Certain friends and colleagues, asking me about the origin of my "Stanislaw" Facebook persona, have already been introduced to the shady night dweller "Stanislaw the Philosopher". Found in and around 1980 sweating over some maths and engineering textbooks in the wee small hours, listening to Mike McLean Through the Night on Radio Clyde, and occasionally sending in record links in the form of unbearably awful puns. Like this:
The king's gardener feared for his life. Long and hard he had toiled in the royal grounds, trying desperately to make the castle's fir trees thrive in the dry, dusty and too-barren earth. Nothing would work to save them. And now that his life was forfeit, he had begun to see ghosts during his nightly rounds. One of these came up to him, holding forth a small cloth pouch, and saying "These are the droppings of the kestrel hawk. Lime for this climate, bone for these flora. You must feed it to their roots, one and all. For either you and they shall die, or else neither."
The gardener did as he was bid. Three nights later, walking through the grounds in the dark of an otherwise still night, he now sensed those trees rising up before and around him, moment by moment blocking off a little more of the violet horizon. Was this truly and solely an imagination? Then too, he began hearing something wholly unaccustomed and chilling on the air, what was that sound? The raising of a distant breeze, the creaking of old bones and branches, the arrival of some new monster unseen?
Or kestrel manure firs in the dark?
On another occasion, Stanislaw the Philosopher posed a riddle from Raymond Smullyan's book of logical puzzles, What Is The Name Of This Book? The hardback book itself was sent to the radio station as a prize. Stanislaw then sent in the correct answer under the guise of his good friend Tom, who was subsequently baffled to receive such a book, from a radio station he never listened to, as a prize in a competition he'd never heard of.
But Seriously...
This whole confession is prompted by Eric Lippert's blog Fabulous Adventures in Coding, and in particular by today's entry, null is not false, part two. Eric starts off by using Dr Smullyan's deductive logic puzzle books to introduce the concept of multi-valued logic systems, including the nullable boolean. This 3-state scheme has the possible values: true, false, and null.
The rules of null are quite straightforward and obvious, if you think of replacing it everywhere with "unknown". So for example in arithmetic, we would have
X + null = null,
which translates as the self-evident "Anything plus unknown, equals unknown." Now in our 3-term logic,
false AND Y = false,
since whatever the second term might represent (including null), the first false makes the expression false. But this also implies that
X AND false = false,
which can be a problem for computer languages featuring short-circuit boolean evaluation. Eric considers the cases of the C# operators && and ||, which are specified as strictly short-circuiting operators, and asks the question, how should we evaluate
X && Y
when X is null? The truth table gives unambiguous answers: false if Y is false, otherwise null. But to obtain that answer we had to violate the specification that Y is only evaluated when X is true. Eric closes by saying "...either we sometimes evaluate Y when we shouldn't, or we sometimes return a value that does not match the value that X&Y would have produced. The way out of this dilemma is to cut the feature entirely."
So, the operators && and || are not "lifted to nullable". That seems a shame! I'd have preferred the alternative way out of that dilemma, where we allow nullable overrides of these operators, and simply replace the pair of statements
In the expression X && Y we evaluate Y if and only if X is true
In the expression X || Y we evaluate Y if and only if X is false
with
In the expression X && Y we evaluate Y if and only if X isn't false
In the expression X || Y we evaluate Y if and only if X isn't true
Here's how to steal sensitive information from users of either SharePoint or LinkedIn, via their web browser.
The method, known as frame sniffing, is unlike a conventional SQL Injection or cross-site scripting (XSS) attack, in that no code need be injected into the site. Instead, a target website crafted within the attacker's malicious webpage is simply loaded into a hidden HTML frame, once the CMS user is tricked into browsing to that page by any of the usual, socially-engineered means (e.g., spam email). As long as the user then keeps that tab open, the attacker can frame-sniff, for example running SharePoint searches exactly like an authorised user.
Paul Stone & Jacobo Ros describe the vulnerability in their video, and present some sample exploits, including a proof of concept that you can run for yourself, at the Context Information Security site:
Surprisingly, the attack works because often the default configuration of the CMS omits to secure against browsers which allow framing. The approach bypasses browser security restrictions intended to prevent webpages directly reading the contents of third-party sites loaded in frames. At the time of writing, only Mozilla Firefox has been updated to prevent frame sniffing.
Installations that are vulnerable by default include SharePoint 2007 and 2010. The vulnerability is easily stomped by tweaking the X-Frame-Options, forcing browsers to disallow framing on critical configuration server pages, or other pages that require an “authentic user click” - as previously described by Microsoft's Eric Law in his (two year old!) IEInternals article, Combating ClickJacking With X-Frame-Options. Obviously, since this setting will prevent SharePoint from being framed, it might break your installation, for example if you have another intranet app using SharePoint via a frame.
Good news: Microsoft have stated that the X-Frame options should be correctly set in the next version of SharePoint. Bad: at the time of writing, LinkedIn have yet to respond to Context's vulnerability report.
Linda's always been mad about Scotland's rugby squad, and just recently she's been busily accumulating points for badges on their Six Nations website to prove herself a superfan! As you can see from the above graphic, she's notching up some success in the endeavour, having collected 2,000 points and been ranked eleventy second (112nd) overall at that point.
Looks like their web dev could use a refresher on English ordinal numbers? This little exercise in natural language expression always reminds me of today's leap day calculation. It has just enough of an exceptional clause to ensure frequent failures of implementation. For every code monkey who ever forgot that last rule about years divisible by 400, another has forgotten the "teens" exception to the suffix rule,
1 takes "st" (so 1st, 21st, 101st, etc),
2 takes "nd",
3 takes "rd",
everything else takes "th".
The exception is of course that any number ending in 11, 12 or 13 takes "th", instead of the corresponding suffix for 1, 2 or 3. The close analogy with leap year rules is striking, as its etymology has nothing in common with the scientific basis of the latter (which itself does have direct analogies to things like modular arithmetic, games of Monopoly, and drawing smooth inclined straight lines on a pixel raster).
Update (1st March): Since the time of writing, Linda has climbed to rank 75th nationally with 2,600 points, and been promoted from "National Squad" to "1st Cap". Problem solved! Update (3rd March): 66th nationally, 3,100 points, promoted to "Starting XV". Girl takes her rugby seriously.
Update (17th March): 57th nationally, 4,700 points, promoted to "Captain". Meanwhile, the team collected yet another wooden spoon today.
New York-based film writer, director and editor Kirby Ferguson's brilliant little set of four 10-minute videos, Everything is a Remix, produced over the course of two years, reminds us of the original motivation behind copyright and patent law. Namely, to create a short period of controlled monopoly, allowing inventors and creators to recoup their development costs. And emphatically not to allow those rights holders to continue to profit almost indefinitely from their creations, while preventing others from doing anything similar or related.
On second thoughts, make that a photo essay. With a final score like that, I don't really feel like talking about it very much.
This year we sprang the extra £25+ to park within Murrayfield. A couple of practice fields behind the West Stand were provided for the purpose, a great improvement on the usual Edinburgh parking experience.
In January Adam Shostack, famous hereabouts for the SDL card game Elevation of Privilege, wrote about the murder of his Zero-Knowledge Systems colleague (pictured right) Ulf Möller (link to original Bild.de report, in German).
Yesterday, Adam wrote again about the case, pointing to a website created by Ulf's family containing several good quality surveillance camera photographs of his murderers (pictured below), explaining the background to the case (in English, German, Polish and Lithuanian), and asking everyone to help find the killers, and spread the word:
The two men are described as slim, both about 1.75 m to 1.80 m tall, between 20 and 30 years old. One of them was wearing a dark jacket with a fur-like hood. The surveillance cameras took clear pictures of his face. The other killer was wearing a noticeable light blue quilted Nike-brand jacket.
We are grateful for any help in finding the murderers. Clues can be reported to the German police (Polizeidirektion Sachsen-Anhalt Ost, who are leading the investigation) by calling +49 340 6000 293, by sending e-mail to lfz.pd-ost@polizei.sachsen-anhalt.de, or by visiting any German police station. If you prefer, you can email us directly at mail.ulfm@googlemail.com.
Homage to Science Fiction's grandmasters.John And Linda's Big French Adventures Notes from our 2010 & 2011 Brittany holidays.So Long PCW, and belatedly, Sub Set Thanks for my (rewarding, but brief) writingcareer.Sony FB: Part One : Part Two Evil Corporation in Bait And Switch!Wee Mac The story of our Border Collie (1993-2009).What's in a Gristleizer? Life as a solder jockey; recycling Golden Virginia tobacco tins.
