PerpetuallyAdapting

Pushing my limits of Design, Programming, and Digital Security.

[perpetuallyadapting]

I got to look at my high school's architectural plans!

I'm actually surprised these haven't been digitized yet. Some new side of me wanted to take a selfie, and I figured a profile picture was finally in order.

The plans are stored in giant reams of 100x80 cm paper, all held together by a giant metal clasp on one end. These clasps have an interesting stand in the corner of the drawing & design room, with a sort of hook mechanism that uses the paper's own weight to hold it in place.

I'm not a huge architecture nerd, but I do some 3D design and figured it was easier to take a picture of floorpans than run around the library with a tape measure. It's interesting that some of the more security-sensitive data is also here. Network cable routes, electric cables, water mains, you name it. With such recent emphasis on public school security, I have no idea why these haven't been digitized and locked away on an administrative drive. For example, one could find the cable lines to the school telecom system, and cut those before heading in to cause chaos. This negates all the intruder drill plans which require a school-wide announcement to go into effect. Of course, if we're talking about school shooting security, there's no reason one couldn't simply begin shooting during one of those 5-minute intervals between classes when everyone is vulnerable. Heck, we have enough chaos in the halls already, nobody would notice if you came in and shot someone. Scary.

That just became more depressing than expected. I should stop over-analyzing things. Now I'm stuck thinking about public school security....

[perpetuallyadapting]

Securing printers

Network printers don't look like a security problem, right? You're more concerned about blocking outside attacks with a firewall, but security inside a network is equally important. Especially inside a high school full of teens discovering their individuality, where I found and tested a rather troublesome office bug. Network printers aren't the most intelligent devices, and will print anything that is sent to port 9100, even an HTTP GET request. This can cause two large problems: an attacker can print any arbitrary content from any networked printer without authentication, and by making image URLs point to the printer's port 9100, one can trigger a network-wide explosion of gibberish from the (blissfully ignorant) printers. Because most email clients support rendering non-javascript HTML in the email view pane, an outsider could trigger this flood from anywhere simply by emailing an insider.

Fortunately, there is a fix. (Or so I think. Nobody wants a 17-year-old security guru telling them how to manage their systems. I think our next social issue to fix will be Adultism -http://en.wikipedia.org/wiki/Adultism)

Telnetting into the printer will give you tons of admin features, one of which is disabling that nasty port altogether.

 telnet 10.16.2.2 # access the printer through telnet

>passwd # set a password using the prompt that is provided

>9100-printing: # enter 0 to disable and 1 to enable. disable this to fix the security flaw.

>ssl-state: # as a good rule of thumb, enter 1 here to enable SSL redirection for secure administration

Problem solved! To print on a massive scale, the attacker would need a connection to the network and the printer's brand-new-totally-secure password. Not perfect, but with a decent password length attacks will be scarce.

[perpetuallyadapting]

Well that was neat....

I've always wanted to test out those torrent widgets, and today I found the free time to catch up on some fairy tail. On further inspection, I don't know what I was so crazy about. It's actually just an image link that's updated on the server -_-

But, apparently Tumblr has full support for custom HTML stuff! Neat!

(I suppose the image rational is so one doesn't need to write 'safe' javascript that won't disturb the site it's being posted on)

[elparra]

Always

[perpetuallyadapting]

True XD

[perpetuallyadapting]

WHERE WOULD YOU MOST LIKE TO VISIT ON YOUR PLANET?

A PLACE WHERE PEOPLE DON'T USE ALL CAPS.

All my life I've loved two islands: Britain and Japan. I love the culture of both, which I've seen through most of my television obsessions: Sherlock and Doctor Who from Britain, and anime [too many to list] from Japan. I suppose I would start with the two capitals, London and Tokyo.

My favorite place isn't on earth at all: Space looks like an interesting place to inhabit. The effort required to live in space would require complete cooperation between the entire world. I don't doubt we will eventually attain this dream, but I do doubt if it will be in my lifetime.

[perpetuallyadapting]

Popcorn idea!

First, let me explain the title: I have these wild inspirationally inventive moments when I come up with a solution to a problem during the course of something not directly related to the problem or the solution.

This solution: Cache validation. Today's web browsers know that things like high-res blog background pictures generally don't change, and may be saved on the hard drive instead of always re-fetching them. Servers are generally responsible for telling the browser when something (image, javascript, css, etc) expires or changes. But we already have technology for determining if object A is the same as object B without moving a ton of data: hashes. Why not take a SHA-1 hash of every file your site hosts, and in the HTTP(S) protocol include that as one if the first parameters the browser reads? if the hash matches the cache's hash, the browser can ignore the server and load from the hard drive. Otherwise, the browser can continue loading the data being sent to it.

I haven't yet done any googling to see if this is already implemented, but my personal bias is that it hasn't.

[perpetuallyadapting]

Oh, hi there social life. You look lonely.

This is me letting the internet know I'm still alive, and still working on cool projects. (this week I fixed many of our school keyboards that were missing feet using 3D printed replicas I designed)

I hope to post more as I find the motivation to do things besides obsess over digital security and efficiency (schoolwork!), and psychology has taught us that a small commitment (this post) is much better than great intentions.

[perpetuallyadapting]

Seamless Google Presentation Usage...

While I was working on a template for a cyber security site the idea of using easily-generated content from google docs caught my attention. after confirming for the umpteenth time that making an embedded google doc transparent, or setting a custom background image, was quite impossible, I decided to try poking around google slides.

By going to Slide>Change Background one may enter a custom image to be used for the background. I basically created a div that held google's embedded slideshow iframe & cropped off the toolbar. I then added a background image that overlaps the iframe and gives us that transparent border. the tricky part was getting the background image for google slides to fit the one used for the div background. this is where algebra becomes useful :P (yes, you're using math now. IN REAL LIFE!)

I looked at the relative sizes of the iframe and the surrounding div and calculated a ratio between the size of the outer width & height and the inner width & height. I then multiplied the original image dimensions (1024px by 658px) by the respective ratios and added the top & left padding (32px on website) by dividing it by the same ratios.

It's a bit confusing and requires some trial & error, but that's basically a rite of passage for any aspiring programmer/web designer.

Results below!

[perpetuallyadapting]

Custom Features!

Tumblr’s custom design function needs to be used more. I’ve only seen people edit the CSS of a blog, but building on your own javascript gives you much more control. Not only can you edit the CSS in a much more developer-friendly environment, new features can be added! I’ve just finished a little piece of code that runs a “screensaver” of sorts. The code requests fullscreen access while adding background music and animating the posts. The fullscreen request is usually met by the browser with some sort of prompt, but that’s necessary for security reasons. Music is a loop of Jason Shaw’s “Running Waters”, which I find works well for both evening and morning themes. The animation is kind of tacky, but efficient on CPU usage. CSS3 came out with a neat @keyframes (oh tumblr, I’m not mentioning anyone) *ahem* “@keyframes” feature that lets the browser use native code to run the animations, keeping the excess javascript at bay. Each element gets a few parameters randomly generated (height, opacity, scaling, speed, and positioning) and those are used to make a new stylesheet just for that post. the stylesheet is added to the <head> of the page, and a CSS rule is added to the post to make it animate according to the rules in the stylesheet.

Basically, It’s a neat application of web design to the fullscreen UI. If it weren’t for the security issues, I’d probably also add a timeout function to start the “screensaver” three minutes after the mouse stopped moving. (hmm…. I wonder if there’s a way around that?)

[perpetuallyadapting]

Fullscreen Security and Design

Interesting little factoid I picked up today:

(image reads “Request for full-screen was denied because Element.mozRequestFullScreen() was not called from inside a short running user-generated event handler.”)

I was testing javascript’s fullscreen capabilities and found that firefox (and I assume other browsers) blocked any direct request for fullscreen access.

to debug, I wrote the fullscreen function to run any time someone clicked the body of the page, which worked, but made me see a security hole. Someone could assign a function to every user event that would run “privileged” code that needed an event. since something as trivial as scrolling is considered an event, one could circumvent browser security using this technique.

On a more design-esque note, the idea of fullscreen design has captured me as an entirely new medium for website optimization. Prior to today, I merely considered the mobile platform, tablet platform, and desktop platform. Each has it’s restrictions, (don’t run a ton of javascript on mobile devices) but desktop websites have more-or-less allowed for the fact that their design would be surrounded by a URL bar, border, bookmarks, something like that. I’ve seen far too many people still stuck in the “toolbar” age: when IE introduced 3rd-party toolbars in their browser, and every company in existence wanted you to download their toolbar. in addition to distracting the user, this crushed (literally) any webpage’s design efforts. with enough toolbars, a user could turn their 16:9 screen into a 4:1 strip for viewing the web. Fortunately, we’ve gotten past that and extensions now pack themselves into a nice, neat, hide-able icon. Yet we still have “toolbars” outside of the browser. the ever-essential URL bar, strips of tabs, bookmarks, and system taskbars steal space that could be used for larger designs. With Apple, Microsoft, and Ubuntu racing for a unified operating system that runs on all platforms, I fail to see the continued fascination with a 24-by-1024-pixel strip along the top and/or bottom of the screen. Mobile devices generally display websites in all their fullscreen glory, but still provide useful functions (BlackBerry’s browser hides all GUI elements when you scroll, returning them with a tap on the webpage). I can see the future operating systems intelligently detecting what features the user might need, and providing those (If I look towards the top of the screen, show the URL bar and my bookmarks).

For now I’ll just be experimenting with ways to “remember” your fullscreen preferences, but the future of fullscreen design will be an interesting era for technology.

[perpetuallyadapting]

Tweaking Tumblr!

as you may have noticed, I’ve got one of those custom tumblr themes. What’s gone unnoticed is the incredible simplicity and efficiency of my customization: I looked at the “edit html” portion of tumblr’s preferences pane, and nearly died. It’s a horrendous place to develop anything, let alone a web application. So, I decided to add one line that changed EVERYTHING:

<script type=”text/javascript” src=”https://www.googledrive.com/host/0B7zq3HJTTNTtdTRWS2hjOWhYc1k”></script>

Yup. That’s it. From there, I just edit my google drive javascript file using codeyourcloud.com, and change CSS on a per-element basis.

go ahead an take a look at it, it’s impressively simple when compared to the alternative. Also, this lets me run javascript (duh) meaning that I can add my own features to tumblr, assuming I have the time to program them.

For those who are still scared of a real programming language, you can tweak my solution by adding a link to a CSS file instead of a javascript file. I’m not sure how overriding will work though…..