So as per my previous post on the matter, and the buzz in general, I decided to go ahead and give the official client a whirl. I started using the new service via iChat and Adium last night, but wanted to see how the actual Google client looked and take a peek at how it works.

As you’ve probably heard, the system is based on the Jabber protocol — which is basically a set of standards built on streaming XML. Here are some details if you’re interested.

Anyway, my curiousity is focused around the authentication piece, so I fired up a sniffer and watched myself login. My side first sent an “auth xmlns” that included an X-GOOGLE-TOKEN (I can’t include the actual content since WordPress is eating the XML) which consisted of a very long alphanumeric string. The server then responded with a “success xmlns” response. After that the exchange of information ensued.

One key piece of information here is the fact that Google’s Jabber implementation doesn’t currently support encryption. From their website:

Google Talk currently does not encrypt chats or calls. But we are working hard to make many improvements to Google Talk while it is in beta, and we plan to fully support encryption of chats and calls before our official release.

No big deal — it’s still beta.

Anyway, I have to get back to work but I’ll be looking more into this later…

You’d think certain things would come second nature to a major OS — things like network connection handling or returning to full functionality when coming out of standby. Well, with Windows XP these things haven’t quite happened yet.

I connect to a lot of network shares and FTP sites in my line of work, and while doing so yesterday I had an epiphany — Windows sucks horribly at both. Sure, if you happen to connect when the resource is working perfectly and there’s nothing wrong with the network, you have a decent chance of success. But if you make the mistake of trying to connect to a resource that has issues, or while the network is acting funky…

For anyone who doesn’t have experience with this, let me tell you what happens. You get the hourglass cursor of death and you lose all control of the explorer window you’re working in. All of it. It’s gone. The window just freezes. This could go on for minutes, hours, or days, by the way. And I understand — I really do. It’s only been 10 %&@#*! years since Windows 95 came out, so I can’t expect Microsoft, a company with mere billions to spend on R&D, to to be able to hash this out just yet. Oh, and god forbid you do the logical thing and close the window. What happens then?

Explorer.exe eats itself. Yeah, that’s over a decade of Windows development being raped by an unresponsive network resource. It makes me sad.

Look, I’m a novice when it comes to programming, but I do understand a key concept called exception handling. It basically means anticipating bad things happening and perparing for them. An example of bad exception handling would be a person who tries to buy an ice cream cone, finds out the store is closed, and commits Sepuku in a fit of frustration. That’s not a good way to handle a lack of ice cream, and restarting the GUI is not a good way to handle someone clicking the close button in an explorer window.

Then you have the standby and hibernate functions. They’re pretty standard — you are in the middle of something and want to stop for a bit and resume your work later without completely shuting down. Unfortunately, in Windows I find it actually saves time if you just go ahead and restart the damn computer. Opening your laptop’s screen only to find that your apps are laughing at you is not my idea of a good time.

So here’s the thing — I’m actually an MCSE and I do like a lot of what XP offers. I am not upset about these things because they existed; I’m upset because they still exist. It’s been 10 years guys…can we have windows not freeze when network resources aren’t available? Can we get a standby function that works properly? Apple/OS X figured it out on the first try. I’m left wondering why is this stuff is still a problem for Microsoft’s flagship OS.

Anyway, until they can get it all sorted I’m going to have to recommend OS X for the desktop. Windows just doesn’t seem ready for the bigtime yet. But who knows, another 10 years and they might have it all ironed out. I hear they’re getting tabbed browsing and virtual folders in 2006.

“If he thinks we’re trying to assassinate him, I think that we really ought to go ahead and do it,” Robertson told viewers on his “The 700 Club” show Monday. “It’s a whole lot cheaper than starting a war.”

“We have the ability to take him out, and I think the time has come that we exercise that ability,” Robertson said. “We don’t need another $200 billion war to get rid of one strong-arm dictator. It’s a whole lot easier to have some of the covert operatives do the job and then get it over with.”

Here’s the thing…I haven’t even considered whether what he’s saying is valid or not — I’m merely commenting on the fact that he’s saying this as a Christian. I mean, the guy is so stupid that he really doesn’t understand that Jesus wouldn’t approve of assassination. It’s really quite sickening.

Hmm…I love Skype, but damn. Google IM sounds like it might rock. I have a feeling I’ll be sticking with Skype, but I’m at least going to try Google’s offering. That’s assuming it has an OS X client, of course.

You Need People

If you’re stuck living a life you wouldn’t have consciously chosen if you had it to do all over again, what can you realistically do about it?

The Black Hole

By “stuck” I mean truly, deeply stuck. You’ve got the stable job, the family, and the mortgage. But even though your situation looks pretty good from an external standpoint, you’re not happy about it. It’s not fulfilling, and you know you should be doing something else, but at the same time, you know there are no guarantees, and you feel as if the only way out would be to destroy what you’ve got and rebuild from scratch. And that isn’t something you’re willing to do…

(Source: Steve Pavlina)

Well, I made another trip to the bookstore yesterday. I picked up another Moleskine notebook and a few new security books. As I was walking out I experienced an all too familar feeling — the frustration of realizing that I hadn’t read the other four books I bought last time I was there.

This really has to stop.

I need to spend less time gathering scattered nuggets of information online and more time taking in the condensed, high-quality information within the books I’ve purchased. The benefit per unit of time is infinitely higher.

In fact, I bought the new notebook specifically for this. I want to spend roughly four to five hours a week just reading and taking notes in my Moleskine. Later, in a separate phase, I’ll transfer the content from my notebook to the /study/books page here on the site.

So yeah, that’s the plan. If I can combine this with my semi-regular workouts and a new eating culture I’ll be in like Flynn.

I just discovered an organic/health food store here in town and I’m all about becoming a member, buying most of my groceries from there, switching to their vitamins, and just generally eliminating all the crap I eat. I’ve been wanting to do this for a long time anyway; finding this store just gives me some psychological ammunition with which to approach the task.

There’s a problem though. I don’t buy groceries. I don’t cook my own meals. I eat out just about every single meal of every single day. And when I don’t, it’s because I’ve made myself a sandwich from plastic wrapped, highly-preserved, horomone-injected meat products — topped off with a diet soda full of god knows what. It’s quite sad.

I know my body and mind are functioning at like 60% of their potential as a result of this, and I know what to do to fix it. The problem is that I’m a geek. I like to spend time doing things that are mentally stimulating: reading books, reading RSS feeds, blogging, chatting with friends, gaming, etc. I quite simply don’t feel I have time to “work” at preparing meals. I’d honestly pay someone to do it if it was cheap enough.

Anyway, that’s the problem and I don’t know how to fix it. I usually have quite a number of things on my plate between work and personal development, and when I’m hungry I just want to get un-hungry. Like, fast. The idea of me going home and preparing a meal that will take time and may not even taste as good is a major turnoff for me.

So, what am I to do? Has anyone come up with a way to break out of this horribly destructive cycle?

In my previous post I mentioned the UFC, and a friend of mine outright asked me what I saw in such barbarism. I thought it was a good question and I’m republishing my response here in a separate thread.

–

For me the sport is so interesting because it’s like Go or Chess combined with an Ironman competition. You have to be a tactician, a strategist, and an athlete in order to compete in this sport. Then, on top of all that, you need a lot of heart. It’s a truly awesome sport.

I personally don’t even notice the “violence” when I watch matches. Violence to me is bad because it’s unwanted, not because it involves physical pain. Take the Liddell/Horn fight for example. After each round they shook hands as they went to their corners. Hell, they probably had a beer after the fight. They’re professionals playing a physical chess match. There are many other sports that are physically gruelling and take a massive toll on the body. Freediving is one. Another would be Olympic level gymnastics. Hell, football as well (although I’m not a football fan). The point is that just because it’s hard on the body doesn’t mean it’s bad. Many have lingering injuries after getting out of the sport, like sore joints or whatever, but I’d argue that this is a small price to pay if they love what they do.

Here’s the thing: fighting on the street for the joy of hurting people is just as revolting to me as it is to any other decent person. But this is NOT a bunch of unskilled hooligans going at it like animals. My advice to you would be to learn a little bit about Jui-jitsu; learn about some of the techniques used. YEARS are spent learning just the fundamentals of defense and attack. It’s a thing of beauty.

So while I agree it’s definitely primal in the way it’s carried out, there’s a whole entire world beneath the repulsive surface you’re reacting to. I urge you to look deeper at it, and I’d love to talk to you more about it if you’re interested. Maybe sometime when I’m in the area we can watch a couple matches together. That way I’d be able to walk you through the complexity that’s difficult to understand at first glance.

Anyway, don’t write it off. There’s much more to it than meets the eye.

I can’t believe Jeremy thought he could stand up and trade punches with Chuck. That’s just crazy. And he did it again and again. I can see being confident in your defense, but damn…

Oh well, he’s still my favorite fighter. He’s got heart all day long and I think if he’d put the stubborness behind him he’d have been a true threat. I mean, he was trying to prove a point by standing with Chuck, and I respect him for that, but after he got rocked the first time he should have gone exclusively to kicking and shooting.

Anyway, just my thoughts…

Many of us are familiar with a concept know as Security by Obscurity. The term has quite negative connotations within the security community — often for the wrong reasons.

There’s little debate about whether security by obscurity is bad; this is true because it means the secret being hidden is the key to the entire system’s security. Obscurity itself, however, when added to a system that already has decent controls in place, is not necessarily a bad thing. In fact, when done right, obscurity can be a strong addition to an overall approach.

So what’s the difference?

Security Through Obscurity

An example of security by obscurity is when someone has an expensive house outfitted with the latest alarm system, but they keep the key and alarm code in the planter box next to the front door. This is security by obscurity because if anyone knows the secret, i.e. that the key and code are stored in the planter, then the security of the system is compromised.

That’s security by obscurity: if the secret ever gets out, it’s game over. The concept comes from cryptography, where it’s utterly sacrilegious to base the security of a system on the secrecy of the algorithm.

Obscurity As A Layer

Obscurity as a layer, however, can be used to enhance security that already exists. One excellent example of this is Portknocking.

Portknocking allows one to hide their network services behind an additional layer of quasi-authentication. Using the technology you can have an SSH server sitting live on the Internet that portscanners literally can’t find. This works because your firewall sits between the Internet and your listening SSH server.

Your firewall listens to the incoming requests and ignores all standard SSH attempts to your box. If, however, you ask in a very specific way, i.e. using the secret “knock”, it’ll open access to the server for your source IP.

The part that most people miss is that you still have to authenticate to SSH. You didn’t replace SSH’s security with portknocking, you simply added it as a layer. Remember, the NSA most likely has great algorithms but they still don’t publish them.

So the next time the subject comes up, remember a simple concept: security by obscurity is bad, but obscurity itself — when added as a layer on top of existing security — can be quite useful. Those who dismiss obscurity out of hand are regurgitating something they’ve heard rather than thinking through the concepts themselves.: