Jan 122014
 

Computers have gotten faster … a lot faster. In some cases there is never enough speed, but to a certain extent today’s computers are not noticeably faster than computers of a few years ago. At least not if you do not run benchmarks. So there is little incentive to upgrade that 5 year old desktop machine – unless you are running Windows XP of course (support for which will be dropped soon).

Unless of course you look at aspects other than simple speed – such as reliability.

A few years ago I used to run old Unix workstations in preference to PCs despite their lack of speed, because they were simply more reliable – I could leave a workstation running for weeks without any negative effects. Whereas the PCs I was used to using were just not quite as stable; every so often something unexpected would occur and a reboot would be necessary. Usually at the most irritating possible time.

We expect computers to be reliable, but are all too often disappointed.

Desktop manufacturers may be able to revive the flagging market for desktops by offering something new – desktops with reliability. There are a number of reliability features that are commonly found in servers that could be offered in desktops with only a marginal increase in cost.

Error Correcting Code Memory

Forget the “code” part in the title; without going into a great deal of technical detail, ECC memory automatically corrects memory errors when they occur. And occur they do.

There are a variety of causes of bit errors within memory varying from cosmic rays to atmospheric radiation; the cause does not matter so much. What matters is how frequently they occur. According to small studies and theory, they should be quite rare, but Google have released a paper actually measuring the error rate in a large pool of machines; the error rate is roughly about 5 single bit errors in 8 Gigabytes of RAM per hour.

If true, that’s more than enough to have a significant impact on the reliability of your average desktop PC. If a piece of software has some random instructions changed into something else, it will usually crash or do something strange to your data. Or if that random memory error occurs within your data, then you might expect a strange coloured blob to appear in your favourite photo.

Normal desktop PCs do not come supplied with ECC memory because it is slightly more expensive than ordinary memory. Without going into details, ECC memory uses additional memory to maintain a check on the contents of main memory.

And that costs more. Not a lot more, but in a competitive market, a small saving may lead to increased sales. Of course there are other ways to increase sales – such as by making a feature of ECC memory and reliability.

Storage

We are currently in a transition period between mechanical storage (disks) and electronic mass storage (flash). Flash storage currently offers very fast storage but with a price tag attached meaning it is infeasible for large amounts of storage. That will of course change.

In the meantime we have to deal with two storage solutions; one with a reputation of unreliability (flash) and one that is really unreliable (disks). Both fail with regrettable regularity (although discs will fail more often!) but fail in different ways. Disks themselves are likely to have a short period where they do not work very well before refusing to do anything, although as mechanical devices they can fail in surprising ways too! Flash will tend to fail in a rather nice way – it will get to the point where all attempts to write will fail, but all of the information is still readable.

Because they fail in different ways, we have to cope with their failure in different ways too. Except for the most obvious thing – everything needs to be backed up. And of course getting a backup mechanism up and running is a pretty tedious task.

It would make a great deal of sense for a vendor to offer a cloud-based disaster recovery backup for your system disk(s). An account with a copy of the system disk image is created before your system is shipped. And once on line, your desktop PC sends updates to that image in the cloud. And when the disk fails, you can ask the vendor to ship a replacement disk with almost everything you previously had already put in place.

On a more general note, it is worth mentioning that most consumer hard disks at the bottom end of the market are complete rubbish. And I would pay extra to buy disks from a vendor that :-

  1. Takes ordinary disks and burns them in for a week to verify that they are not going to go bad in the first few months; there’s a NAS vendor (whose name escapes me for the moment) that does this and has one of the lowest disk failure rates on the market despite using relatively cheap and nasty disks.
  2. Ships them in proper packaging that absorbs the shipping bumps and knocks. Just because a disk drive looks intact does not mean it is safe to use.

 And What About The File System?

So far it has all been about the hardware, but there is more we can do about reliability in software too. And carrying on from the previous section, one of those areas is how the operating system stores files on disks.  The software module that does this is (to use the Unix or Linux term) the file system and there are different kinds.

Historically different file systems have assumed that the storage is perfectly reliable. However with the increased awareness of silent data corruption, there are now a few file systems that check for silent data corruption – including what is probably the first: ZFS.

Even if there is a small loss of performance, file systems should detect silent data corruption and correct if possible.

Preparing To Fail

We all know that software is unreliable; to be precise it is not perfectly reliable as it is a great deal more reliable than we give it credit for. After all we only notice the failures; and some of the failures at that.

Rather than trying just to produce reliable software, programmers should be designing software that fails safe without losing any data. See crash-only software.

Jan 112014
 

As categorised, this is a “working note” and explains how I ‘down mix’ quadrophic FLAC files into stereo files with the assistance of sox. This may well not be the best method and indeed I may be getting it totally wrong – who knows what two channels are supposed to go where?

It turns out that my portable media player doesn’t understand FLAC files with more than two channels, and as I have a number of these obtained from somewhere I needed a way to make them playable. The first step is to identify FLAC files with more than two channels. It turns out that the venerable file does that quite adequately :-

% file one.flac two.flac
one.flac:              FLAC audio bitstream data, 24 bit, stereo, 96 kHz, 24179840 samples
two.flac:              FLAC audio bitstream data, 24 bit, 4 channels, 96 kHz, 24179840 samples

As you can see the third column of the information about the file identifies the number of channels; it also identifies 5.1 surround sound files as 6 channel files. And quite possibly wilder and woollier kinds of channel numbers too.

Now onto the conversion. This is simply the following :-

% sox input-file.flac output-file.flac remix 1v0.5,3v0.5 2v0.5,3v0.5 norm
% file output-file.flac
output-file.flac:      FLAC audio bitstream data, 24 bit, stereo, 96 kHz, 24179840 samples

The details of what sox command to use … and specifically the remix parameters came from a post discussing the problem here. I’m not qualified to assess the details, but the results seem fine. For extra points, the remix parameters for 5.1 surround sound are: 1v0.3694,3v0.2612,4v0.3694 2v0.3694,3v0.2612,5v0.3694.

Dec 212013
 

First of all, take whatever seasons greetings you would like from the list above, and ignore the others.

And now onto the ranting.

Reading some US-based Atheist blogs, it appears that our friends on the other side of the pond can sometimes get a little wound up about what seasons greetings they receive. To the extent that a woman has been punched for saying “Happy Holidays” – hopefully the assailant will get prosecuted for ‘aggravated assault’ or something equivalent. After all getting physical with someone who has deliberately insulted you is wrong; getting physical with someone who has just wished you well is downright evil.

Except for occasional outbreaks of gross stupidity such as Birmingham’s winterval controversy, people in the UK are just a little bit more sensible about the whole situation. In particular christmas is not seen as an exclusively christian event – to the extent that I’m seen as a little weird when I wish people “Happy Winter Solstice” (and I’m happy to be thought of as weird!) even though people know I’m not a christian.

Christmas isn’t a christian event? Of course not. Even christians don’t do the religious thing over the whole period; for most there is just a short christmas midnight mass and then it is back to eating and drinking too much in the company of family. If I were the christian god, I’d be shouting “Get on your knees you miserable sinners” the whole period.

And bear in mind that some of us get confused as well: I recently wished someone a “Happy Winchester” as a seasons greeting.

Dec 032013
 

Before those po-faced spoilsports start jumping up and down screaming that Christmas is supposed to be all about the baby jesus, let’s take a look at the origins of Christmas…

Turns out that it might not be an exclusively Christian thing after all – despite “his” name being right there in the name – as it seems there have been other religious festivals at around the same time of year. And long before Christianity.

After all the puritans did oppose Christmas as being too “pagan”. And there is a lesson to be learnt from the mistakes made during the English Civil War – however long ago it may have been – whilst the ultra-religious are perfectly free to believe that Christmas is all about religion, it is plain that the overwhelming majority of the population are more interested in the party aspect of Christmas.

No harm in that. There’s a lot to be said for having a party or two with friends, co-workers, and family in the “bleak mid-winter”. No reason to introduce any religious poppycock if that isn’t your thing.

But where did this notion of paganism in association with Christmas come from? It turns out that having a mid-winter festival has been popular for ages :-

  1. Yule is a Germanic mid-winter festival that has vestiges in our current celebration of Christmas such as the Yule log and probably the Christmas tree.
  2. Saturnalia was an ancient Roman festival in honour of the god Saturn marked with revelries and gift giving.
  3. The Winter Solstice has probably been “celebrated” as a brief time of plenty before the famine months of winter begin, for thousands of years. Holly, Ivy, Mistletoe are all aspects of Christmas with a potential pagan past.

There is a tradition that the date of Christmas was deliberately chosen to match the dates of existing religious festivals; whether this is true or not is almost irrelevant. What is almost certainly true is that the importance of the christian festival of Christmas owes a great deal to earlier mid-winter festivals.

After all Christians are masters of the art of syncretism.

Dec 032013
 

People like me keep banging on about why the security of passwords is so important. We keep telling people they need strong passwords, when what people really want are easy to remember passwords. Of course we keep on saying the same message because not everyone pays any attention.

The truth is that it is possible; or at least partially possible to have both strong passwords and relatively easy to remember ones. But first why is it necessary at all?

The sad fact is that there are criminals out there; not spotty teenagers in basements having some sort of weird fun, but genuine criminals who want your account details for a variety of reasons. Organised crime has moved on from bathtub gin, bank robberies, and drugs realising that (amongst other activities) computer crime can be quite profitable with a lower risk of being caught.

The most obvious accounts targeted by criminals are bank accounts – online access to your bank. Whilst they will target such accounts, criminals will also target the most innocuous accounts as well – your ISP account, or a work account. The lowest level of usage of a stolen account is to send spam; not in vast quantities but even several hundred spams sent in your name can really ruin your day.

And will continue to have a less obvious negative effect over time – your email address will be less trusted by recipients if it has ever been used by a spammer. And of course that is the damage I know of. The criminals may use your account for other purposes.

In fact it is probable that any stolen account has a small but definite value on underground markets such as the Silk Road (or deeper and darker places).

And that is excluding the damage that criminals can more directly cause you by access to all the data contained within your account.

How Do Criminals Get Your Password?

So how do criminals get hold of account passwords? It turns out there are three main methods, and one is only useful in certain circumstances (and happens to be the most technical and so the most interesting to geeks).

Just Ask!

It may seem crazy, but probably the easiest method of obtaining account details is simply to ask for those details! The question is normally dressed up to confuse the situation so that it appears to be a legitimate organisation asking for the password. An email from your bank asking you to login via a provided link; an email from your IT support department asking for your password to increase your mail quota.

The defense against this is to never tell anyone your password. Your password is a method of demonstrating that you are yourself; if you give it away, you let other people pretend to be you.

Don’t do it.

Just Guess!

Some people use passwords so weak that they can be guessed relatively easily – or at least easily when the password guessing is scaled up. If a criminal has a 0.001% chance of guessing a password, but they try 1,000 different accounts with 10 different passwords at 1,000 different sites per day, they can expect to get 100 accounts a day!

The best defense against this sort of attack (for an individual) is to make sure you do not have a weak password – go for one that is long and strong (we’ll get to that later).

Password Cracking

The last method of getting account passwords is only possible with access to the password hashes which normally involves exploiting some kind of vulnerability. Once access to those hashes is obtained, it is possible to use a password cracking dictionary to generate a list of candidate passwords and calculate the password hash for each one. When the hash for a candidate password matches the hash of a real account, you know what the password is.

It shouldn’t be possible for a criminal to get access to password hashes, but they do get access to them on a regrettably frequent basis. In addition, it is not uncommon for password cracking to be used as the ultimate test of whether a password is “strong enough” – if it can be cracked with a reasonable level of resources, it is weak.

The best defense against this kind of attack is again to use a long and strong password.

Long And Strong (And Memorable) Passwords

The best passwords are long and random, but very definitely not memorable – as an example, a typical random password might be Y2JkOGY3OTg0YzY1NGMyNTUxMmUzZDkyNDFhZTU2OWYgIC0K. Not the sort of password anyone would want to remember, although password stores such as LastPass allow the use of such passwords. Certainly worth investigating.

However it still needs a master password and there are other circumstances where passwords you have to remember are essential. In such cases memorable becomes a requirement, but we still need strong passwords.

For most of us, a memorable password is made up of dictionary words, yet we are often told that a word-based password (no matter how cleverly transformed it might be) is a weak password. It turns out to be correct for single word passwords, but multi-word passwords are still relatively strong. A lot weaker than truly random passwords of an equivalent length, but somewhat surprisingly a lot stronger than short truly random passwords.

The mathematics of this gets a bit hairy, so take it on trust – length is the most important factor in determining password strength with certain exceptions (a very long word isn’t strong no matter how long it is).

The XKCD Password strength comic

Stringing together a whole bunch of words may not seem the most sensible way to come up with a memorable password; in fact I’ve been using a five word password for many years, and at this point I can’t forget it! I would suggest though that the XKCD method can be strengthened a wee bit by adding a symbol between every word – pick a random symbol like “@”.

Now pick three to four “random” words, and string them together with your random symbol :-

${word 1}${symbol}${word 2}${symbol}${word 3}${symbol}${word 4}${symbol}

Becomes: four@blatter@pong@zoo@

One thing to watch out for – you should have at least one “unusual” word in the list of random words, and don’t have too many short words – the password trustno1 is a weak password!