Security experts always moan about how few people properly understand security and cryptography, and the smart ones point out that UI problems in security and crypto tools lead pretty directly to security problems. I'm convinced that the lion's share of these UI problems come from an insistance on clinging to mathematically correct metaphors that don't survive translation into everyday English.

The big example of this that I give out often is the terms used in public-key cryptography. Yes, it's true that both the public and private keys are "keys" in a mathematical sense. But one of the reasons I constantly see novices accidentally leaking private keys or otherwise confusing the two is that these names tell you nothing about their everyday purpose. In actuality, the private key is the only one that is in any sense a "key", and the public key is actually a lock.

If I want to give you an account on my system and I ask for you to use ssh keys, it's like I have a set of bicycle kennels that I am letting out for people to store their bikes in. If I decide that you should be allowed to have one, I simply ask for you to give me a lock that I can slip through the hasp on the front door and you obviously keep the key so that I never need to see it. Likewise if I give you a shell account on my system, you give me your ssh lock ("public key", to use the standard confusing terminology) which allows you to use your key (ssh private key) to enter.

That aside, one of the cleverest security access techniques to come out in recent years is OPIE, or One-time Passwords In Everything. It's basically designed so that you generate a new key each time you enter the system, like one of those constantly-changing password systems they use in spy movies. This has many of the advantages of the ssh public key system, but with the added convenience that you don't need to carry a two-kilobyte key file around with you. This convenience prevents a lot of clumsy workarounds for the key problem, which on average can be a benefit to security (if you allow long but easily remembered passphrases, for example, you avoid the problem of people keeping the short punctuation-laden passwords in their e-mail or doing something else equally dangerous).

So let's start with what the user sees when she logs into my system with the One-Time Password system. When you ssh to zork.net without an ssh key, you get a prompt such as the following:

otp-md5 73 fr8981 ext, Response:

This requires the user to use a password-generator program to generate the password. She runs the program, enters her secret passphrase and the 73 fr8981 part of the above challenge, and gets back a result like this:

KATE LAWS LESK ALOE AQUA DUMB

She then copies and pastes these six words into the ssh window, and is let in. The next time she logs in, Zork says:

otp-md5 72 fr8981 ext, Response:

and the generator gives her:

AT LYRA GEL AMOK NICK LESK

Now, it may sound inconvenient to require this password software on every system you want to connect from. If you're in an Internet cafe, for example, you don't want to have to download and install special programs. For this reason, I have set up the page at http://zork.net/ssh/ to have both a Java ssh client (on the right) and a JavaScript One-Time Password generator program (on the left). So almost any Web browser can be used to run this password generator on any machine.

This looks like it involves a lot of spooky scary hard-to-understand crypto math, but in actuality it's a super elegant and easy to understand system. So what follows is an attempt to explain the inner workings in plain English.

If you have access to a modern Unixy system (basically every major OS except for Windows, these days. Poor bastards at Microsoft are still behind the curve there), you'll see that there's a program called md5sum that's used to make "checksums" of any amount of data you like.

A checksum is basically just a statistical summary of characteristics of the data. They usually show up as a long string of hexadecimal numbers, which make a number so large that the number of possible combinations is enough to give one of these strings to every atom in the universe.

[nick@frotz(~)] md5sum /etc/motd
74d4639801fad57b90932584d1bd8646  /etc/motd
[nick@frotz(~)] echo -n 'hello' | md5sum
5d41402abc4b2a76b9719d911017c592  -
[nick@frotz(~)] echo -n 'hello, world' | md5sum
e4d7f1b4ed2e42d15898f4b27b019da4  -
[nick@frotz(~)] echo -n 'hello' | md5sum
5d41402abc4b2a76b9719d911017c592  -

This is partly useful because it means that if you have a huge file and I have what I think is the same huge file, we can each run md5sum on it and compare the 32-character checksum string instead of comparing all umpteen gigaboobles of data. In fact, most unix nerds use a program called "rsync" instead of ftp or scp, which checksums pieces of each file to send only chunks that are different. It's very fast, and if there's an error you can just restart and it'll quickly find where it left off. The popular BitTorrent file-sharing program makes heavy use of checksums, and you may have seen it spit out the occasional Piece failed checksum: Re-downloading. log message.

The really great thing about this sort of checksum, though, is that it's impossible to go backward. You can't look at that long number up there and use it to generate the original /etc/motd file. To do this would be like trying to recreate the Oxford English Dictionary from a list of statistics saying how many spaces were in it and the average length of all the words and so on. Or it's like trying to do a sketch of someone's face using only a set of fingerprints. It's a one-way function: lobster go in, lobster stay in.

So what does this have to do with the crazy OTP password scheme? Well you may remember that the full string you see when you log in says something like otp-md5 999 fr8713. That otp-md5 is there because it uses md5 checksums to verify your passphrase.

When you enter your passphrase into the password generator, it combines the fr8713 part with it first (just to stir things up a bit, in case two people accidentally have the same secret passphrase, and you don't want it to be obvious by making the one-time passwords for the two users match up). Then it runs md5sum on this combination, and gets one of those 32-character hexadecimal checksum numbers.

Then it combines the fr8713 with the 32-character checksum it just got and runs md5sum on that. It keeps doing this 999 times (or 998 or 432 or 73 or whatever it said in the otp-md5 line) and then converts the hard-to-type 32-character checksum string into those six words so that you don't have to squint so hard to make sure you typed it in properly. The translation between the six words and the long hex string is two-way, since the computer can easily and quickly flip back and forth between them almost as easily as it can switch a word between UPPERCASE and lowercase.

So remember how the md5sum process was one-way? Knowing the result of run number 999 doesn't let you go backward to number 998 any more than those statistics let you recreate the OED or my fingerprints give you a full-color mug shot. And the system you're connecting to only stores the result of run number 999 in your account settings.

So after you set your account up by entering run number 999, the first time you log in it will say otp-md5 998 fr8713, and you'll run the JavaScript which will do the md5sum game 998 times. You'll type the englishified result into zork, and zork will de-englishify it and run md5sum on it one last time to make sure that what it gets is what it has stored for run number 999.

So Zork never actually knows your secret password, but it knows how to tell whether or not you know it. Because it knows that if it just runs this md5 checksum feedback loop thing enough times, the result will look like what it has stored.

The OTP generator Web page I have up is all JavaScript that runs in your browser, and the passphrase never leaves your machine. Have a look at the http://zork.net/ssh/ page sometime, and view source. You can scroll down and see the list of words that it uses for translating the 74d4639801fad57b90932584d1bd8646 stuff into something more typable, and then there's a function called core_md5 that does the same thing as the md5sum program. The rest is just loops so that it runs the checksum the number of times you tell it, and mixes in the fr8713 and does a couple of other basic management tasks.

Now I just need some Spider Jerusalem glasses.

Of course, shipping couldn't be easy, now could it. The calculations for the USPS seem pretty simple: you just punch in a weight, and they have some formula for calculating the maximum allowable volume. Hell, it may even be constant.

But UPS has formulae that make the tax schedules look elegant. Basically, they calculate a weight that the box is supposed to be, based on volume, and the weight that the box actually is, and choose the higher one. So you get hammered hard on packing materials and double-boxing.

And you know how UPS domestic has like ground shipping where you just pay a minimal amount and let it take forever? Well overseas it's entirely impossible to distinguish one class of service from another. Near as I can tell it's just like random priority froofraw.

And then there's the old "insurance vs. customs" game. If you insure your package for lots of money, customs may make you pay that in full just to let it enter the country, effectively costing you the entire value you insured against loss. Lose-lose!

I'm in a state of total fucking disbelief. I've decided that International Moving Companies are a massive scam. They exist to milk as much from corporate moving reimbursement as possible.

Since flats in London are 90% of the furnished variety, and since none of our appliances are 220 (except our laptops), we're getting rid of furniture and electronics.

So, I've whittled our move down to a few key areas:

• clothing
• books
• crockery/cutlery
• wall-hangings
• paperwork, CDs, and miscellaneous keepsakes

The rest is just noise, and appears in our checked and carry-on luggage.

Now, when I ask people for an in-person moving estimate, they direct me to some stupid web page first. The form on that page usually looks like this:

PLEASE CHECK ALL THAT APPLY:

[ ] BAND SAW    [ ] COMMERCIAL DRYER    [ ] JUNGLE GYM
[ ] FLAGPOLE    [ ] DRYCLEANING GEAR    [ ] SWING SET
[ ] GARAGE DOOR [ ] BED (4-POSTER)      [ ] SWIMMING POOL
[ ] BRICK (TON) [ ] CHANDELIER          [ ] CAMARO + CINDERBLOCKS

So I kind of scratch my head and go "um, none of the above?" and they drop me like a hot rock.

I spoke to a longtime friend who has done the expat thing many times in his life. According to him, oil company stooges are the worst. You'll walk into a merkin's house in Lagos and there will be all the family antiques. He goes to parties in penthouses where dining tables have been hauled from Nebraska and fill all available space in whatever room they're stored. Basically some midwestern housewife is handed an expense form by her husband, told "the movers will be here on Tuesday, so just show them all our stuff" and then sort of by default has them ship anything not nailed down. The moving companies count on this.

These people run 110V heavy appliances like washing machines and refrigerators from foreign power, just using a converter. What, they don't have refrigerators where you're going? Is your dishwasher really that precious to you?

Add to that the fact that moving and shipping companies seem to all be crooked (been looking at http://movingscam.com) and the whole thing just seems so not worth it. At this point I'm ready to just pack it all up myself and ship UPS and USPS.

What a goddamn racket!

When I first learned to shave, I was still a teenager living with my parents. I learned to shave using the home sink with its seemingly limitless supply of hot water. And my father taught me to just rinse off the razor in the stream of water as needed, to flush out the harvested whiskers.

But based on all the forums and shavegeek photosets and all, it seems that the preferred method is to fill the sink with hot water, and just go from there. The advantage, they say, is that the silence of the still waters will allow you to hear the rasping sound as you work. This promotes keener understanding of the whole process, and results in a finer shave.

The only problem with this is that I used to fill the sink to shave, years ago. I had no choice, until we called the plumber to clear out the pipes. It was really distressing, since I'd leave a ring of hair and soap around the bowl, and I just found the whole process gross. I came to associate "full sink" with "filthy sink".

But since our drain has worked nicely for the past couple years, I decided to give it a try a while back. After all, our dinky energy-saving apartment water heater only has a couple minutes of hot water left once I'm done with my shower.

Boy did I have flashbacks. I spent a good five minutes working to clean the Taylor's Lavender Cream residue off the sink rim, wiping away whiskers with my finger. Hulk SMASH.

But this morning I decided to give it a go again, this time using the Proraso pre-shave cream instead of the nancy boy pre-shave oil. I lathered up with the Proraso soap on top, and got to work.

Imagine my surprise when all the little globs of hair and cream stayed coherent in the bowl as I shook them off. It didn't last, but the hairs didn't all migrate to the meniscus or cling fast to the sides of the sink. When I was done, all it took was a little splashing with cold water and the whole lot went down the drain, quick as you please.

And despite the double-numbing mentholyptic treatment of both proraso pre-shave AND lather didn't seem to matter. I got a great shave without marks or irritation. I could hear what I was doing, and began judging my shave based on the sounds it made.

Beaujolais!

I have of course said this elsewhere, but it bears repeating.

On the 18th of April, 1906, at 5:12AM local time, a colossal earthquake hit California, centered on San Francisco. This is one of those events that defines SF history, and so every year there's a celebration in the early morning.

Of course, since this is 2006, this year's will be enormous. People are making a big to-do about how the hundred-year anniversary is coming. But there's just one problem:

The quake happened in 1906, before Daylight Saving Time. The quake happened at 5:12AM Pacific Standard Time. The revelers this year are celebrating at 5:12AM Pacific Daylight Time. They're an hour early.

If that doesn't convince you, consider that the accounts of the quake always describe the "early dawn light" that illuminated the city when the quake hit. A sunrise calendar I just used lists morning twilight as 6:03AM PDT, and sunrise proper as 6:31AM PDT. The sky is still black at 5:12AM PDT!

Naturally, as with the whole "2000 is still the 20th Century" crowd, all this amounts to is proof that I'm a smartass.

Mike Orr has this cool little howto explaining how to do various HTML markup techniques using reST:

http://sluggo.kicks-ass.org/python/rest/rest_for_html_users.html

It's unfinished, but it's full of useful advice for beginning to think of your plain-text layout as markup instead of trying to do everything with particular tags.

Okay, so I hit the shavegeek forums every couple of months just to see if they've come up with anything interesting beyond "OMFG TEH BURBLE SOAP IS LESS SANDALWOODY THAN THE GURBLE SOAP I H8 U". And a couple weeks ago they were all abuzz about the famed Proraso brand Italian shave soap being carried in Target of all places.

I used to troll Italian import places in North Beach who laughed at me to my face for asking about this stuff: "Oh, you'll never find that around here!" It's an anomaly in shavegeek accoutrements. All the ingredients say wrong wrong wrong: it's mentholated, confabulated, and extracted and yet it is somehow a formula that wins real fans. If you thought the Nancy Boy altoid effect was strong, well Proraso's menthol and eucalyptus is like having the Halls of mentho-lyptus all over your face.

So I wrote to Pedro because there was a big fight on the forums about the US formula. Supposedly the ingredients list for the Target stuff doesn't match the imported stuff. Lots of European shaving cream manufacturers have been reformulating to meet with European Union FDA-type regulations, but we don't really know why they chose to do this. However, the rundown of all those threads is that the one change they made was:

...to ditch Lanolin and replace it with sodium borate.

This was good news, since Uncle Pedro is allergic to lanolin. It probably also makes Proraso a vegan formula, which could be handy for lots of other folks.

So I shaved with Proraso shaving soap a few times, and it really felt as though my face were going tingly-numb. It has a strong medicated feel to it, and I think that I got a little careless as a result. The shave I ended up with was rough and overscraped, and I really couldn't tell how brutally I was working myself over with this anæsthetic stuff on.

Now, it's probably fantastic stuff for the summer. The cooling effect would be such a great thing on a hot day that I'd probably dab the stuff behind my ears and along my neck for relief from the heat. But I think I'll leave my little $4 tub of the shaving soap alone for now.

However, lots of shavegeeks rambled and raved about the pre-shave cream. Some folks groused that it was no better than a "proper prep" (which I assume means seven minutes of hot towels and a deep-tissue massage), but others swore by it. So I figured what the heck and went back to Target to get a jar.

So this morning I put the stuff on under a layer of Taylor's avocado, and did a quick shave with a four-day-old blade that had already been giving me grief. It's possible that I just mixed the lather a little richer than usual, but the shave was flawless. The metholated cooling was more muted than when I used the proraso soap, but I still felt like my face was a little tingly-numb. Still, I emerged baby's arse smooth without so much as a single bump.

I'll definitely try a bottle of Nancy Boy pre-shave oil to compare, but I think this category of goo may be the next big thing for me in blowing petty cash on vanity grooming products.

Someone in one of the shavegeek forums discovered an archive of advertisements on the Web, and pointed out the collection of shaving product ads.

They cover both world wars, and it seems interesting that in the earlier images they seem to really be hawking shaving sticks. In one of the earliest entries, however, The Conversion of Mister Prejudice, they show someone applying it to his face and lathering against his chin with his brush. I've never used a stick, but I always thought it was supposed to be brushless.

Lots of brushless creams show up in the post-WWII entries, and powders seemed big in the 20s. I have no idea how good any of these shaving products were, but the brands represented really are terrible nowadays. Barbasol is really the industrial foam goo of last resort.

As always, implications of getting laid by being smooth-shaven abound.

And of course, you can't have a collection of old shaving ads without a few Burma Shave rhymes.

Well it looks like Corey Greenberg has revised The Perfect Shave, and is now pushing the Vulfix #2233 as the best all-'rounder.

He's also updated his blog-copy to include the magic that is Nancy Boy shaving cream and rose hip oil and all sorts of other little discoveries that he's written about over the past couple years.

Well, I went through and cleaned up my old entries, using this technique. When I was done, I decided to clean up all the entries that were generating reST errors because reST was freaking out trying to interpret raw HTML. I basically went through and cleaned up all of Nutella's entries and a bunch of Sam's.

For Nutella, he essentially wrote everything as one solid block of HTML, often with no newlines at all. So what I did was wrap most of his entries in reST's raw html directive, like so:

.. raw:: html

        <cite>blarblarblar</cite> etc etc <a
        href="http://zork.net/motd">a link</a>

The outcome is as you'd expect:

blarblarblar etc etc a link

Nutella used <cite> a lot, and decimal unicode entities to print hanzi.

For Sam, he had written most of his entries in the wiki markup, using only occasional HTML for URLs and <pre> blocks and so on. I wrapped a few individual paragraphs in the .. raw:: html bit, but mostly I just fixed his bad entries to be properly reSTy.

So one somewhat bothersome aspect of the blosxom system is that if you edit a file, that bumps it up to the top of the listing. This is because pyblosxom sorts all entries by the modification time of the original posting.

There are quite a few old entries in here that could do with a few repairs, but they really don't belong at the top of the page or the RSS feed. So for you folks, I give you the magic of touch!

Here is an example of how to use cp and touch to edit old entries while keeping their posting date the same:

$ cd /var/www/motd/madness/goober/
$ cp -a no-its-true.txt /tmp/old-entry
$ vi no-its-true.txt
$ touch no-its-true.txt -r /tmp/old-entry

First, the cp -a causes the file in /tmp/ to have the same exact modification time as the oirginal file. We are actually just backing up the modification time here, and don't care about the contents.

Then we edit the file as normal (I use vi, but I know that many folks like nano).

Finally, we use touch -r to make the edited entry have the same modification time as our backup in /tmp/.

So this would be helpful for folks like Nutella, who need to go in and mass-replace a lot of <br> and <p> stuff with ordinary blank lines.

If you edit an old entry, let me know and I'll give the full site build a push. Right now pyblosxom only updates files that have brand new mtimes, so this trick will sneak past that. I can force a full rebuild that will update everything.

The Economist drops a little science on the diminishing returns of multi-blade cartridges:

It is simply not possible to add a new blade whenever the marketing department wants one. Every additional blade, explains Michele Szynal, a spokeswoman at Gillette, adds weight and size to a razor. Firms must therefore find ways of making both razor and blades lighter, which means thinner blades, more closely spaced, made of special materials, with new coatings.

—The Economist, http://economist.com/displaystory.cfm?story_id=5624861

I was Spads in this conversation:

+Spads:	well you're going to have to set up NAT anyway
~paganini:	Yes
+Spads:	so while you're doing that, DHCP is pretty much aftershave
~paganini:	Hehe
@Lxndr:	what is the point of aftershave, anyway?
+Spads:	two things
~paganini:	NAT doesn't look too hard though
+Spads:	lots of idiot men buy crap like old spice, which is alcohol supposed to I dunno, disinfect or something
-:	paganini does not use aftershave
+Spads:	I use witch hazel, which is a skin toner, and feels super fantastic
~paganini:	Except sometimes I use a little witch hazel if my razor was dull and I got scraped
@Lxndr:	okay, so the point is to be an idiot man?
~paganini:	Hehe
@Lxndr:	and/or use witch hazel
+Spads:	I mean, you've just done a skin peel. it's sensitive. slapping alcohol on is just going to sting and do pretty much nothing for you Lxndr: well I use an "after shave toner" alcohol-free aftershave I use lucky tiger but I've heard good things about trumper's skin food I'm actually leaning toward beginning to use pre-shave oil too especially for when the razor gets a little old
@Lxndr:	I've never really even used, like, shaving cream. Nonetheless any of that other fancy-schmancy stuff like aftershave or pre-shave oil.
+Spads:	do you use an electric, or just let your beard grow?
@Lxndr:	Currently, I use disposable razors.
+Spads:	wait
-:	paganini uses shaving gel
@Lxndr:	I am also lazy, and shave only once a week or so.
+Spads:	without shaving cream???
~paganini:	Whoah
+Spads:	like, dry?
@Lxndr:	Yes, without shaving cream.
~paganini:	Lx, does your face still have skin?!
+Spads:	holy shit
@Lxndr:	In the shower, usually, so it's damp.
+Spads:	I didn't believe that anyone actually did that
-:	paganini tried that once
+Spads:	like I thought it was a myth that all these fru-fru "wetshaving" fanatics made up
-:	paganini had razor-burn that lookedl ike roadrash
+Spads:	the notion that people somehow are shaving without any lube
@Lxndr:	well, there is the water.
-:	Spads hands Lxndr the Bill Duke Predator Memorial Ghetto-Shaving Award

Well gosh, I guess people really do shave like that. I had no idea!

So we now have the latest 1.3.2 Pyblosxom, which means we have proper RSS now. I've updated the little XML box, but the long and short of it is that you should change "index.rss" to "index.rss20" for your feeds.

http://zork.net/motd/index.rss20 <-- teh new url.

http://zork.net/motd/nick/index.rss20 <-- example user RSS category feed.

Six months ago, I observed the following in #tron:

CrackMonkey:	http://www.kk.org/cooltools/archives/000979.php <-- oh dear, I may personally be suckered in by this one...
sneakums:	man, count me in
CrackMonkey:	It has all the elements necessary a strong technical argument, economics, a certain historical chic, and the aura of self-confident masculinity without all that messy bravado

For the next week, I did all the usual Internet research you'd expect before going off into some goofy "lifestyle" craze. I read Corey Greenberg's The Perfect Shave (which is still required reading, even though Corey has moved on a little since then), trolled through the Shavegeek Forums, and spent hours comparing products on Classic Shaving. I made some rather nice purchases based on that.

However, I've learned a little since then, and that's the main reason why I'm posting this here: so far Sneakums, Octal, and Uncle Pedro have all joined in the fun with old-timey shaving gear, and more seem to be following. Last Autumn, I'd have just thrown those three links at them and let them read up on it like I did, but now I'd like to explain what I'd do if I were getting into this today.

After spending a good amount of time in the SAIS source code and getting a feel for the game logic, I sent a long mail to a collaborator with my dream goals for the system. I listed a bunch of things, but my real pie-in-the-sky items were these:

• Make solar-system navigation in something akin to the tactical mode.
• Make in-game object rules handled via embedded scripts using something like lua or embedded python. This would make it a modder's paradise, with new objects and graphic sets easily spliced in.
• Add planets and station objects in the solar-system view.

After poking around through lua some, I chanced to take another stroll through the pygame docs. I had not remembered how high-level pygame is compared to using libsdl in C! Pygame has all sorts of great rect methods and sprite groups and other great features that make it a real win. So now I'm taking up the fool's errand of the second system.

I've got access to the SAIS code, so I've been trolling through it to figure out some of the math behind the game object interactions. The camera math is some of the clever stuff, and I am thinking of making heavy use of pygame's rect magic to make that happen.

And then I'll make the game AI, situations, ship definitions, and so on out of modder-supplied python code. I'll have my own default set based on SAIS, but it should be fun.

But for now I'm working on making the simple tactical system work as a hollow demo, with space-object-motion and sweeping camerawork. Once that works in a generalized manner (so that you can raise and lower HUD elements once that's coded) I'll start making a game of it.

I've got a short list of goofy projects that always seem to come up at times when I'm feeling nostalgic or hoping to tackle a relatively uncomplicated programming feat to keep my skills up. I always consider writing interactive fiction in my new favorite language, or maybe a BBS, or perhaps that TradeWars clone I've been meaning to try.

I mumbled about TradeWars in IRC one day, and someone mentioned Diceland. It's a game where you fold these paper octahedra, and the side that's facing has certain power qualities. You move by pressing down on green corner dots (causing you to roll over one edge, allowing you to "walk" across the field) and damage is represented by a red dot that always takes you to a less powerful face.

On the web site and paper game box, they tout this PC game called Strange Adventures in Infinite Space. Last night as I was leaving the ragout to simmer and waiting for E to come home, I decided to head over to the Web site and drool over screenshots.

So I had a look around and figured it would be another era before Free Software had a good critical mass of indie game developers to make shiny little cult hits like this. But I noticed that they claimed to have a Palm Pilot version or something, so I kept poking around on the site to see just how cross-platform it really was. Then I hit jackpot.

They released the source code to the game engine under the GPL about a month ago, in order to open the doors to the modding community that had sprung up around this game. In addition to this, the authors had ripped out all the DirectX code and replaced it with SDL, making Linux ports super easy.

So I quickly pasted this into IRC and set to downloading. After an hour of ripping out Windowsisms (namely, replacing all the directory-walking code, and then spending an hour in the debugger before realizing that an image wasn't being loaded because the coder expected a case-insensitive filesystem) I had a running demo! It was slow, so this morning I had a look at how the developers had done the main SDL loop, and realized that the double-buffering was miscoded. It's a little faster now, but still not exactly where I'd like it.

You can see my darcs repository at http://zork.net/~nick/sais/ and you can always just darcs get http://zork.net/~nick/sais/ and join in with me. I've put in a proper makefile, and I plan to fix the performance bottlenecks visible in http://zork.net/~nick/sais/gprof.txt . The big problem is that the developers hand-wrote their own sprite libraries and just treated DirectX as a dumb buffer to blit pixel data to. There is a lot of room to replace their code with ordinary SDL functions, and their sprites with SDL_Surfaces.

In addition to this, I'd love to see if I can get the modders to contribute some GPL-friendly artwork, and maybe I'll hit the creative commons sites to find replacement sound samples. I'd love to get Uncle Pedro to do some pencil-squiggle animations so that we can finally do the Bread & Cheese game.

For now, though, you will still need to download the Source Code and Demo zipfile to get the graphics, sound, and game data. Be sure to check out the modders' forum thread on the source code release.

I noticed nutella mumbling about the ability to check the output of his entries. I only just realized that he was actually entering everything in HTML, and ignoring the actual plain-text formatting that motd uses. Even his entries that were just blank unadorned paragraphs were separated with <p> tags instead of blank lines.

Well I've now switched laziness away from the old "genericwiki" formatter, and over to reST. This means that shoving HTML code inline will no longer work, and you'll have to learn reST layout in order to punch in unicode entities or make non-trivial links. The end result, however, will be to banish those hideous less-than/greater-than symbols from everyone's posts.

But the bonus is that you can always test by running rest2html on an entry and checking your result in a browser.

I just ripped off the RSS 2.0 theme files from another pyblosxom package, so now the feeds should be working again, though at a different URL.

http://zork.net/motd/index.rss <-- teh new url.

http://zork.net/motd/nick/index.rss <-- example user RSS category feed.

MOTD is now teh cr0n.

Hooray for BAKED.

I first came across Moleskine notebooks in Diesel a while back. I was intrigued, but the fru-fru LifestyleBabble on the wrapping turned me away pretty quickly, in much the same way that Danger's marketing copy makes me never ever ever want to get a hiptop ever ever ever (well, that and the fact that it's got a complete proprietary javur OS). Also, it seemed to be made of leather, and I don't like arbitrary objects being made of leather as though it were some cheap material that carries no social cost.

I recently discovered an entry in Cool Tools about Moleskine notebooks. Following links, I found a lot of snooty self-aggrandizing "contemporary nomadism" nonsense (it's an inanimate blank book, guys, it doesn't "bear witness"), but also a lot of practical analysis of why these things are actually very good.

They are no longer made of leather, it turns out, but rather some sort of rubberized synthetic. The cardboard backing is very sturdy, and the paper is really high-quality stuff (Nice and soft to write on, and it took my leaky pilot pen without complaint, didn't smudge, and dried fast enough that it didn't leave an imprint on the opposite leaf when I closed the book). It's signature-bound, and lays flat very nicely.

In addition to the handy bookmark tassel, and the elastic strap that holds it closed, there is a clever pocket built into the rear cover that is just the right size to hold a few 3"x5" index cards (or whatever receipts, business cards, or tickets you need to stash away).

And on the subject of size, it is exactly the perfect size for the rear pocket of my jeans. I used to keep a cheap Mead "square deal" Marble Memo there, but the cheap gummy perfect-binding always gave out and they made a mess of my pockets. Now I've got a hardcover notebook that I don't need to worry about sitting on.

Their Lomo-esque "buy our products and/or services and become a post-modern artiste" marketing copy is still pretty obnoxious (and seems to cater to the "YOU CAN'T CURL UP IN BED WITH A COMPUTER!!!" crowd), but the damn thing only cost me $11 at my neighborhood independent bookstore and it doesn't contain flesh or proprietary software.

The one thing I regret is that I can't find the little 3x5 accordion file version, as I have a number of situations where I want to keep sets of index cards organized for various purposes.

Almost their entire line comes in two sizes: 9cm by 14cm (a little over 3" by 5"), and the full-size 13cm by 21cm (about 5" by 8"). They make address books, sketchbooks (the paper's thick enough for watercolor, but you only get about half the number of sheets), and grid-ruled books (i guess for lab notebooks).

Best $11 I've spent in months.

There's a new transcript of an RMS LISP talk up on gnu.org. Some choice tidbits:

on TECO:

Actually, there were some rather sophisticated facilities; I think that Lisp got its unwind-protect facility from TECO.

on EMACS LISP features:

I implemented Common Lisp once on the Lisp machine, and I'm not all that happy with it. One thing I don't like terribly much is keyword arguments. They don't seem quite Lispy to me; I'll do it sometimes but I minimize the times when I do that.

He likes the scheme.

Beaujolais for starting with a threaded example, but that while macro is bogus. The comments seem to range between "Y NOT UZ PERL HUK HUK HUK" and "Pardon me good sir, but wouldn't ML be more indubitable and minimize undue perspicacity?"

threaded-map is supafly, though.

So I now have a Nalgene brand water bottle, made of non-leeching lexan. My big question is: where the hell do you put the water?

Lolz.

When my experience of computers was limited to 8-bit PCs and occasional use of VAXen at the University of Washington and the Seattle Public Library, the public's view of computing was far different. The Macintosh was still a plaything for the wealthy, and hadn't yet even claimed the "Desktop Publishing" niche. Computers were seen as inscrutible tin gods worshipped by the technocrats and their adoring press.

Someone on slashdot once noted that you don't have to answer the question "What do you do with a computer?" any more. It used to be that people had this Isaac Asimov-inspired notion that you "asked it questions" and it would give you an answer. Perhaps this was the fault of efforts like PROLOG.

By the 1980s, though, the LOGO program had thousands of elementary schools across the country getting through the first few chapters of the official LOGO course. LOGO was quite possibly the most accessible LISP interpreter on Earth, but nobody ever did much beyond pushing turtles around on the screen. LOGO was essentially a $2,000 spirograph.

But a number of maxims about the nature of computers began to creep into common usage. People who had never used a computer by themselves before were saying things like "Garbage In, Garbage Out." or "Computers only do what you tell them to."

It was largely a reaction to people mistyping or misunderstanding commands, and then (perhaps influenced by 1950s "electronic brain" rhetoric) expecting the computer to correctly interpret the intent of the garbled input. For a certain type of mind, the irrational degree of formalism and structure provided by the early 8-bit operating environment was liberating. Results could be planned for, anticipated, and feedback was immediate and reproducible. It's a playground for structured thought, and a frustrating mess for anyone who can't enjoy that.

But the further implications of the above bromides deserve special attention. Computers today are not the simple, single-tasking BASIC boxes of the 1980s. My Linux box has plenty of vendor-supplied cron jobs, long-running daemons, and even a couple dozen outside users. Yes, technically everything we tell this machine to do gets done in a straightforward fashion, but there is a lot that it does simply because that's what Debian is designed for.

So to a certain degree you can trace everything my machine does to my intent. There is a bit of delegation, but it is measured and acceptable to me (thus falling into the realm of what I want it to do). Even more restrictive proprietary computer systems behave in much the same way. You can tell because there is often a public backlash when some vendor-supplied behavior conflicts with the users' conception of how their computers should perform. Consider the CPU ID numbers that Intel implemented a few years ago, and how unhappy the general public was with that decision.

But what of systems such as Palladium and other hardware-implemented "Trusted Computing" schemes? The use of signature verification and other cryptographic tomfoolery in the hardware allegedly prevents corrupted code from being run, and allows automated audits on the state of all installed software. The benefits to the user end, however, once the signatures begin to prevent certain debugging or introspection tasks. The control of the computer is given over to the hardware as a means of sneaking "DRM", or copy prevention techniques into PCs.

Seth David Schoen has argued that Palladium could be acceptable technology if there were some sort of "Owner Override" mechanism. If the user of a computer can bypass the hardware restrictions (presumably via hardware means, to preserve the security benefits of such a system), then the intent of the user is not thwarted.

There's a great moment in the 1982 movie "Tron" between Ed Dillinger, the sneaky Senior Executive of Encom, and Walter Gibbs, the greybeard founder who sympathizes with the film's heroes.

Walter:	User requests are what computers are for!
Dillinger:	Doing our business is what computers are for!

The plot of "Tron" focused on the deactivation of a malicious security and control system for Encom's computers that was preventing the employees from getting work done. The film colorfully presented the Master Control system in cold-war terms, as a totalitarian leader who pitted programs that woldn't give fealty against each other in gladiatorial games.

The depiction of the Master Control system in the "real world" is far more interesting. Upon entering a command into his terminal, the character of Alan Bradley receives a frustrating series of "access denied" messages. While this sort of thing may make sense in a centrally-administered time-sharing system, it is not the sort of thing the owner of a standalone workstation wants to see.

An Owner Override would be something that Walter Gibbs could support. It preserves the property rights of the computer's owner, allowing her or him to completely control what the computer does. It also means that you don't have to correct anyone when they say "a computer only does what you tell it to."

So I'm sitting here watching E wrestle with wikitravel, trying to enter in her own travel story about Krakow. Here's what happens when you think you want to add something to wikitravel:

You start looking for an existing page, and only see big scary CIA documents or big templates with huge requirements and a rigid structure. If you aren't completely scared off at this point, you might notice the Plunge Forward advice, and let that steel your confidence. Maybe you read the Stub Articles page again, and decide to forego the stuffy template this time.

So basically I told E to go to the Poland page, edit the URL, and then "edit this page" from the empty Krakow page. By this time she was super ready to just close the browser and do something more interesting. Now she's busy wrestling with the crack-addled wiki markup (quotation marks for emphasis! Welcome to "the Internet" of hand-lettered business signs!).

It sounds like it's basically all about Mister Bad being unemployed and doing nothing but edit wikitravel articles all day.

I just got off the phone with a reporter from the East Bay Express. She was writing about the petition to keep BART open until 3am on weekends to cut down on drunk driving and to let folks stay out and party late.

She found my BART Petition Rebuttal thread and mailed me asking for an interview. I was trying to coordinate times, and noticed her message was posted 1 hour in the future. I realized that she was in mountain time, and George Perry reminded me that the East Bay Express is owned by the same conglomerate that owns the SF Weekly.

So I basically sent her a mail saying "I can call you, but if it's long distance I can send you my number." Whoops! She's in Emeryville, using the newtimes mail system (some novell thing).

I was satisfied with her level of skepticism, which is refreshing after spending so many years talking to bubbly tech press who take every word you say and repeat it to avoid doing any work. I guess I forget that computer news is really special and separate from even the more corporately-managed free weeklies.

So she didn't seem to buy that the problems were all technological, and that's a fair point. The issue of money came up, but I'm sadly not as familiar with the particulars of the BART financial hemmorhage beyond occasional quotes that they're trying to reduce the yearly net cost per rider to $28. The one thing I did point out is that night work is typically much more expensive than daytime, and they could likely save money if they found some way to do maintenance during the day without stopping service.

Okay, so I'm actually tempted to write up a big article for wikitravel. Happy, Evan? I'm gunna sketch out a "Bay Area Commuter Rail" tour, since the BART/Metro system is really its own region with its own routes, access points, sights, and Imaginary Geography.

I live in a neighborhood of Oakland that's 20 minutes from downtown SF by BART, and go to school in a part of San Francisco that's also 20 minutes from downtown. I tend to think of things in terms of their transit stations, much the way people in LA and New Jersey think of freeway exits.

Welcome to the land of WikiWords. Now everything in StudlyCaps becomes a GoogleSearch. (Yeah, I upgraded pyblosxom, and grabbed some caching and formatting extensions along the way)

Dude!

That's all I can keep saying! Dude!

It's a set of 6.001 lectures videotaped by HP so that they could have SICP on file for all future students! It's released under the attribution/share-alike creative commons license!

http://www.swiss.ai.mit.edu/classes/6.001/abelson-sussman-lectures/

http://www.swiss.ai.mit.edu/classes/6.001/abelson-sussman-lectures/legal-info.html

It was recorded in 1986! Think of that! It was done for version 1 of SICP, and probably used Common LISP instead of Scheme (though that doesn't really matter).

But it's 1986! The students all have perms, bowl cuts, square-frame glasses, and izod shirts! Sussman actually wears a pocket protector with no irony whatsoever!

Gödel, Escher, Bach had been published only a few years prior to this, so that they were still all giddy about Bach and technology and Wendy Carlos and stuff, so the intro music is Jesu, Joy of Man's Desiring played on a synth keyboard. Hell, it's probably a casio!

I was looking at the leather case on Sussman's belt, and realized that there's no way in 1986 that it could be a cellular telephone. that leaves me with a few basic possibilities:

• Mace
• A pocket knife/leatherman
• A slide rule

Man oh man I hope it was a slide rule.

But Dude!

I'm busy mirroring all the divx files (about 9G total), and I'm watching them one by one. So far I'm on section three of day two part a, but I have through day four downloaded. It's amazing how smooth everything flows when it's being written up on the blackboard, and the student questions really are the most pressing ones.

It's fun to note that they have a weird 1980s teleprompter screen for the actual slides they do want to put up (usually images and fully-formed page-long programs). But the real strength of the lectures comes from the fact that Abelson and Sussman have a many-paneled chalkboard on which to write their terse chunks of LISP. There's something about the ability to narrate as you write that gets lost in slide-presentation lectures.

At any rate, this is the last piece I needed to make any sort of lisp hacker initiation club complete. I'm still jazzed about its very existence. Dude!

I just spent two days studying call-with-current-continuation.

I scratched my head trying to figure out what sort of execution-flow magic was going on, trying to see what made this one of the most powerful features of scheme. I spent hours trying to decipher the scheme jargon and heady compsci technobabble.

Today someone explained that I was reading too much into things, that it's really quite simple. A short tutorial reading later and the light bulb went on:

call/cc is just GOTO

The scheme community is so caught up in their own self-important pontifications and pedagogy that they can't just admit that one of the most powerful features in their belovedly pure language is just GOTO.

I'm still picking my jaw up off the floor.

In 1968, the Communications of the ACM published a text of mine under the title "The goto statement considered harmful", which in later years would be most frequently referenced, regrettably, however, often by authors who had seen no more of it than its title, which became a cornerstone of my fame by becoming a template: we would see all sorts of articles under the title "X considered harmful" for almost any X, including one titled "Dijkstra considered harmful". But what had happened? I had submitted a paper under the title "A case against the goto statement", which, in order to speed up its publication, the editor had changed into a "letter to the Editor", and in the process he had given it a new title of his own invention! The editor was Niklaus Wirth.

—Edsger W. Dijkstra

Hooray for Uncle Bad!

Man, I would definitely include all of Paul Graham's Web site in any hacker reading group.

So Siduri pointed me toward Lists and Lists, which is an inform implementation of LISP complete with a tutorial genie who checks your work. I'm not sure that it's proper scheme, and it's definitely not R5RS compliant. Still, it looks cute (once you look past the fact that it's proprietary software written in a language that has a proprietary runtime library).

So Ed Lang got curious about all these books I listed the other day, but waffled about the cost. Aside from GEB, none of the books I listed are over US$20. Most of them are paperbacks -- slim little volumes.

But if you're genuinely not able to buy any books, but want to learn scheme, here's what there is on the net.

For starters, there's Teach Yourself Scheme in Fixnum Days. It's a very practically minded tutorial, and it doesn't hide the OS-interface features that have side effects. Most texts present lisp as an ethereal function evaluator, and give you no I/O beyond the REPL (Read, Eval, Print Loop) itself.

I haven't worked my way through that tutorial, but I'll probably give it a try sooner or later. It even lists CGI programming examples, which is kind of a trip. It seems to use mzscheme as the implementation for all the code examples.

If you're looking more for the no-math no-computers liberal arts oriented approach that TLS had, you may find How To Design Programs useful. It's actually the textbook to a course that uses DrScheme, which is a nice GUI scheme IDE with graphics libraries and other goodies. The trick to DrScheme is that it initially presents you with restricted feature sets of the language to keep beginners from getting too confused. It's really a classroom tool. It's actually based on mzscheme, if I remember correctly.

If you're a little more hardy, and are looking for an in-depth coverage of CS, there's always The Structure and Interpretation of Computer Programs. It's an amazing book! Although it's designed with portability across scheme implementations in mind, the course designed around it uses MIT Scheme.

Finally, if you're looking for a big Scheme reference, the canonical book is The Scheme Programming Language, 2nd Edition.

While not specifically about Scheme (it uses Common Lisp for most of the examples), the book On LISP has been recommended to me as a good way to learn how to think about macros. No, not like the goofy preprocessors that come with 1970s compiled languages, but a truly dynamic modification of the LISP evaluator! I'll let Paul Graham tell his own tale about the power of LISP macros.

Most of these are available in HTML format, except for On LISP. I have them all mirrored locally so I can read them on my zaurus and maybe print them all out some day. It irritates me that the images most T_EX-to-HTML generators spit out are 1-bit. Why not take advantage of ghostscript to anti-alias?

I've had this recurring theme in my life where I try to get my brother into some technical topic or other. Typically I'm trying to get him into programming of some sort. I never know how much of it is me being a pestering brute and how much is him actually enjoying and understanding the lesson.

So my latest push was accepted rather warmly. I mentioned that graph algorithms are usually big list manipulations, and the sort of thing that has all sorts of rich algorithm analysis behind it. Lots of good science code out there.

So he sent me this way to determine if a sequence of the degrees of unique vertices is graphical. That is, can we say that in a reasonable universe, all of these vertices are connected in a single structure.

(1 2 2 1) is a valid graph, since it is just four nodes strung together in a line. (7 2 2 1) is invalid, since there's simply not enough nodes for any one of them to have 7 connections.

I'm not sure he followed my explanations, or really spent much time reading my long mails on the subject. I encouraged him to trace the various functions to see how they work. The trace function is simply fantastic for learning how a system is behaving without going into the debugger. It's much like the strace and ltrace tools, but it's easier to be selective.

I'm not a great schemer, so likely this is done in a stupid or redundant way. I do think it's done in a portable way, and is straightforwardly implemented so that a new schemer can understand it.

So here's the code, all commented and supafly. The latest version lives at http://zork.net/~nick/scheme/degree_seq.scm

; Functions for analyzing degree sequences in an undirected graph


; list-satisfies? is a list analyzer function.  It accepts a predicate
; function and a list.  If any element of the list should fail the
; predicate, then list-satisfies? fails as a whole.  Put another way, it
; succeeds *only* when all elements of the list satisfy the predicate.
(define list-satisfies?
  (lambda (predicate l)
    (cond ((null? l) #t)
          ((predicate (car l)) (list-satisfies? predicate (cdr l)))
          (else #f))))

; decrement-n-elements accepts an integer n and a list of numbers.  It
; subtracts 1 from the first n elements of the list.  No data validation
; is done, so all atoms must be numbers.  In the event that there aren't
; enough elements in the list to decrement n elements, the function will
; simply return a list with all elements decremented.
(define decrement-n-elements
  (lambda (n l)
    (cond ((null? l) '())
          ((zero? n) l)
          (else (cons (- (car l) 1)
                      (decrement-n-elements (- n 1) (cdr l)))))))

; valid-degree-sequence? is a predicate that analyzes a list of integers
; representing the degree of connectedness of unique nodes in an
; undirected graph.  It returns true if the sequence is all zeroes or
; reduces to same, and false if it contains a negative degree or reduces
; to a sequence with a negative degree.
(define valid-degree-sequence?
  (lambda (sequence)
    (cond ((list-satisfies? zero? sequence) #t)
          ((list-satisfies? (lambda (x) (not (negative? x))) sequence)
           (valid-degree-sequence? (reduce-sequence sequence)))
          (else #f))))

; reduce-sequence does the actual work of reducing the degree sequence.
; If the sequence d1,d2...dn has enough elements such that n >= d1, then
; it will decrement the first d1 elements of d2...dn.  If there are not
; enough elements for this to be performed, the list reduces to the bogus
; sequence (-1), which will fail any valid-degree-sequence? test.
(define reduce-sequence
  (lambda (sequence)
    (cond ((> (length (cdr sequence)) (car (sort sequence >)))
           (decrement-n-elements (car (sort sequence >))
                                 (cdr (sort sequence >))))
          (else '(-1)))))