes. Using the SI prefix instead of the historical computer system increases the size over what's reported in Windows and other operating systems by about 7 percent. And I think it's the right thing to do.

At one time in computing history, it may have made sense to stick with 1K=1024. Back then, memory and storage were scarce. And people did very low level programming where they needed to know about every last byte. But nowadays, most of that is abstracted away from us. And given the ever increasing role of the metric system in the world, we really need to stop this archaic practice.

I've written previously about how 1 kbps continues to be misrepresented as 1024 bits per second, when it is really 1000 bits per second. Google still hasn't fixed this. Nevertheless, in the networking world, 1K=1000. The IEEE agrees as well.

We also have the new KiB, MiB, etc., units, which provides a solution for people who want to stick with power-of-two based units.

For the rest of us, let's get with the SI system and make 1 KB = 1000 bytes, 1 MB = 1,000,000 bytes, etc.

Getting back to the lawsuit, I find it hard to believe that the lead plaintiff was in any way hurt or negatively impacted by Seagate's representation of GB as 1000^3 instead of 1024^3.

Sadly, after reading the class action lawsuit web site, it seems that Seagate has already settled. I'm sure this makes sense for them as litigation is costly. Nevertheless, I would have liked to have seen them fight the good fight.

The lead plaintiff gets $5,000. The lawyers get $1,792,000. Since I have purchased five or six Seagate hard drives during the period in question, I am eligible to receive about $100 back if I wanted to. But I'm not going to file a claim. It just seems wrong.

The Holiday *** : Lots of big names in this light romance.

Fast Food Nation **** : Fictionalized adaptation of the book. Lots of cameos. Good.

Borat ** : Disappointing. The original HBO series was so good!

When the requests come from regular ole' people, things are easy. When they're from companies (old world media like television stations), things get complicated because they want me to sign legal paperwork giving them rights to the picture. Since I'm giving away the pictures for free, it really annoys me to have to parse the legalese, fill out paperwork, mail it to them, etc.

So I decided to make my first contribution to Wikimedia Commons: Shingles on the chest, released under the GNU Free Documentation License or Creative Commons 3.0 (share or remix allowed with attribution). Hopefully this will satisfy and future comers so I don't need to sign any more contracts!

This YouTube video shows two of the stepeest road rides in Portland. (The video would benefit from some liberal editing. Don't be afraid to fast forward.) They may even be the steepest. I rode both of them a few weeks ago with my biking buddy Kurt.

The first, College Street, is located just behind our condo. The grade is 18 percent. I had to stop once. With sufficient training, I could see myself nailing this one some day.

A couple of days later, Kurt suggested we try Brynwood, located off of Skyline. At 20 percent grade, this one is even tougher than College St (and longer to boot). I don't know if we were still recovering from the previous weekend's attempt up College, but Brynwood stomped us. I had to stop twice, the second time because my heart was almost 200 beats per minute. I don't know if I'll ever be able to do this one without stopping.

The line has been drawn in the sand for next year!

Scoop **** : Quirky Woody Allen movie with Scarlett Johansson.

Pan's Labyrinth ***** : Muy bien! Best movie I've seen in a long time. A great metaphor for Spain under Franco.

Saw III **** : Still dark and twisted, still strangely entertaining.

Flags of Our Fathers *** : A little disjointed and hard to follow; not as good as its partner movie, "Letters From Iwo Jima".

A Random Walk Down Wall Street

The book pretty much fortifies the investing axioms that I have been following for the past several years, but presents a ton of data to back up the claims, which are:

• The ability to consistently beat the market average is rare.
• The only way to get higher returns is to take higher risks.
• Diversification smooths out the volatility inherent in risky investments.
• The semi-strong efficient market hypothesis is the most credible of all the market theories.
• Your life stage defines your risk tolerance (with younger people able to handle more risk).

• 5% cash. Or cash equivalent, interest bearing (of course).
• 20% bonds. Three-quarters comprised of zero coupon treasury or no-load bond funds. The rest inflation-protected (TIPS). Put in tax exempt account if possible, otherwise try and use tax-exempt funds.
• 65% stocks. Two-thirds comprised of total stock market (Wilshire 5000), the rest international and emerging markets.
• 10% real estate. No-load REIT fund.

An article from Sun entitled Preparing for the End of IT as We Know It makes the case much more eloquently than I could have: "We at Sun have concluded that the time is fast approaching when competitive enterprises will move to a model where they run secure, network-based services instead of their own applications, datacenters, and networks."

(Thanks to Mathew Eszenyi for the link!)

Bottom line: I no longer feel like I can trust my money with FNBO. It's amateur hour over there. Time to get out!

It would have been easy to have just made the gadget box bigger and added more drives. But I wanted to do it more elegantly and have the gadget grow and shrink and only use as much space as necessary. (As a side note, all Vista gadgets have a minimum height of 57 pixels, and it's not possible to shrink them less than that.)

Not having seen many gadgets that automatically change size, my usual method of just looking at how somebody else did it wouldn't work. I had to figure it out for myself. After many hours of experimenting, I finally ended up doing it as follows:

First, I inserted a <g:background> tag into the main body of the gadget:

<g:background id="background" src="images/background-black3.png"/>

The background image background-black3.png needed some work as well. Initially, it had a shadow and transparent border around it, but this caused problems when the image was stretched. To work correctly using this method, the top and bottom of the background image must be opaque.

With this tag in place, the following simple lines of Javascript change the gadget's height:

 var heightInPixels = 100
 document.body.style.height = heightInPixels
 background.style.height = heightInPixels

My actual code was a little more complicated in that it used the number of drives to figure out how high the gadget should be. But you get the idea. And you can download the actual gadget and look at the code if you want to learn more.

• Users will enter their passwords even when HTTPS indicators are absent
• Users will enter their passwords even if their site authentication images are absent
• Site authentication images may cause users to disregard other important security indicators
• Role playing has a significant negative effect on the security vigilance of study participants
• 36% of study participants who were using their own personal banking account chose to login after seeing an explicit warning page saying that the connection was probably insecure

One of the most unpleasant tasks is making a good-looking, standards-compliant web design that works on all browsers. Far and away, the most annoying browser is Internet Explorer 6. Stuff that works fine on Firefox, Opera, Safari, and even IE7 just does not work on IE6.

I wish I could just say "to hell with IE6" and not support it, but according to Google Analytics, over 70 percent of Trainster users are using IE6. So like it or not, I am stuck with making it work.

Last week, I tried out Trainster on Safari for the first time. Like Opera, Safari is a very strict browser when it comes to interpreting HTML, so it is good for testing out a site. If it works with Opera/Safari, it should work with anything. I found a few problems, further confirmed by the excellent W3C Markup Validation Service.

Thinking that standards compliance would solve all of my problems, I set out to make all of Trainster HTML 4.01 strict. It took a lot of work, especially since there are a lot of little nitpicky things that one needs to do in order to be HTML 4.01 strict. But I slogged through it, and Trainster is now HTML 4.01 strict (yay!). And strict compliance did fix everything... except for IE6. A few hours after pushing the changes live, complaints started to roll in from IE6 users saying that the site was all messed up.

Mind you, it is not that easy for me to test IE6. You can't even run IE6 on Vista, so I had to install Virtual PC 2007 and download a special virtual machine from Microsoft Support that has Windows XP with IE6 on it. And sure enough, once I loaded it up on IE6, the site didn't look right.

Fast forward over two hours of pulling my hair out trying to figure this out, and it turns out I was bitten by the IE6 xml prolog "feature". Any seasoned web developers out there are probably nodding their head in sad agreement at this point... For those who don't know, if you have this one innocent-looking line at the beginning of your HTML page:

 <?xml version="1.0" encoding="iso-8859-1"?>

Then IE6 will disregard any specific DOCTYPE instructions that you have otherwise given and render the page however it sees fit (called "quirks mode"). ARGGGHHGGHHHHHH! Luckily this behavior has been removed for IE7. So I removed the line and all is well.

I'm not sure what the point of this blog entry is, other than to vent a little bit and perhaps save some other poor soul from suffering the same fate some day.

Get Rich With Options

Here are the book's take-aways so you can get rich and profit. Of course, the usual investing disclaimers apply. If you go broke following this advice, don't blame me. If, on the other hand, you get rich... you can buy me lunch.

Sell slightly out-of-the-money covered calls on your long stock positions. This is the one that most people already know about. The vast majority of calls expire without being assigned, so most likely you will get to pocket the premium. If your stock does get called away, then you at least got to sell your stock for a decent price.

Buy deep-in-the-money calls instead of buying a long position in a stock. The call will track the stock's market value, which translates into a higher ROI if the stock rises and less risk if the stock drops.