A better London Underground Map?

From the Economist Daily Chart (Which I strongly suggest, you subscribe to the RSS feed), it appears someone has gone to the trouble of designing a geographically accurate map of the London Underground.

If you've been to London and used the Tube, the standard map is itself a nice informative chart, worthy of a Tufte mention, I'd say.  Anything that goes to improve on that, gets my vote.  While I don't claim to have any special knowledge of London Tube stations, the fact that some stations are closer to each other above ground than what is on the standard map would save you that bit of aggravation exactly when you need to rush or are late to some meeting. 

Of course, if you're used to the standard map, this might take some getting used to but if you've never been there and it's your first time, might as well try the new one.   Obviously, you're getting to miss the long running track and repair changes information that is published along with the standard map.   But as the designer suggests, take both with you.

2011 CWE/SANS Top 25 Most Dangerous Software Errors

Through lwn.net, the top 25 dangerous software Errors can be found here.  Makes for some nice or frightening reading depending upon your point of view. It is a bit weird that

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

is still there and at an astounding 3rd place.  I was under the impression that the new C/C++ standards would have done and fixed that at the compiler level or something of that sort. Again, assuming the bulk of these errors were in C/C++.

Makes me think that the OpenBSD folks were in the right to fix things by changing the insecure libraries so that this kind of error cannot be triggered at all.

And oh, I do like this one too

Use of Hard-coded Credentials

even mentioning espionage implications and Stuxnet.

Go on, read the full list here.

A simpler search: Emacs Occur

The Emacs manual has a section devoted to search and replacement exploring a multitude of options to search and replace text.  You should at least be familiar with
`C-s'
     Incremental search forward (`isearch-forward').
`C-r'
     Incremental search backward (`isearch-backward').
Anything a bit more complicated than that, you need to dive into the manual.

And if you really do read the section end to end, you'd see the last part on Other Repeating Search.

And you'll find another simple search M-x occur. Call it, supply the search string and that's it.  It provides all the matches in another buffer, each line clickable to take you to the specific line  in the source file or buffer where the match was made.  It is also mapped to M-x list-matching-lines.  And if you want to search multiple buffers, there's M-x multi-occur and M-x multi-occur-in-matching-buffers, the latter that takes a regular expression for file names.

And if you do want a bit of context to the matches, supply a prefix argument and it will show contextual lines to the matches; i.e C-u 2 M-x occur searchtext RET will show 2 lines of context with every match. 

That's it. M-x occur is for the occasions where you can't be arsed to find the 100% correct regex and no one's watching you hacker FAIL.

And you should really read the complete section on Search and Replace.  It's well worth your time.

Emacs 24.1 heading into Pretest

A bit late to post this but it appears Emacs 24.1 feature freeze and pretesting is going to start.

Well, almost, if you look at the entire mail thread; for a release in 2012, if all goes well.

If you don't want to wait that long, you can still get the weekly builds from here.

Emacs world domination...will have to wait

So, on a whim, I decide to look up google trends for emacs search volume.




This is not looking good. It's time to organise and spread the gnus otherwise we might go out with a mew...err...whimper.

Data Security will probably never work till....

data loss is the same as physical property loss.  Since that's never going to happen, data security in the IT field will probably be a fool's errand.

Let me explain.  First this post is a good rant on security issues and how management perceives it.

If someone steals your iphone or laptop, that loss is completely tangible.  You had it then you lost it; something which you paid lots of money to get.  There is an incentive and an object that you know that belonged to you that got stolen that makes you want to safeguard it.  Compare this to a database breach;  The same data is still there except that someone else too, unauthorised, has a copy.  In fact, there is nothing like someone got punched, got a gun pulled at his face,blood,screams,physical assault with the object forced from their hands.  One random day, someone reports that there was unauthorised access and the data has probably been copied over.

That's all.

You expect people to swoon over data loss, some electronic stuff which to most people is fungible? 

I'm convinced that this is the primary reason why no one cares or will care.  It's just not the same as physical property loss(Of course the impact of the data loss is large;not denying that).   I think Nicholos Negroponte explained this well in his book 'Being Digital'.  Something along the lines of "what's original and what's a copy in the digital realm when one bit is the same as the other bit?"  and the values attached to them compared to physical originals and copies.  How does one even know that a file has been copied a million times?

All the worst case scenarios and security checks will probably never impact management till some cracker figures out a way to steal the data centre, lock, stock and barrel. :-)

Being Digital

Why aren't Firms doing a cost benefit analysis on Data theft?

After reading a lot of recent news on phishing and cracking attacks on high profile firms, I keep wondering whether anything is being attempted at all in the security front all. I mean,you're on the WWW, there are a broad spectrum of people who are for/against/indifferent to you.  And if you do something perceived as unpopular, you're inviting some form of protests, legitimate or not. Inevitably, the firm's site is cracked and a whole lot of really, really sensitive information gets leaked and then there is much grovelling and PR.

Is it still that companies are still going through the popular 'security theatre'?
Virus software Check
Firewall Check
RSA token Check
ACL software check

and that's it?

And oh 'It can't happen to us/me' syndrome?
Yes,Yes, I get the usefulness of the above softwares and how they raise the  bar on cracking and all that but it all seems so pointless when the actual methods of cracking are revealed, isn't it?

Why aren't the firms looking at cost benefit analysis on the loss of data before doing any securing of the data?  I mean, if you're looking at a Credit Card database, wouldn't a worst case planning of complete compromise of the same be planned and mitigation steps planned for the same?  Multistep authorisations, access control, manual verification, disabling remote access for certain operations, aren't they supposed to be done for securing such data? I find it hard to wrap my head on the entire credit card databases being whacked;  I can understand a single card holder account compromised due to social engineering tricks but entire card databases?  How?  It boggles the mind.

Wouldn't one at least check the cost of compromise of the database? i.e. we'd lose X millions in sales and revenue if this get leaked along with the bad PR and legal issues pertaining to card data losses and intimation to individual users and hence we'd need to make sure we have the above security checks and processes in place? Shouldn't the expected data loss cost be a factor in making additional investments in terms of money, time and processes to make sure the unthinkable does not happen?  And application teams and project managers deploying things would probably think about security from the ground up rather than treating it as something the infrastructure guys would help with before deployment.

And shouldn't they pick up best practices from the casinos?  Of course, I realise they work with physical money more rather than electronic stuff but they seem to be doing a good job in making sure they don't come out red faced that often with so much money involved.  And they seem better at figuring out Insider threats and have enough checks and balances to catch them?  I mention this because (apparently) most data losses seem to stem from insiders doing it and/or providing the information to external parties under duress, carelessness or otherwise.

The downside of the litany of compromises is that, there will be legislation and laws that are not going make it easy to do business.  In India, we seem to have that started with the central bank insisting mobile/internet payments in certain cases be done through a 2 step process.  I currently have to do that now for paying my cellphone bill through the carrier's mob app. I pay through the app and then I get an SMS that outlines how I will have get in touch with the bank payment gateway, get a one time code and send that as an SMS again to the carrier.
 

AucTeX Tip: Automatically save file before compiling

It used to be irritating for me that I had to save the file when I hit C-C C-C when compiling the file.  It tends to break my flow of work when I had to hit 'y' when Emacs queries me to save the file before compiling.

No  more.

Asking on the Auctex mailing list, the answer turned out to be a simple
(setq TeX-save-query nil) ;;autosave before compiling

customisation to my .emacs file.
It saves me a few keystrokes of C-x C-s too in the event I forget to regularly save my file.  Hopefully, this is worth it for you too.

A simple way to extract specific PDF pages

Today, I received a humongous PDF with about 300 pages of documentation which had to be shared with lots of people who had to review each section independently.  Instead of simply forwarding the entire document to them and asking them to wade through it themselves, I thought I'd split the pages out and send only the relevant bits.

That should be easy, right?

Well, I forgot what the tool was.  A few minutes of google search turned up...pdftk which was what I was looking for.  Turned out that I had installed it long time ago and when I tried it, it dumped core on the cygwin installation I had.

This happens to me.  A lot. Just when I have deadline and I think of the solution, the carpet gets pulled under me.  :-)

Wait, I did remember doing something using LaTeX and another quick search revealed pdfpages on CTAN.  Downloaded and installed it, read the documentation and it was  a breeze to get things sorted.  The smallest example that I can create to get a specific set of pages is shown below.

\documentclass[a4paper]{scrartcl}
\usepackage{pdfpages}
\begin{document}
\includepdf[pages={ 9-14,27}]{RFP.pdf}
\end{document}
%%% Local Variables:
%%% mode: latex
%%% TeX-master: t
%%% End:

That's it.  LaTeXing the file gave me just the pages I needed.  If you have a TeX installation, this works for most cases.  Please read the documentation if you want to something fancy but the above is enough to get the pages you need.

Fitting long TOCs into a single Beamer frame

Here's a simple way to fit a long TOC into a single frame instead of making it flow into multiple frames.  This might be useful for those preparing long lectures with beamer.