iTunes 8. Now With a Piece of 'Genius'

Some of you might have noticed that Apple introduced a new and improved iPod Nano, and some other iPod hardware. Apart from the hardware, they also released iTunes 8.

No subscription model for the music, but (apart from some other improvements) they added a Genius function. The Genius analyzes your music library, and makes suggestions on the music your playing. Cool feature since it finds/suggests songs with the same mood, but there's room for improvement.

Genius Playlist?? Genius Playlist??The following screenshot shows a overview of the 'Forty Licks' album of the Rolling Stones. As you might notice, the Genius in iTunes recommend that I seem to miss. I can buy these songs on the right. Notice the missing songs and the ones I marked in yellow.... Okay, one of them is spelled wrong (Jumping instead of Jumpin'), but the others are correctly spelled.

Even a Genius Makes a Mistake Even a Genius Makes a MistakeThis doesn't only occur on the album of the Stones. It occurs on almost every album/song I play.

Is Apple trying to earn an extra buck? Or is there a vacancy for a real Genius? Anyway, I'd love to have this feature on my iPod.

Posted on September 11, 2008 and filed under Apple, Music, Software.

Storing Plain-text Passwords

Security is a hot issue now-a-days. You get told over and over that no one will ever ask you for your password. Not your bank, not Paypal, and not even your online grocery store. This is to make sure that people won't be persuaded by phishers and other scumbags in giving them the password.

But why is it that a lot of companies and other initiatives on the Internet seem to store passwords in plain text in their databases? There is NO NEED to do this. Almost every hypertext scripting engine (ASP, PHP, Coldfusion, Perl, Ruby on Rails) supports the hashing of passwords.

COLDFUSION: <CFSET hashedPwd = HASH(password, "SHA-256") />

When a user logs in with a username and password, they are checked against the credentials in the database. The password gets hashed, and the hash is checked against the stored hash in the database. This way no one will be able to figure out the actual password (especially if a relativley strong hashing algoritme is being used like SHA-256).

If the same user forgets his/hers password you only need a mechanisme to reset the password to a random password, and communicate this with the user (by e-mail, SMS, snail-mail, or whatever) and allow the user to change this new password to one of his own at the next logon.

Another nice feature of hashing passwords is that the user can use a password with lots of printable characters (like !@#$%^&* (){{}|":;'\][/.,<>?`~), or complete sentences because these won't be stored. Only the hash (a hexadecimal string) will end up in the database. No matter how long the password/sentence is, the hash will always be a fixed length.

Maximum flexibility for the user, and a secure way of storing the passwords in the database. So if financial institutions or other high profile web-presences fail to do so, they should be made aware, and change their code.

So there's absolutely no need for anyone to be able to see your (plaintext) password besides yourself. And don't let them tell you otherwise.

Posted on August 28, 2008 and filed under Security.

FireFox 3 Color Management

In the 'old' days, Safari was probably the only Internet browser with some decent color management. The problem was that images displayed in Firefox and Internet Explorer looked a bit desaturated and lighter.

Now, in FireFox 3 you have the opportunity of enabling color management. Just set the following configuration option to 'true' (by double clicking) in the FireFox configuration settings (to access the config-part of FireFox, just type about:config in the address bar).

gfx.color_management.enabled

This feature is turned off by default. Restart firefox and be amazed by the colors in your photos on the Internet

Posted on August 27, 2008 and filed under Browsers, Photography, Tips'n Tricks.

Undocumented Coldfusion Ports

After running 'chkrootkit' on one of my Ubuntu server at work, I got a responds:

Checking `bindshell'... INFECTED (PORTS:  4000)

A message which started a 'mild' shiver across my back, because the rootkit checker just reported that one of the processes on the server could be compromised.

First I took the server of the network. Just to make sure. After that I searched the Internet for a possible explaination. Nothing substancionally. until I found the following command to see what is occupying the port.

sudo netstat -e -p -n -a | grep 4000

This gave me the following result:

udp6       0      0 :::4000                 :::*
65534      13886      4739/coldfusion8

So it seems that Adobe Coldfusion is using this port. But this can't be found in any of the official Adobe Coldfusion documentation. There are some (blog)posts related to this, but nothing more.

Posted on August 27, 2008 and filed under Annoying, Linux, Operating Systems, Security.

Point & Shoot

Ever since a certain split-up, I'm in need of a decent point&shoot camera. A nice small camera to fit in my pocket for every day snapshot use, but with pro-like features. Why?, because they won't allow you to attend a concert with a Nikon D300 and a 80-400mm lens.. (or any lens for that matter). And the camera on my Nokia N95 is not satisfactory at all.... But then again, it's a phone.

At the moment I'm kinda interested in the Canon Powershot G9, or the Panasonic Limux DMC-LX3 (which is not available yet. The first is.. well... kinda a legend at this moment, but the second is throwing high hopes for that segment. The new Nikon P6000 lacks Mac support and uses a closed RAW format at this time, so that's a no go (even though the integrated GPS in kinda neat).

Guess I have to wait for the first reviews of the Panasonic Lumic DMC-LX3. I hope it's available soon.

Posted on August 21, 2008 and filed under Gadgets, Hardware, Personal, Photography.