My Hotmail account was hacked last week. Very embarassing--I have never had an account hacked before because I use decent passwords and I avoid viruses by not clicking through on strange links and using a Mac. The hackers sent out a link to an online pharmacy, though I suspect the linked page is also use to spread malware. I was able to send out a follow up email within 2 hours to let people know to delete the email, and, fortunately, I don't have a lot of addresses in my hotmail addressbook. My aunt had it even worse--I saw 4 or 5 emails from her account, and she struggled to regain control of it and is now just going to shut it down.
It got me thinking about security, both virtual and physical.
On the virtual side, the long held belief is that a strong password will keep you safe. That is apparently not true, as I just learned. But the reason why is a bit annoying. Hackers use "dictionary" attacks on popular web services, where they just bang on an account trying thousands (hundreds of thousands, actually) of combinations.
The most sophisticated tools (eg. L0phtcrack), easily available online, can crack 25% of passwords in seconds, and can try 17 BILLION combinations an hour. An 8 character password with a combination of letters, numbers and special characters (eg. asterisk, dash, underscore) has only about 100 billion different combinations. So, if someone really wants to crack your account, they just need a few hours. Presumably, the hackers just spend a few seconds to get the easy accounts. The password length I had been using, a mere 6 digits, had only 45 million combinations. I do use longer passwords on my more important accounts, but Hotmail is mostly for spam anyway, so I never upgraded the password.
The real problem here is obvious, but few ever mention it. Why do Hotmail and other services allow hackers to bang on the door thousands of times? If you blow a password 10 times in a row, your account should be locked. Then a simple, easily remembered password would be perfectly adequate.
The problem here, and I suspect why the web services do not enforce this, is that if hackers are banging on Hotmail all the time, thousands of users will be locked out every day, generating an enormous amount of traffic to customer support. Very sensititive systems such as SaaS ERP do enforce a limited number of tries, but they have a small number of users and an enormous reputation problem if they are cracked.
So, perhaps the solution is multifactor authentication. Not the physical token systems that you see some corporate users carrying around, but merely a second layer of security. You could have a password that gets you to the second layer, which would require you to pick out a face or picture from a matrix of options. The human brain is particularly good at remembering faces. Because you can only present 15 or so options, it is really not adding that many combinations, but it would definitely help, and the fact that it eludes keylogging software is a definite bonus.
[UPDATE 9/20: Google just released two factor authentication for Google Apps accounts. It uses a smartphone app to generate an authentication code that is the second step of the process (replacing a dedicated fob such as used by Verisign systems). I am feeling rather pleased with myself for being one day ahead, for once, instead of the reverse.]
So, "strong" passwords present the illusion of security, but in reality are just a slightly higher fence. That works for random attackers, but not an attacker that might be targeting you.
Many physical security measures work on the same principal--you don't have to outrun the bear, you just have to outrun your friend. But if someone is targeting you specifically, you are in trouble. This is where things like airport security often fall down. They annoy the casual traveler in the name of protection, but fail to deter the dedicated attacker.
The auto theft statistics for 2009 show almost a 25% drop in theft from 2008--a big decrease. But they also show a drop in the recovery rate. Basically, the casual thief is deterred, but the pros are still doing fine.
The most effective part of a home security system is the sign out front. Casual thieves move on to your neighbor. If you are targeted by pros, then you had better installed something a bit heavier duty than ADT.
Friday, September 17, 2010
Thursday, September 2, 2010
Google Priority Inbox--the end of Serendipity?
First off, I am in the Google ghetto, as apparently the only person for whom Google has yet to turn on the Priority Inbox feature. I even pay for a premium account, and still I am not cool enough.
People in the tech industry, whether entrepreneurs, investors, business development or whatnot, suffer famously from email overload. I use a tiered system of email accounts to deal with it and prioritize emails.
It is hard enough to get noticed as an outsider when you send an email, but it is possible with a pithy subject line and succinct opening paragraph. Now, you are at the mercy of the machine. Is there going to be an SEO business for emails to try and find your way into the priority inbox? For many harried execs, an email in the non-priority queue might as well be in the spam folder.
Is this the end of the serendipitous connection? Does that matter? Are we now doomed to insularity?
It certainly means that having a warm introduction to a targeted contact is more critical than ever. It also means that the conference business is going to see a rebound, because you need to find your targets in person, not digitally.
People in the tech industry, whether entrepreneurs, investors, business development or whatnot, suffer famously from email overload. I use a tiered system of email accounts to deal with it and prioritize emails.
It is hard enough to get noticed as an outsider when you send an email, but it is possible with a pithy subject line and succinct opening paragraph. Now, you are at the mercy of the machine. Is there going to be an SEO business for emails to try and find your way into the priority inbox? For many harried execs, an email in the non-priority queue might as well be in the spam folder.
Is this the end of the serendipitous connection? Does that matter? Are we now doomed to insularity?
It certainly means that having a warm introduction to a targeted contact is more critical than ever. It also means that the conference business is going to see a rebound, because you need to find your targets in person, not digitally.
Review--Speedplay Pedals
I decided to try Speedplay Zero pedals a few months ago, because I moved my cleats back a touch on my Specialized shoes and could not duplicate the position on my Sidis. Sidi apparently has not gotten the memo that we are all moving our cleats closer to the arch of our foot--your calves are not that strong, so why engage them so much? I also find that my left foot is finicky and inconsistent about the lateral angle it likes to pedal at. My heels are closer to the cranks, but my left foot is more so, and it seems sometimes like I am pushing against the limits of float on the Shimano Dura Ace pedals I normally use. Finally, I am retarded when trying to get into my pedals at the start of a race. I can be relied upon to fuss around for a few seconds trying to get in while everyone else takes off.
Oh, and Spartacus uses Speedplays.....'nuff said.
Speedplays are renowned for their adjustability, and having a 2-sided pedal makes it easier to get into. They are a bit lighter and allegedly more aero, but I really did not care about that.
So I bought some. Turns out that I still could not get the cleats mounted far enough back. No problem--some hunting and $40 and I found the extended base plate that gives a ton of fore-aft adjustment. Oh, and another $40 for some angled wedges. That makes the total investment a bit pricey. I purchased the Stainless axle version of the Speedplay Zeros, as they are much cheaper than the Ti, and stiffer and more durable.
I have been using the Speedplays on my carbon bike, which I have ridden most of the time recently, but I am still putting in days on my Ti bike with the Shimano pedals.
I definitely like the new cleat position....it just feels very natural. Remember that you have to bring your saddle height down if you move your cleats back.
On the bike, I like the Speedplays a lot. Engagement is a bit easier, though not foolproof. I still manage to miss sometimes, and when you do, the consequences are more catastrophic that with the Shimanos because your shoe flies off the pedal. The feel is a bit odd, because there is no resistance to the float. At least with the Zeros you can set the limits of the float, but there is a bit of an ice rink feel, though I quickly adjusted to that.
The Speedplay design is different in that it is the reverse of most pedals--the retention mechanism is on the shoe, not the pedal. Effectively the pedal is the cleat.
The cleats are a pain. I have already had them come loose twice and slide laterally. If you tighten them too much, then they don't work properly because you create too much friction for the ring that is the retention mechanism. I tightened them to the torque spec but even with the threadlock on the screws they don't appear to want to stay in place. So, I finally just overtightened them and accepted slightly balkier function.
You need to keep debris out of the cleats, and the cleats are metal, so they are slippery to walk on. That means you really need cleat covers, which are a pain.
The Shimano cleats, by comparison, are just easy to deal with, and you can walk for miles on them.
For the riding I do, which involves a lot of walking around in coffee shops, I think the Shimano pedals work better. If racing performance is a priority or you have fit issues, the Speedplays get the nod.
Oh, and Spartacus uses Speedplays.....'nuff said.
Speedplays are renowned for their adjustability, and having a 2-sided pedal makes it easier to get into. They are a bit lighter and allegedly more aero, but I really did not care about that.
So I bought some. Turns out that I still could not get the cleats mounted far enough back. No problem--some hunting and $40 and I found the extended base plate that gives a ton of fore-aft adjustment. Oh, and another $40 for some angled wedges. That makes the total investment a bit pricey. I purchased the Stainless axle version of the Speedplay Zeros, as they are much cheaper than the Ti, and stiffer and more durable.
I have been using the Speedplays on my carbon bike, which I have ridden most of the time recently, but I am still putting in days on my Ti bike with the Shimano pedals.
I definitely like the new cleat position....it just feels very natural. Remember that you have to bring your saddle height down if you move your cleats back.
On the bike, I like the Speedplays a lot. Engagement is a bit easier, though not foolproof. I still manage to miss sometimes, and when you do, the consequences are more catastrophic that with the Shimanos because your shoe flies off the pedal. The feel is a bit odd, because there is no resistance to the float. At least with the Zeros you can set the limits of the float, but there is a bit of an ice rink feel, though I quickly adjusted to that.
The Speedplay design is different in that it is the reverse of most pedals--the retention mechanism is on the shoe, not the pedal. Effectively the pedal is the cleat.
The cleats are a pain. I have already had them come loose twice and slide laterally. If you tighten them too much, then they don't work properly because you create too much friction for the ring that is the retention mechanism. I tightened them to the torque spec but even with the threadlock on the screws they don't appear to want to stay in place. So, I finally just overtightened them and accepted slightly balkier function.
You need to keep debris out of the cleats, and the cleats are metal, so they are slippery to walk on. That means you really need cleat covers, which are a pain.
The Shimano cleats, by comparison, are just easy to deal with, and you can walk for miles on them.
For the riding I do, which involves a lot of walking around in coffee shops, I think the Shimano pedals work better. If racing performance is a priority or you have fit issues, the Speedplays get the nod.
Thursday, July 8, 2010
Top 10 Reasons I should make the Rapha Gentlemen's Ride team
The Rapha Gentlemen's Race is coming up in 5 weeks. Competition is hot for a place on the six man team. Here are the top 12 reasons why I should make the squad.
12. Gun Show. It's sketchy in the PDX.
11. This time, you won't have to push me 5 minutes into the race......I hope.
10. I will channel the Badger, and smite our enemies.
9. I spend so much time in my Pain Cave, I decorated it with Ikea furniture. Mmmmm, comfy.
8. Man beer.
7. I look good in pink.
6. I am great to draft off of, unless I have had a burrito.
5. I spent my kids' college fund at Studio Velo.
4. I wore out my Big Ring.
3. I am the only one who knows where we are going.
2. Rapha Whore.
And the #1 reason why I deserve to be on the team......I will not have to stop for refreshments during the ride.
12. Gun Show. It's sketchy in the PDX.
11. This time, you won't have to push me 5 minutes into the race......I hope.
10. I will channel the Badger, and smite our enemies.
9. I spend so much time in my Pain Cave, I decorated it with Ikea furniture. Mmmmm, comfy.
8. Man beer.
7. I look good in pink.
6. I am great to draft off of, unless I have had a burrito.
5. I spent my kids' college fund at Studio Velo.
4. I wore out my Big Ring.
3. I am the only one who knows where we are going.
2. Rapha Whore.
And the #1 reason why I deserve to be on the team......I will not have to stop for refreshments during the ride.
Monday, July 5, 2010
Tech Review - A week with the iPhone 4
So I went to the Apple store at 630am on launch day to see what the situation would be. It turns out that even in suburban Corte Madera, the situation was bad--hundreds of people lined up. I had not pre-purchased an iPhone 4 because, despite my love for my 3Gs, I just was not sure I wanted to commit to a new iPhone and another 2 years with AT&T.
Although, for as much guff as AT&T gets for its poor network, I have not had a remarkably better experience with Verizon. I use a Verizon MiFi data card, and it can almost always get a signal, but the speed is not impressive, and it drops out from time to time.
So I decided that a new phone was not worth waiting all day, and went off to do other things. On my way home at 330pm, I stopped by again to see what the situation was. The line for walk-up purchases had dropped from about 200 people to perhaps 60, so I thought what the hell, I will queue up for a bit.
After about 30 mins, the Apple store employees counted up the people lined up and compared it to their inventory of phones. I was to get the 2nd to last phone in stock, assuming I stayed in line. Hmm...they hooked me. But now the problem was that our line, though short, was not moving. I took 3 steps in 40 minutes. They were focusing on moving the line of people who had pre-purchased phones, which makes sense. I was further alarmed when I found out that the people just getting into the store in our line had been in line since 8am, 6 hours previous.
Hmmm. The right move would have been to leave and come back the next day at 8am to try and get a phone that had not been picked up by someone who pre-registered, but they had me hooked with the guarantee of a phone. The experience of being in line was not so miserable, so I made the classic error of factoring in the sunk costs of my time so far in line and stayed. The Apple Store employees brought us water, parasols, and even an iPhone cake! The people in line were pleasant.
So after 3 hours I finally got my new phone hotness. I had read by this time about the reception issues, but I always use a case anyway. Of course, I had failed to anticipate a major failure on Apple's part. If you can sell a flimsy piece of rubber for $29, why wouldn't you stock more of them? Seems like cranking out millions of them would not have been that hard relative to the miracle of manufacturing so many complex phones for the launch. And to exacerbate it, they are badly backordered online, and no one else has cases available. This is a byproduct of Apple's renowned secrecy, because case manufacturers are not sure of the exact dimensions until the launch (they only get cardboard mockups).
Anyway, I finally got my digital hotness home. I love the seamless experience of an Apple phone transfer. Plug it in to iTunes, wait 45 mins for 32GB of stuff to transfer, and you are done. So what do I think? So far, I am not impressed. It is a better phone than the 3Gs, but it is not a significant upgrade and it has some flaws.
It is faster, but not noticeably so. If you have a 3G, you might be more impressed. I really don't like the feel of the phone in my hand. It weighs the same and is smaller in every dimension than a 3Gs, but it feels awkward in the hand and pocket because of its sharp edges. Perhaps the case will sort this out. It is also symmetrical, so you can't grab it and know without looking at it which side the screen is on. The 3Gs has a nice organic shape that is more comfortable in the hand.
I prefer the old OS's double press shortcut to your phone favorites, which now brings up the multitasking menu. You should be able to set this function, but I have not yet found a way to do it.
The screen is nice, but I really did not struggle with the old screen and I reserve most of my reading for when I am in front of a much larger screen.
Facetime is an interesting feature, but not one that I will use. Perhaps if I traveled more. Sound quality on the phone is alleged to be better, but I have not done any real testing. I tend to use a bluetooth headset, and that reliably makes you sound underwater on any phone. I also have not done any real scientific comparison of photos and videos on the new phone. With a lens that is as small as a cameraphone's, you just will not get good pictures. Period. Even so, sucking less is a nice upgrade. If I know I will be taking photos, I bring my Canon S90.
Now, I could always return the phone (you have up to 30 days), but I don't hate it. I will keep it and stay with AT&T. Android phones occasionally tempt me, but their media management is piss poor compared to the iPhone. I will pay extra for a seamless experience, and iPhone/iTunes provides that.
Although, for as much guff as AT&T gets for its poor network, I have not had a remarkably better experience with Verizon. I use a Verizon MiFi data card, and it can almost always get a signal, but the speed is not impressive, and it drops out from time to time.
So I decided that a new phone was not worth waiting all day, and went off to do other things. On my way home at 330pm, I stopped by again to see what the situation was. The line for walk-up purchases had dropped from about 200 people to perhaps 60, so I thought what the hell, I will queue up for a bit.
After about 30 mins, the Apple store employees counted up the people lined up and compared it to their inventory of phones. I was to get the 2nd to last phone in stock, assuming I stayed in line. Hmm...they hooked me. But now the problem was that our line, though short, was not moving. I took 3 steps in 40 minutes. They were focusing on moving the line of people who had pre-purchased phones, which makes sense. I was further alarmed when I found out that the people just getting into the store in our line had been in line since 8am, 6 hours previous.
Hmmm. The right move would have been to leave and come back the next day at 8am to try and get a phone that had not been picked up by someone who pre-registered, but they had me hooked with the guarantee of a phone. The experience of being in line was not so miserable, so I made the classic error of factoring in the sunk costs of my time so far in line and stayed. The Apple Store employees brought us water, parasols, and even an iPhone cake! The people in line were pleasant.
So after 3 hours I finally got my new phone hotness. I had read by this time about the reception issues, but I always use a case anyway. Of course, I had failed to anticipate a major failure on Apple's part. If you can sell a flimsy piece of rubber for $29, why wouldn't you stock more of them? Seems like cranking out millions of them would not have been that hard relative to the miracle of manufacturing so many complex phones for the launch. And to exacerbate it, they are badly backordered online, and no one else has cases available. This is a byproduct of Apple's renowned secrecy, because case manufacturers are not sure of the exact dimensions until the launch (they only get cardboard mockups).
Anyway, I finally got my digital hotness home. I love the seamless experience of an Apple phone transfer. Plug it in to iTunes, wait 45 mins for 32GB of stuff to transfer, and you are done. So what do I think? So far, I am not impressed. It is a better phone than the 3Gs, but it is not a significant upgrade and it has some flaws.
It is faster, but not noticeably so. If you have a 3G, you might be more impressed. I really don't like the feel of the phone in my hand. It weighs the same and is smaller in every dimension than a 3Gs, but it feels awkward in the hand and pocket because of its sharp edges. Perhaps the case will sort this out. It is also symmetrical, so you can't grab it and know without looking at it which side the screen is on. The 3Gs has a nice organic shape that is more comfortable in the hand.
I prefer the old OS's double press shortcut to your phone favorites, which now brings up the multitasking menu. You should be able to set this function, but I have not yet found a way to do it.
The screen is nice, but I really did not struggle with the old screen and I reserve most of my reading for when I am in front of a much larger screen.
Facetime is an interesting feature, but not one that I will use. Perhaps if I traveled more. Sound quality on the phone is alleged to be better, but I have not done any real testing. I tend to use a bluetooth headset, and that reliably makes you sound underwater on any phone. I also have not done any real scientific comparison of photos and videos on the new phone. With a lens that is as small as a cameraphone's, you just will not get good pictures. Period. Even so, sucking less is a nice upgrade. If I know I will be taking photos, I bring my Canon S90.
Now, I could always return the phone (you have up to 30 days), but I don't hate it. I will keep it and stay with AT&T. Android phones occasionally tempt me, but their media management is piss poor compared to the iPhone. I will pay extra for a seamless experience, and iPhone/iTunes provides that.
Wednesday, May 19, 2010
They're not on dope, they're on rocketships.
[Update 5/20: Well, according to Floyd Landis, they are on dope.]
Your faithful cycling correspondent here again, the Ayatollah of Geek & Rolla! I made the arduous journey to the wilds of Santa Cruz yesterday to watch the Tour of Calfornia go over what has become one of its signature climbs--Bonny Doon.
Local boy Scott Zwizanski of Bissell came by between the chase group and the peloton, looking exhausted but focused. When I have ridden with Scott he never seemed to leave zone 2, so it is nice to see him suffering like a dog--I taught him that trick. One guy who did not look to be having fun was Andy Schleck, who looked like he had swallowed a live badger when he trudged by behind the peloton--he should have been hanging out in the party bus.
Your faithful cycling correspondent here again, the Ayatollah of Geek & Rolla! I made the arduous journey to the wilds of Santa Cruz yesterday to watch the Tour of Calfornia go over what has become one of its signature climbs--Bonny Doon.
The climb itself is about 7.5 miles and climbs from the beach to 2,000 feet. The bottom is really hard, with a long stretch (about a mile) of 10%+. Then it just climbs steadily for the last 4.5 miles.
I got the chance to do 2 trips up the climb before the pros arrived, which was an experience in itself. The fans packed along the side of the road were cheering for everyone riding up the climb. I was already tired from riding around Pescadero earlier in the day, so when I hit the 10% section, the legs started to scream. But when dozens of people are ringing cowbells at you and cheering, you don't think about how you feel. You just get out of the saddle and hammer, because this will not happen again.
Absorb the "Pro" moment. Cowbells, drunken fans, absurd costumes. Deep in the pain cave. Totally epic. For extra Pro credit, instead of falling off the bike at the top of the steep part, slam it into the big ring.
Sporadic cowbells for the next few miles, and then at the 1km to go sign, it got loud again. Big Ring. Thankfully it is not that steep, and I could fake it over the top.
Uhhm...the gorilla was clearly not impressed by my speed over the top. Presumably he got a bit more pumped for the pros.
I did not get photos of the crowded part of the climb, around mile 3 where it is steepest, but you probably saw it on tv. Because they closed the road while I was riding down after my second ascent, I watched at mile 4, where it is only about a 4% grade. I chose my spot because a resident had dragged their tv out to the street, so we could watch the live coverage while we waited.
They were hauling ass, even though at this point, Levi had decided not to push 100%. Looks to me like they are rolling in the low 20s.
Here comes the chase. You don't often see guys going uphill in the full aero position like the guy on the front here. I do it, of course, but mostly because I am too tired to hold myself up anymore.
Ah, finally. Here are some chaps I can appreciate. The "autobus" rolls by at a pace that seems more human. Chatting, smiling...looks like a party bus.
Local boy Scott Zwizanski of Bissell came by between the chase group and the peloton, looking exhausted but focused. When I have ridden with Scott he never seemed to leave zone 2, so it is nice to see him suffering like a dog--I taught him that trick. One guy who did not look to be having fun was Andy Schleck, who looked like he had swallowed a live badger when he trudged by behind the peloton--he should have been hanging out in the party bus.
Monday, May 3, 2010
Zero to Hero...by the numbers
I recently signed up for Strava.com, which is a very cool website that tracks your bike rides and allows you to compare them...both with your other rides and with other riders. It has a cool feature where it takes your GPS data and automatically computes your times and power outputs for various segments, like climbs.
So, I just uploaded more than a year of files from my Garmin, and I can see very easily how I have improved, and how I stack up against other local riders who are on the system. Of course, right now while there are not yet a lot of other riders on Strava, I look great. I am the King of the Mountain for the Marshall Wall! Suck on that, beyotches!
What is very cool, and super easy to do relative to other websites like TrainingPeaks, is to map your progress. Take the Hwy 1 climb from the Pelican, for example.....
It is clear that all the miles I have been riding seem to be helping with fitness. This would be more scientific if I pushed all out on this climb every time, but it usually comes at the end of a long ride. I tend not to slack on it, though.
We can see that my wattage has steadily improved and my times have plummeted. Interestingly, the top 2 entries show the power of weight. They may also show that I am not getting aerobically any better, but more on that later. In August 2009, I was probably 4kg heavier than I am now. There is an old saw in the pro peloton that 1kg is 30 seconds over a 30 min climb. The 2 entries show the same average heart rate and power, but 40 seconds faster over the climb. That is exactly what you would expect based on 10 seconds per 10 mins of climbing. Looking at this makes it really tempting to become a weight weenie.
So, I am not getting any fitter? Well, looking at another climb shows that all is going well on that front. There is no way to go easy up Panoramic from Stinson, and I tend to always do it at threshold.
On this climb, we see a nice progression. Not sure why I avoided it for almost a year...actually, I know why...it hurts. The latest time is a bit weird in that the power is the same, my weight should be the same, and yet I was almost a minute faster. One explanation is that the most recent effort was on my Time, which is stiffer, lighter, and most importantly, has a slightly more conservative power meter. The power for Apr 15 is (under)estimated by Strava...I was riding the Corvid prototype that day.
By the way, the little dots on the elevation profile are the relative positions of me and the KOM leader. You can track how you did against your previous efforts or others' efforts to see what strategy gets you up to the top fastest--start slow and accelerate? go ugly early? steady? spin or mash? stand up often or stay seated?
For me, Ulrich-style is the way to go. Steady, seated, patient. Ulrich was the Terminator of the peloton. He felt no pain, no remorse, no fear. He would keep hunting you forever. Of course, he was doped up to the eyeballs, but minor details.
So where do I stack up on Panoramic?
A distant second at the moment. I don't know who Jordan Kobert is, but I am guessing that he has no torso....just 2 huge frickin' legs with hands at the top to steer.
There is still some weirdness to the data. Take the climb from Fairfax to Pine Mountain, for example, which I used to use as a 20 min test.
Seems like the 2nd and 3rd fastest times had a lot higher power, and should have been fastest on a climb where wind is not really a factor. Here again, it might be the power meter. The fast time was on the Time with the SRM, and the other 2 times were on the IF with the Quarq. But either way, I was hammering for all 3 ascents and am a bit surprised by the times. I need to hit this one again hard in the near future on the Time and take it sub 15 mins. The KOM right now is 14:10.
Okay....all geeked out and my head hurts.
Subscribe to:
Posts (Atom)