Web Of Shite

Dear Mr Osborne,

I am writing today to urge you to go more on the offence against Mr Brown and Mr Darling over Northern Rock.

It is my fervent belief that Labour is going to completely destroy this company and would be further outraged were this not to be the catalyst for getting that load of schysters out of power before there’s nothing left of our reputation and economy.

The government appears to have lost sight of the fact that 75% or Northern Rock employees were shareholders. Northern Rock was a model employer, its employees took part in Share Save and were rewarded well with bonuses all of which meant that many had holdings in the 10s of thousands of pounds. The capital gains tax regulations would have made it extremely difficult for the employees to dispose of these shares at the “right time” finding themselves locked in for taper relief.

These same employees, now completely wiped out by Nationalisation, no-doubt share the same sentiment as every other Northern Rock shareholder - that the Labour government played no small part in the companies down-fall.

These same employees are now those the government will be relying on to help rebuild the business. Not exactly a formula for success.

The Labour party has a history of contempt for shareholders. During the Railtrack years shareholders were despised as “grannies” and these days we are derided as “speculators”, “carpet-baggers” and “bottom feeders”.

The shareholders of First Group were congratulated by a cross-party group of MPs in 2006 for “the innovative use of their shareholdings to raise the issue of FirstGroup’s violation of basic human and labour rights at the company’s annual general meeting on 13th July” - so there appears at-least some evidence that shareholders have capacity for good.

The fact is, as I would fully expect a Conservative to appreciate, that shareholders are the life-blood of capitalism… we provide the capital that creates business, wealth, jobs and innovation. We are card-carrying capitalists, even the little old grannies.

So it should perhaps be no surprise then that New Labour are torn between the two ideals of (new) Capitalism and (old) Socialism. They are forced to endure Capitalism in order to govern this Nation, however if their handling of shareholders both through Railtrack and Northern Rock is anything to go by then one must conclude they have still to reconcile their beliefs fully.

If I may draw your attention to what the Times said on 17th July 2005:
“Compensation is normal when democracies nationalise private firms. Gordon Brown’s Treasury refused to acknowledge this. Its memos oozed contempt for ordinary citizens. It apparently hoped that by manoeuvring Railtrack into bankruptcy, it could get Railtrack for nothing. And this from a man who last month lectured African governments on their probity.”
[http://www.timesonline.co.uk/tol/comment/article544925.ece]

So to the purpose of this letter. I recall how effectively Theresa May MP crucified Mr Byres during commons debates over Railtrack. I have seen no repeat of this from the Conservative party over Northern Rock. The attempts from yourself and Mr Cameron have been rather pathetic to be honest.

I think there is much political capital left in Northern Rock.

I hope your party will take up the battle for shareholders property rights, and not allow the government to attempt to repeat the Railtrack scenario again. I see they’ve learned at-least some lessons from Railtrack having slapped in an FOI exclusion this time.

Having the independent [sic] assessment fixed by terms which mean shareholders will be offered nothing will serve only to drag everyone through expensive legal proceedings to neither the benefit of the taxpayer nor the shareholders.

It is my belief that the failure of the tripartite authorities and the disclosure of the LOLR facility played no-small role in Northern Rocks collapse, and I am certain a truly independent review would reach the same conclusions. As such I hope your party will be pressing for such an independent review of the situation to be led by members of professional and non-government associated organisations, this means no organisation who receives a significant amount of their revenue from government work should not be involved. The British Bankers Association and Bar Association would be high on my list.

I include below a copy of a letter sent recently to the Chancellor from my self.

Kind Regards,
Gerard Calderhead

Dear Mr Darling,

I am disgusted at the proposed Northern Rock compensation order.

In what world is it fair to fix the terms of independent [sic] valuation based around the company being unable to operate as a going concern and is in administration? How exactly is that independent? The company is a going concern, has assets in excess of liabilities and is certainly not in administration.

If all value in the company disappeared the minute LOLR and guarantees were provided then surely the company was trading in a false market for some months. You will recall that Bryan Sanderson asked the FSA this very question on no less than two separate occasions was told the company was NOT trading in a false market.

Your position is both untenable and indefensible.

Surely proper independent assessment is in everyones best interests, rather than yet more political grandstanding from the Treasury. I have every confidence that the shareholders will eventually win their fair and due compensation for violation of their private property rights.

Does the Government see any irony in the speed with which it criticised the Putin Government for violation of private property rights in the state seizing control of private Russian oil companies?

All this bluster about protecting tax payers interests, presumably against those evil shareholders, is quite sickening. Not only am I a high rate tax-payer (that’s right unlike Ron Sandler I am not “non-dom”) but I also pay taxes on my investments in the form of capital gains and stamp duty.

Does the Government see any irony in encouraging savings, investments and indeed shareholding on the one hand (for example tax efficient share ISAs) - and then on the other thieving from and demonising those same investors who follow their advices?

I am amused at the Jekyll and Hyde nature of this Labour government who are unable to decide if they are fans of private capital or not. On the one hand the governments advisers rank amongst the largest investment houses in the world. Yet on the other they are quite happy to seize private property owned by a different set of private capital providers.

It might interest you to know that I was born and raised in the village where Keir Hardy grew up, and went to School with the son of John Reid. I lived most of my young life but yards from a public building baring Mr Hardy’s his name but I doubt he would recognise your organisation these days.

Still, although it may take a couple of years to get the compensation properly due us shareholders at-least we can take solace in the inevitable downfall of this Labour government - a shower of self interested, hypocritical, incompetent charlatans you surely are.

I’ll leave you with this thought: In the world of money politics 180,000 providers of private capital can do a lot of good or bad.

I really hate ID cards and deeply resent the government trying to force us down this road.

This document is an interesting read.

Spread the word.

Whilst debating the level of crapness of many of the “newest” ideas in interactive television with a colleague we got onto the subject of Convergence and the abuse the term suffers at the hands of the technology impotent.

A service being widely regarded as a Killer App on platform A does by no-means guarantee it’s Killer App status will carry through to Platform B. Consider instant messaging which is by all accounts a Killer App on the PC and, to a lesser extent, on Mobile. Will making such a service available on a Set Top Box make it an overnight shining success - highly unlikely. PCs and Mobiles are active-personal where-as a TV is usually passive-shared.

Will I attempt to have a private conversation over an episode of Eastenders with my family/friends in the room with me? Unlikely.

Yes, sticking instant messaging on the TV would be an example of TV being convergent with PC and Mobile - however it’s a shallow attempt to imitate its success on TV.

For such dumb ideas my term of choice is Clonevergence.

There are a lot of Phishing websites out there at the moment and they are largely living on shared web hosts. These vary from ISP provided homepage hosting to commercially provided hosting for small businesses.

Generally what happens is either:
* A weakness in the software running the website is exploited
* The owning user has a really dumb password which is brute-forced
In either case an attacker is able to upload arbitrary content and code allowing them to use to compromised users hosting to launch a Phishing attack.

The approach many in the industry are taking is to make the browsers smarter and able to inform the user that they have navigated to a suspect site. However I wonder if there’s something we can do on the server side to trap such attacks and take those sites down either automatically or through some timely notification to the administrator.

I have thought of some ideas:
1) Analyse Apache access logs and checks URLs being hit on the server against some externally provided blacklist, such as PhishTank. If it is found that the host is compromised then the administrator can be emailed or some other appropriate action taken.

2) An Apache plugin module which, similar to (1) above, will check URLs being hit against a known blacklist, if it sees a request to a known phishing URL it would return a 405: Permission Denied instead of serving up the content - call it mod_phishtank.

3) A script that monitors the access logs, again, try to develop some heuristics which spot suspicious activity. This may include newly uploaded content being accessed from many users over a short period of time which accepts form data and where the original requests carried an off-site (or no) HTTP Referrer header.

4) A script that monitors the access logs such that if the requested URL itself looks suspicious (e.g. http://gerry.com/www.ebay.com or www.ebay.com7account7loggin.dll.gerry.com) then this could be regarded as a new Phishing attempt.

5) A script which periodically runs through ALL content stored on the physical disk for each user and scans them for anything that looks suspicious. For example if any web content contains “.*welcome.*bank” it may be a clue that this is Phishing content.

There is certain appeal in sites which are verified on PhishTank’s database as Phishy being removed automatically by the Apache instance which serves the content, though I am in two minds about whether such a module as described in (2) above, would actually find its way into general use.

Developing heuristics to judge the phishyness of a site based on the logs and other key data also seems like a good idea in general. This is especially true since many of the web forgery sites we see contain randomly generated garbage as part of the domain (e.g. www.barclays.co.uk.procid9343423.hacked.com) which means a simple and dumb blacklist is not going to be enough going forwards.

I have been concerned about the “property” fever sweeping the UK in these last years. Living in London property is one of the main topics of conversation, probably due to the unique characteristics when compared to other areas of the UK.

For what it’s worth: London has a population of 7.5 million in an area of 1,579 km². Compare that to Scotland where the population is around 5 million and an area of 78,772 km². That means London has a population density about 75x greater than Scotland.

So I’m sure you’ll appreciate that with such a population density and with the continual churn of people coming and going people in London like nothing more to talk about property - especially those trying to get onto the “property ladder”.

The average house price in the UK for a first-time buyer is around £150,000 and rising at around 7.5% per year. The UK Consumer Price Index (rate of inflation) is currently around 2.7%. Meanwhile the average wage rise in the UK is around 3.7%.

So that means property prices for first time buyers are rising at around 2X rate of pay increases and at about 3X the rate of price rises in consumables.

To put a slightly different slant on it: the recommended minimum deposit you should have to take out a mortgage is around 5% of the property value, which works out at £7,500 for a first time buyer. With average salaries of (being a bit generous) £25,000 this means that in the time it will take you to save up your %5 deposit you’ve actually lost money because of the corresponding increase in equity on the property and corresponding increases in fees and taxes and interest payments.

Consider. Property prices in the UK are on such a boil that every month you wait it will become harder and cost you more money to get in. Think about what that means.

I don’t like it. I don’t like it one bit. It is quite simply not sustainable for the cost of residential property to rise faster than earnings because that means these rises are fueled by increasing debt.

This isn’t a property ladder… it’s a Property Pyramid. In order to move up the Pyramid into a shinier new home you need to sell your current one for more than you paid. This means that as you move up the Pyramid you do so standing on the shoulders of those entering the market behind you. They market can’t keep growing, debt keep increasing and the pyramid keep getting higher forever - soon the base will no longer be able to support the weight.

As far as I’m concerned the UK Property market currently meets all the criteria for classification as a Pyramid Scheme.

Did you know:
* Since 1995 the average house price in the UK has almost doubled.
* The financial times in December urged investors to “diversify away from property”.
* Interest rates are at their highest now since September 2001.
* Morgan Stanley and PWC are predicting a housing market crash before 2010.
* Stamp duty and Inheritance Tax last year contributed over £6 billion to the economy (about £100 per head for every man woman and child in the UK).
* Estate agents commission on sales is worth over £1.2 billion per year.
* I wonder how much the Lawyers made.

I don’t take responsibility for the accuracy of these figures. All are based on reports I’ve read on various websites and from newspapers. Do not rely on these as the basis for any financial decision, do your own research and draw your own conclusions. These are my opinions only.

So I recently got the following Gem in my mail inbox in amongst the flood of returned spam mails that spammers are spoofing from my domain (so much for domain keys)…. but that’s another matter.

Dear Mr Calderhead,

You may already be aware that you have recently paid the maximum cash fare for a Tube or DLR journey. This has been deducted from your Oyster card.
To avoid incurring this maximum cash fare again, it is important to remember to always touch in at the beginning of your journey and touch out at the end of your journey when using your Oyster card, even if the ticket gates are open. For more information, please click here
To check your recent journeys, you can use a touchscreen ticket machine at most Tube stations or log on to your Oyster account online at tfl.gov.uk/oyster
Please note that National Rail only allow customers with Oyster to pay as they go on some journeys, for a list of routes please click here

A very reasonably worded e-mail. Obviously. Given that this affects the wallets of several million people who live and work in London it’ll come as no surprise that it’s well worded. It is of-course total bollocks.

Let me put a sense of scale to the problem facing TFL here:
* There are systems that predict the movements of stock and currency markets
* TFL have a system that can track and bill millions of people every day using Oyster
* TFL have a system which records every car that passes one of their many congestion cameras

But my daily commute… now there is an intractable problem!

It would be a piece of piss (given the data they are collecting on us from Oyster use) to make a fair and balanced decision about how much I should be charged for a journey where I failed to press my Oyster card against a reader on exit.

Some very simple analysis will show that I beeped in (say) at Heathrow terminal one and surfaced again the next morning in Chiswick… hmm… I wonder where the mystery journey ended!?!

The only conclusion is therefore that they do not want to make fair decisions as it’s not in their interests to do so - much better just to charge a blanket rip-off “Penalty Fee” and use the money to pay for the Olympics. Most robbers wear a mask.

I use VMWare an awful lot these days - it’s just so darned handy for development since you don’t need to worry about maintaining multiple environments - just give each one their own virtual machine. Lovely.

However, I hit a bit of a snag. All my VMs are based on one image which I replicate whenever I need a new VM - and the image was setup with a 5GB virtual disk. Ordinarily that’s plenty - but not this time. Sadly the software I’m working on has an environment that weighs in at almost 2GB.

So rather than starting from scratch and reconfiguring and reinstalling a shiny new VM, which would probably have taken the better part of two days, I thought it best to investigate whether and how I could “simply” give the image more disk to play with.

After a bit of digging I discovered an application on SourceForge (where else?) called VMManager and downloaded it to have a play. A neat little application (though the UI is a bit on the crap side) which allows you to create new VMs and modify the parameters of existing ones (add devices etc. etc) and ultimately begs the question - why do I need VMWare workstation anymore? But I digress.

So VMManager will let you increase the size of your virtual disk. So, job done? Errr… no. Increase the size of the virtual disk and delete the nvram file - which VMWare player will very kindly recreate with your new disk parameters (i.e. bigger) and the image will boot — hooray.

However your job is not yet done. All you’ve done is make the hard-disk bigger, now you’ve got to increase the size of the partitions and on Linux it’s not as easy as with Partition Magic.

To change the configuration of a partition in Linux the application doing so needs exclusive access to it (i.e. it can’t be mounted). So since muggins here didn’t bother partitioning off /home when he set the thing up it means I’ve got to boot from a live CD so I can run gparted

Okay so off I go and get the gparted live CD - what a neat idea. This is where I hit my first trivial snag, I’m using VMWare Player so can’t change the VM config. Fortunately VMManager took care of that and a quick ESCAPE whilst the VM is coming up takes me to the boot menu where I can tell it to boot from my virtual CD ROM - which is hooked up to my gparted live CD.

All cool, gparted comes up… I’m starting to get excited when… er… why is my root (”/”) partition an “unrecognized format”? I could have sworn I was able to access it earlier when I booted from it, after the resize. Oh well, I guess VMManager might have confused it… e2fsck to the rescue!

Err… no. Can’t find the master block or some nonsense. By this point I’m scratching my head and being generally bewildered. Boots back into my normal VM, comes up no problem, opens /etc/fstab and indeed the partition is ext3… not even that but I’m in it now, reading files from it. WTF!

It’s at times like these that a voice of sanity is required. Since I don’t know anyone suitable I was left with no other option - I MSN’d Michael with something of my usual level of eloquence like “Greetings Dude. You know how Linux disk formats are widely regarded as bullet-proof? Well… err… they’re not”. This, as one would expect, was met with a resounding “What the fuck did youdo?”.

After explaining the situation to Michael he exchanged ideas, I exchanged frustrated expletives until finally his 31337 G00G13 5K1112 uncovered that FC5 (unless you’re awake when installing) will try to turn on Logical Volume Management during the install… and the penny clicks. I was wondering what that crazy ass volume nonsense was in /etc/fstab that looked so new to me but which I singularly failed to connect to my current problems.

Okay so no-way I was doing this with gparted since it doesn’t support LVM. Bugger. So now I have to go off and google for a bit myself to figure out what this stuff is all about… and I’m not helping you out, you can do the same thing yourself if you really want to know.

So I grabs myself a copy of SystemRescueCD and again boots my VM from disk. SystemRescueCD comes with the necessary command line tools to manipulate the volumes on your disk… whoopee.

So leaving out all the confused steps the flow goes something like this

      vgchange -ay    # Activates all volumes, a good place to start.
      run_qtparted    # used to turn that free space into once big partition
      pvcreate        # turn new partition into a physical volume
      vgextend        # add physical volume into my existing volume group
      lvextend        # add the new space onto my logical volume for the root / partition
      e2fsck          # repair the root / partition… it needed it for some reason
      ext3resize      # to actually grow the ext3 partition to consume all that lovely spave

Yes I know I left all the parameters off, but you don’t expect me to do your googling for you… do you? Just remember your Volumes usually appear in /dev/Vol<group></volume> once you’ve activated them from where you can mount them and get at them with e2fsck etc. and you should be able to figure the rest out.

Geographically Aware web-sites are starting to appear with increasing frequency, this article attempts to show how I achieved this myself.

This article, and the work I've done in this area, has been inspired by a pretty neat web-service I was introduced to by a friend and fellow geek. The site is called GeoURL and it allows web publishers and bloggers, via mechanisms which are the subject of this article, to associate a geographical position with some HTML content. To put this in context, if you were writing an article about Tinto Hill then you could embed within the article a pair of meta-tags that provide a short description and the physical location of the hill.

So the idea as conveyed by this example is very simple. The meta-tags in questions are given in this example which is used for this very site:

The "ICBM" tag is so named because Inter-Continental Ballistic Missiles were loaded with lat/long coordinates to determine their targets.  These coordinates are simple latitude and longitude separated by a comma (western hemisphere longitudes and southern hemisphere latitudes are negative).  If you are in the UK the easiest way to get these is to use StreetMap which once you've located the place in question (say using the postcode) gives an option beneath the map (you have to look quite hard) to "Click here to convert/measure coordinates"

The other two tags called "dc.title" and "dc.title.alternative" are references to types of element defined by the Dublin Core Metadata Initiative which is an attempt to devise a standard way to describe things such as people and places as part of the wider Semantic Web project.  If all of that means nothing to you, then don't worry - you can plainly see what the purpose of these two tags is so just use them and forget about why for the moment. The interesting stuff is coming up.  How to extract these meta-tags from a web-page is an exercise I leave to the reader, it's something that is fairly bog-standard for most developers these days - failing which you may consult my very hacky sample code.

A longitude and latitude are angular measurements which can be used to provide angular coordinates for any position on earth (with varying degrees of accuracy). These measures range from:
* Longitude: 0° at the Meridian of your choice (Greenwich?), 180° Eastward and -180° Westward
* Latitude: 0° at Equator, 90° at North Pole and -90° at South Pole

Angular coordinates is something most people will not be familiar with. Ultimately it is easier for us mathematical simpletons (myself included) to deal with metric coordinates. It is possible to convert lat/long coordinates into something more akin to what we are used to dealing with, that is X,Y offsets in meters or kilo-meters - however there is a catch. The earth is not perfectly spherical and as such it's very hard to calculate a "map projection" so the method we shall use, the Universal Transverse Mercator, adds a little complexity in the way of UTM Zones. You are encouraged to read the wikipedia article on Universal Transverse Mercator as it's very good and does a far better job of explaining this that I ever could (without plagiarising it of-course).

For those seeking an easy life here's a PHP Implementation written by Jim Studnicki that I've used in my demo app.

Using the UTM system we are able to convert lat/long coordinates into an Easting (meters), Northing (meters) and a UTM Zone. If we have any two within the same UTM zone then we can easily calculate the straight line distance between these points, or putting it slightly differently if we had a database of places we could search it for those close to a certain point.

An example of such a database table (mySQL) is given below. The table is URLs and their descriptions stored along with the Easting, Northing and UTM Zonings.

To find URLs near a given point we first calculate our bounds. If we take the example where our boundaries are 9Km then this is easily calculated (in PHP style syntax) from the Northing and Easting of our known point by:

We are now ready to construct a SQL query (mySQL query constructed in PHP syntax) which will search for places within 9Km in a straight line from our known point.

If you put all of these together then you too can build GeoURL style website (or using these principles any other kind of Geographically Aware Website) all of your own.   I've been thinking of doing one for Geek-Code but haven't the time nor inclination at the moment. The code for my prototype is available for you to thieve if you will, though you should note that there is some third-party GPL and other free to use licenses in there (acknowledgements in the main source code file).

That's it, happy hacking.

I have a very specific problem I want to solve quickly. I want a script that can be used to control a service (lots of attributes you can check, set etc.) however users mustn't be allowed to see or touch the config file. This means running suid as root or an appropriate user.

I will acknowledge that SetUID on a perl script is probably not best from a security perspective, but thankfully (in my scenario) it will not be running as root.

The snippet below shows a perl function which uses "who -m" to discover the user connected to your stdio/tty which is not necessarily the same as the user logged in or the suid you are running the script as. It is basically the user under which access to the system was granted for the given tty. It then gets the groups to which the user belongs and checks to see if the group is in one of the admin groups allowed to run the script.

There is probably a much better way, but I quite like this.