When it's finished in ten years, Dubai's latest architectural monolith will be the tallest skyscraper in the world. At more than one kilometer high (3,280 feet), the Nakheel Tower will have the hundred floors.

"From our perspective, we are building a tower that's going to be over a kilometre in height. This is a complete iconic development. It may be the tallest."

[Daily Telegraph]

Netbooks were supposed to be this great inroad for Linux development, but it turns out that the XP side of the netbook business is doing a lot better in the area of customer satisfaction: MSI today told Laptop that, according to internal studies, "The return rate is at least four times higher for Linux netbooks than Windows XP netbooks."

Lest you think I've somehow chopped this figure and embedded it out of context, here's what MSI's US sales director Andy Tung told our friend Joanna at Laptop when she asked about high return rates:

We have done a lot of studies on the return rates and haven’t really talked about it much until now. Our internal research has shown that the return of netbooks is higher than regular notebooks, but the main cause of that is Linux. People would love to pay $299 or $399 but they don’t know what they get until they open the box. They start playing around with Linux and start realizing that it’s not what they are used to. They don’t want to spend time to learn it so they bring it back to the store. The return rate is at least four times higher for Linux netbooks than Windows XP netbooks.

Check out Laptop for more of the interview. [Laptop]

WE GOT WORD that Intel is adivising mobo-makers and memory vendors alike about their new X58+Core i7 combo and to abide to a strict 1.65V limit on memory voltages, beyond which there is the risk of burning out the CPU....

I started writing this post earlier in the week—-right after my Chicago Bears vs. Philly sideline shoot, and I hadn’t had a chance to finish it, but last night I shot the USF #10 ranked Bulls vs. Pitt from the sidelines, so I thought I go ahead and finish off the week with it (the couple of shots above of Pitt Running Back LeSean McCoy are from last night’s game).

So here’s where my problems started: I need to take five bags with me on my flight to Chicago to shoot the Bears vs. Eagles. They are:

1. My Camera Bag
2. My Lens Case (the 200-400mm is so big is has it’s own separate case with shoulder strap), but at least I can strap my monopod to the case.
3. My laptop bag (I have to have my computer, right?)
4. My rolling overnighter luggage (I have to take clothes)
5. My Think Tank gear belt for shooting on the sidelines

Of course, we’re only allowed two carry-ons on the plane. The easy choice was to check my overnight luggage bag (which I did), and since I was only going away for one night, and didn’t have to pack much, I took apart my Think Tank belt, and put it in my overnight luggage as well.

That still left with me three carry-ons (one over the limit):

1. My Camera Bag
2. My Lens Bag
3. My Computer Bag

…so something had to get checked or left behind. My first thought was to use a backpack camera bag that would hold my camera gear and my laptop, but on the sidelines of a game, you don’t really have any place to store your gear—your stuff has to stay with you (which is why I wanted to try out my new Think Tank modular gear belt).

So, here’s what I tried: Pelican makes a case called the “Pelican Case Cruzer” (see the photo below from Pelican’s website) and in the main compartment you store your camera gear, and up in the lid is a panel, and inside that panel is a cutout sized for an Apple 15″ MacBook Pro and an Apple Power Adapter. Plus (and this is a big plus)….it rolls!

I loaded mine with two camera bodies, a 24-70mm f/2.8 Nikon lens, a 10.5 Nikon fisheye lens, a 50mm f/1.4 prime lens, an SB-900 flash (hey, ya never know), an Epson P-5000 photo viewer/backup, and an assortment of back batteries, cables, and other stuff that rolls around in your case.

Pros: This actually solved my main carry-on problem, because now my camera gear and computer were both in one crazy-rugged, rolling carry-on. It’s small size is really great, because it’ll fit in the most any overhead, or under your seat if need be. The inside dividers are completely configurable, so you can set it up exactly like you need it. Plus, it looks cool (and looks count).

Cons: Every camera bag I’ve ever owned had a zipper pouch area, or a zippered pocket, etc. where you could store extra batteries, cables, and all that extra little stuff, but with the Case Cruzer you don’t—it’s just configurable dividers and that’s it. I really miss that little zippered pouch (even more than I imagined). Also, it’s just a little too shallow, so you can’t fit a Nikon D3 without laying it down flat, which takes up a lot more room (notice in the photo above, how they have the Canon body lying flat), and the same with Nikon’s new SB-900s. The other downside is that while it’s designed to hold your Apple power adapter, it’s not realy designed to accomodate the cord (especially the longer white power cord), so I had remove that part of my adapter and toss that in with my camera gear.

All in all, I pretty much liked Case Cruzer, and it did work to get me down to two carry-ons, but it’s just not quite 100% there. I wish I could design two camera bags myself; a “Nikon shooter’s bag” and a “Canon shooter’s bag.” But in the meantime, this will have to do.

I wanted to take my “Think Tank Modular Belt System” out for a try (you can see it in the photo above from Sunday’s shoot—it wears like a belt, with different compartments for different lenses and accessories). But here’s the new problem–how do I get it to Chicago? I don’t know what everybody else does, but I packed it in my checked luggage. There’s probably a better way, but I don’t know what it is. Anyway, the Think Tank system absolutely rocks for Sports Photography. I hate carrying a camera bag over my shoulder, and on the sidelines, there’s really no place to store yours safely, so you have to lug it around (but nobody does, because nearly everybody has a Think Tank system around their waist).

Anyway, I’m amazed at how well it works; how handy your gear is, but most of all how it distributes the weight so well that you forget you even have it on. Really brilliantly designed and thought out. I still don’t know the best way to get it to the sidelines, but I sure like having it (and I used it for last night’s USF game shoot).

I also packed two of the great inventions known to man; Gel Knee Pads. They are absolutely invaluable!!! (I bought mine at Home Depot, and they have the word “Gel” on the front, under a clear plastic part of the pad).

So, to recap:

1. I checked my overnight luggage
2. I packed my Think Tank belt and cases in that luggage, but that only worked because I didn’t have much to pack for just an overnight trip.
3. I used the Pelican Case Cruzer to hold my camera gear, and my laptop and power cord, and I carried that on the plane.
4. My second carry-on was the Nikon lens case, so I made the “two-carry” limit no problem.

So, you can see how hard it’s become to travel with photo gear, and because of the very real worries of theft from checking camera gear in your luggage, you really have to take your gear on board as a carry-on. Also, I’m pretty queasy about shipping my gear by Fed Ex to my shoot, especially if all I can do is ship it to the hotel I’ll be staying at (I’ve had hotels turn down or refuse a delivery to a guest for no apparent reason).

Anyway, if there are any other sports shooters out there who have come up with other ideas for getting your gear to the event, and managing it once you’re there, please let me know (post a comment here), because while what I did, did work—it ain’t great.

As we move towards battery and hydrogen cell breakthroughs that could wean us off our addiction to oil, here's at least one engine design from yesteryear that ought to be examined a bit more. The free-piston engine, first invented in 1920, are cheap to build and roughly twice as efficient as current gas engines.

Unlike its conventional counterpart, free-piston engines don't have a mechanical connect between the piston and a crankshaft. Instead, magnets at the center of the piston's rod move past metal coils to create an electrical current. The engine's configuration allows it to combust fuel quicker, improving efficiency, emissions and easily optimized for different fuels.

The bad news: they're hard to control (variations in combustion cycles can cause poor performance) and they're incredibly loud (the quick explosions need to be muffled somehow). But automakers, such as GM and Volvo, are already investigating putting the engines in future vehicles. Lets hope their forays into this don't take as long as their exploration of fuel cell options. [Technology Review via Treehugger]

Just a couple of items. First, there's now an official web page from the German Voigtländer about the Bessa III 667, in German and English. It appears to be still under construction (the "see larger image" link by one of the pictures doesn't work, for example, and the English page lacks text) but it announces that the camera will be ready by the Spring of 2009. Oh, and "Preis: noch keine Angaben" ("Price: Still no specification"). Apart from features already reported, the camera uses an SPD (silicon photodiode) meter, and has parallax correction and exposure indicating LEDs in the viewfinder.

The other note is that I have positively confirmed with Carl Zeiss AG that its Zeiss ZE manual-focus lenses, with fully-functioning Canon EF mounts for use on Canon EOS film and digital SLRs, are being engineered with Canon's consent and cooperation. Although Zeiss demurred when asked about the specifics of the relationship between the companies, saying that it's an internal corporate matter, they did state the following in no uncertain terms: "Reverse-engineering the lensmount without the support of Canon is not part of the business ethics of Carl Zeiss."

This is good news for Canon users, as it means that the Zeiss ZE lenses will work perfectly on Canon cameras and not suffer from any possible compatibility issues that have befallen certain reverse-engineered independent lenses in the past. It also means that Zeiss has stayed true to its previously stated commitment not to reverse-engineer its products. "We as a company always seek a friendly relationship with the other players on the market," Zeiss's representative said.

_____________________

Mike (Thanks to Chris)

Send this post to a friend

The Gadget: Western Digital's ShareSpace Storage is a steely, cubular vault of NAS with fast Gigabit ethernet that brings enterprise-level centralized storage down to the small business and deathcore nerd space, with 2TB or 4TB capacities in multiple RAID configurations out of the box.

The Price: $699 for 2TB, $999 for 4TB (tested)

Verdict It's a cubular vault of 4TB of basically enterprise-class networked storage that sits on your desk and feels like it could stop a round from the world's deadliest carbine—what's not to like?

It's basically impossible to test actual drive reliability in the short span of review time (though everyone has their own opinion about which companies they love or loathe), so really what it comes down to here is ease of installation—which WD is touting heavily, so you won't need an IT geek—and features.

Western Digital's software walks you through most of the setup, though I still had to manually map the network drives in Vista, and Bonjour didn't automatically pick it up on my roommate's Mac. More frustrating is that despite having a gigabit router and using gigabit cables, I did not see gigabit speeds out of the box—or at all, with transfer speeds hovering around 10.5MB/s writing and 12MB/s pulling data. The default RAID5 configuration in the 4TB model (which balances redundancy against eating whole hard drives, leaving you with 2.66TB actually free) is noted for its relatively poor write performance compared to RAID1, and you'd be better off performance-wise with the latter if you're planning on doing a lot of write-intensive stuff, but that still doesn't explain the gap here.

It also comes with their automatic backup and remote access programs, Anywhere Backup and Mionet, though they annoyingly only give you three licenses for the latter, so if you've got four computers you want to continuously back up, you'll have to get another license. But whatever, the best feature is the built-in iTunes music server, which worked flawlessly. Dump a whole bunch of music into the shared music folder and it automatically shows up as a networked source in iTunes and showed up like magic on my PC and roommate's Mac.

Another (small) aggravation is that it's not hot swappable, so if you want to pop out one of the drives and maybe drop in a 1.5TB drive, you have to power the whole thing down. But I can almost forgive that since three USB ports let you plug other external drives into the box to expand storage even further.

While it's definitely overkill for average home usage, if you're that serious about centralized storage (like if you're if prosumer photographer) or you know, actually running a small business, despite its handful of flaws, if you've got the cash, it's definitely worth looking at. [Western Digital]

Does turning the key in your ignition get more than just your motor hot? BBC magazine suggests 10 ways to rethink driving that might help you stress out less. Key examples: Don't change lanes in slow-moving traffic, and make eye contact to foster a more human spirit. What do you do to lessen your ire during your commute? [via]

We moved five months ago, but our decluttering process started over a year ago. In anticipation of our move, we were forced to take stock of absolutely everything in our home. Moving tends to help in that regard. We knew were were downsizing, so the need to get rid of a lot of items was a must. We held a yard sale and we also used Craigslist to get rid of larger items. All of our efforts paid off, and, in the end, we downsized our home and reduced the amount of clutter in our lives.

I thought of all the clutter that we had to inventory when I read this article in the Ireland edition of The Independent. The author forced himself to declutter during his fifth move in as many years. Moving is a great motivational event that should lead to getting rid of tons of clutter. From the article:

I’m discovering that, despite all that to-ing and fro-ing between places over the past half-decade, I’ve never properly culled my mountain of possessions. Instead, I’ve just created a lot of work for myself and the unlucky slave labour I recruited for each move by hauling all this stuff around with me each time …

My guiding rule this time out is: if I haven’t worn it since I moved last time, then it’s getting tossed. I’ve been surprisingly faithful to that guiding maxim, ignoring that little voice in my head that says: “Hey, those X-Works jeans and boot runners could be considered vintage next week, hang onto them!”

Everyone moves, but some of us don’t take advantage of this situation and needlessly transport clutter from one location to another. Make sure you take stock of everything you have, and ask the question, “Do I really need this in my new home?”

By Evan Ackerman

Carbon nanotubes are pretty amazing things. They’re the strongest and stiffest material on Earth: a 1 millimeter diameter thread of them can support a weight of about 7 tons. The problem is that they’re expensive (and tricky) to produce, especially in any quantity that isn’t just broken bits of tubes. The journal Science is reporting that researchers at the NanoTech Institute of the University of Texas at Dallas have come up with a way of cheaply and quickly manufacturing large sheets (we’re talking meters) of long nanotube strands that are completely transparent and stronger than steel. The sheets are “spun” out of a self-assembled nanotube forest, and can be created with fairly simple machinery at a rate of up to 10 meters per minute. Furthermore, there doesn’t seem to be any reason why the sheets couldn’t be made as long or wide as you wanted. The last picture in the series above shows a nanotube sheet supporting droplets of water and juice that weigh about 50,000 times more than the sheet itself… Pretty cool. No information on cost, though. Read the paper here (PDF).

Laptop batteries that recharge to 90% in 10 minutes, after the jump.

Batteries. They suck, but they’re necessary. As capacities go up, so do charge times, which is a real drag… It would be much better if laptops were like your car: run them until empty, spend a short time refueling, and you’re good to go again. Sure, a proper fuel cell would be nice, but in the mean time Toshiba has been developing a Super Charge ion Battery (SCiB) that can charge to 90% capacity in a mere 10 minutes. SCiBs can endure over 5,000 charge cycles (10x more than li-ion batteries) and are less likely to spontaneously combust. While Toshiba currently has a demo battery powering a laptop, the first consumers will see of SCiB batteries will be in the Schwinn Tailwind, a hybrid electric bicycle available next year.

VIA [ Physorg ] and [ PC World ]

The WebKit Web Inspector has been redesigned and improved, and it looks great. Here is a brief look into the features.

Redesigned

First and foremost, the Web Inspector is now sporting a new design that organizes information into task-oriented groups — represented by icons in the toolbar. The toolbar items (Elements, Resources, Scripts, Profiles and Databases) are named after the fundamental items you will work with inside the respective panels.

Console

The Console is now accessible from any panel. Unlike the other panels, the Console is not just used for one task — it might be used while inspecting the DOM, debugging JavaScript or analyzing HTML parse errors. The Console toggle button is found in the status bar, causing it to animate in and out from the bottom of the Web Inspector. The Console can also be toggled by the Escape key.

Elements

The Elements panel is largely the same as the previous DOM view — at least visually. Under the hood we have made number of changes and unified everything into one DOM tree.

Resources Panel

The Resources panel is a supercharged version of the previous Network panel. It has a similar looking timeline waterfall, but a lot has been done to make it even more useful.

Scripts Panel

The previous standalone Drosera JavaScript debugger has been replaced with a new JavaScript debugger integrated into the Web Inspector. The new integrated JavaScript debugger is much faster than Drosera, and should be much more convenient.

Profiles Panel

The brand new JavaScript Profiler in the Profiles panel helps you identify where execution time is spent in your page’s JavaScript functions. The sidebar on the left lists all the recorded profiles and a tree view on the right shows the information gathered for the selected profile. Profiles that have the same name are grouped as sequential runs under a collapsible item in the sidebar.

Databases Panel

The Databases panel lets you interact with HTML 5 Database storage. You can examine the contents of all of the page’s open databases and execute SQL queries against them. Each database is shown in the sidebar. Expanding a database’s disclosure triangle will show the database’s tables. Selecting a database table will show you a data grid containing all the columns and rows for that table.

Search

Accompanying the task-oriented reorganization, the search field in the toolbar now searches the current panel with results being highlighted in the context of the panel. Targeting the search to the current panel allows each panel to support specialized queries that are suited for the type of information being shown. The panels that support specialized queries are Elements and Profiles.

The Laws of Productivity is a must-read presentation for startups that want to be more productive. Here’s a direct link to the pdf. And here’s my summary of the presentation:

Individuals

1. Work 40 hours a week. (Working more feels like you’re doing more, but you’re actually doing less.)
2. Work below capacity (say 80%) during those 40 hours.
3. Consider spreading 40 hours across 4 days instead of 5.
4. Get the sleep you need; allocate 8 hours.
5. If you need a short productivity boost, work more for 3 weeks. But expect an equivalent reduction in productivity afterwards.

Teams

1. Work in small cross-functional teams (< 10 people).
2. Put team members in a dedicated and closed room.
3. Try not to split people’s time across multiple teams at once.

Thanks to Dan Cook for creating the presentation and Andrew Chen for bringing it to my attention.

Python 2.6 final is now available.

Overstock's Byrne vindicated amidst economic meltdown

Two and a half years ago, Overstock.com CEO Patrick Byrne penned an editorial for The Wall Street Journal, warning that widespread stock manipulation schemes - including abusive naked short selling - were threatening the health of America's financial markets. But it wasn't published.…

A little blurb in the 22 September 2008 issue of Newsweek caught my eye. Linda Stern writes that younger workers are becoming more comfortable about sharing their salary information with friends and co-workers. She points out that it’s also possible to make more generalized salary comparisons using web tools like:

• Glassdoor.com, which allows employees to share salaries and review employers. (You must register to see details, though.)
• Salary.com, which offers a wide range of employment info, including an analysis of salaries for various positions.

Werner Vogels, CTO of Amazon, writes in his blog post Expanding the Cloud: Microsoft Windows Server on Amazon EC2 that

With today's announcement that Microsoft Windows Server is available on Amazon EC2 we can now run the majority of popular software systems in the cloud. Windows Server ranked very high on the list of requests by customers so we are happy that we will be able to provide this.

One particular area that customers have been asking for Amazon EC2 with Windows Server was for Windows Media transcoding and streaming. There is a range of excellent codecs available for Windows Media and there is a large amount of legacy content in those formats. In past weeks I met with a number of folks from the entertainment industry and often their first question was: when can we run on windows?

There are many different reasons why customers have requested Windows Server; for example many customers want to run ASP.NET websites using Internet Information Server and use Microsoft SQL Server as their database. Amazon EC2 running Windows Server enables this scenario for building scalable websites. In addition, several customers would like to maintain a global single Windows-based desktop environment using Microsoft Remote Desktop, and Amazon EC2 is a scalable and dependable platform on which to do so.

This is great news. I'm starting a month long vacation as a precursor to my paternity leave since the baby is due next week and was looking to do some long overdue hacking in-between burping the baby and changing diapers. My choices were

• Facebook platform app
• Google App Engine app
• EC2/S3/EBS app

The problem with Amazon was the need to use Linux which I haven't seriously messed with since my college days running SuSe. If I could use Windows Server and ASP.NET while still learning the nuances of EC2/S3/EBS that would be quite sweet.

I wonder how who I need to holler at to get in the Windows Server on EC2 beta? Maybe Derek can hook me up. Hmmmmm.

Now Playing: Lil Wayne - Best Rapper Alive [Explicit]

A minor tweak here and there to your laundry and clothing storage routine can yield big savings over time. Over at the financial blog WiseBread, they have some great ideas for cheaply extending the life of your clothes and keeping them nice in the process. The tips cover the basics like washing your clothes in cold water to extend the life to reinforcing the hems of pants when you first buy them to stave off problems later. One of the tips I'm particularly guilty of is not wearing appropriate clothes for the task at hand:

It can be tempting to simply get messy chores done while wearing whatever it is we wore at work, but that's a fast way to ruin work clothes. There's a reason why moms frequently make a distinction between their kids' 'play clothes' and 'school clothes'. If tacking a potentially dirty project, don't do it in a dress shirt and slacks.

I've fixed many a messy problem right after getting home from work without getting out of a nice pair of dress slacks, only to have to spend a ton of time getting a stain out for my lack of foresight. What tips and tricks do you have for keeping your clothes sale day fresh week after week? Share in the comments below. Photo by foxtwo.

Stronger competition for Dell/EqualLogic

HP has snaffled the last of the main independent iSCSI SAN (Storage Area Networks) suppliers by buying LeftHand Networks in a $360m all-cash deal.…

In conversations about multi-point autofocus systems, and on comments on this blog, a frequent question that comes up is “Why would you want all those points? I have a hard enough time with my camera picking the wrong point as it is!” Frustrated by their cameras getting things wrong too often, many of these photographers have simply set their cameras to always use the center point use and instead rely on the focus and recompose technique.

I have to admit, this response puzzled me for a while. After all, the first thing I do when I set up a camera is immediate place it into manual focus point selection mode. In fact, I don’t think I’ve let an SLR pick a focus point for me in something like a decade. In a true showing of how one expects the world to match their own viewpoint, I guess I pretty much thought everyone would select their own focal point instead of letting the camera drive this.

As happens all the time, it turns out that I was wrong in my assumption. That’s OK. I seem to learn something new every day from the conversations I have about photography and how other photographers use their cameras. And one thing is for sure, we all do things our own way.

The big problem with letting the camera choose the autofocus point is that most cameras don’t have enough working information to be able to make much more than a semi-educated guess. For example, the phase detection autofocus sensors that are used when you look through the viewfinder pass along just a few bits of information about the portion of the scene they cover. Among these bits are: 1) whether or not there is enough contrast to make a reading; 2) whether or not the area is in focus; 3) how much of a correction is needed to bring the area into focus; and 4) in which direction that correction needs to be applied. From this information, the camera also can sort out how far it is to the objects in the scene at each point.

Obviously, each camera maker uses their own proprietary algorithms to process this data. Some camera makers go beyond just the data from the autofocus sensors and will also pick up clues from matrix or evaluative exposure sensors. The fanciest of these systems can look for flesh tones—even round face looking blobs, depending on the resolution of the exposure sensor—in the exposure data to help pick a point. But, even the most complex of systems are making an educated guess based on relatively little information. Most of the time, the algorithms in the cameras I’ve played with seem to select the point that is closest to the camera and which has high contrast. Yay. That’s not a sure-fire recipe for success.

Your wetware is ever so much more powerful than the electronics in your camera when it comes to deciding what to focus on. When you look through the viewfinder, you know what you want to focus on, so why not just tell the camera yourself? Then, all it has to do is read the data from the focus point you have chosen and drive the lens to where it should be.

That said, some cameras make it easier than others to pick a focus point. Out of the box, the Nikon SLRs I’ve played with let you directly select a focus point using the control pad on the back of the camera when you are in single point and dynamic area AF mode. It’s easy enough that I was able to sort it out in a minute or two without looking at the manual while standing in a camera shop playing with a D700 and a D3. As far as other Nikon models, I’m less knowledgeable. Maybe folks can chime in through the comments to fill in more information.

On Canon SLRs, with which I have a lot more experience, you have to do a two-step dance by default. First you hold down the focus point select button and then you spin the command dials to steer the point into place. It’s easy enough to do quickly with enough practice, but until it’s second nature, it takes way more thought than it should. Luckily, with the 5D as well as later model x0D series cameras (20D, 30D, etc.), you can set a custom function to use the multi-controller joystick on the back of the camera to quickly choose your focus point. On the 5D, look into Custom Function 13. On the 40D, it's Custom Function III-3, I think. On the rest, well, you’ll have to dig into the menus a bit to sort out what’s what. I know that you can also pull this trick with the 1D Mark III using Custom Function III-9. Of course, if you’re camera isn’t listed here and you know the answer, I welcome your input in the comments as well.

The bottom line is that if you’re haven't looked into this already, you should dig into your manual and see how all of this works. Once you find that you can easily set your focus point manually, you may never let your camera do it again for you no matter how smart it thinks it is.

The photo above is of Gary Vaynerchuk speaking at Web 2.0 Expo NY 2008. The focus point on Gary’s face is simulated. No actual @garyvees were harmed in the making of this illustration.

Related Posts:

• Focus and Recompose

There are a lot of contexts in which it's convenient to have a ready source of random numbers and the requirements aren't the same. Consider two example applications: surveys and lotteries. [Thanks to Terence Spies for suggesting the survey example.]

In a typical randomized survey, you start with some set of people (e.g., a list of names or phone numbers) and you randomly select some subset of them. Then you call them and ask them what they think of Barack Obama, Jessica Alba, or ketchup. Then you can use straightforward statistics to estimate the probability that are going to vote for Obama or eat ketchup, or perhaps that like Obama and Banderas. For this application what's principally important is that your sampling function be unbiased, i.e., there be an equal chance of selecting each member of the set. For instance, consider what happens if you select people by height from low to high: you're going to get a lot more women than men in which case you probably don't get that good an estimate of how popular Jessica Alba is in the population as a whole.

In a typical lottery, customers get to pick a set of numbers and then the lottery operator draws their own set of numbers using some random number generation method. If you get the numbers right (or sometimes m out of n), you win. It's important to recognize that the critical property here is unpredictability: if gamblers can predict the numbers that the operator will generate then they can choose numbers that are likely to win. Uniformity actually isn't that important, though it makes things easier—lots of gambling games aren't at all uniform (think craps, for instance)—you just need the odds that the game pays off to match the probabilities (actually the inverses of the probabilities) of each outcome. Let's stick to the uniform case for now, though.

So, we have a need for two different kinds of random number generator: one useful in non-adversarial situations like surveys and one useful in adversarial situations like lotteries. In the latter case, we need the generator to be unpredictable to an attacker, which is much harder to achieve.

Back in the old days, people used to use tables of random numbers that had been generated by hand via dice rolling or somesuch. For obvious reasons, this works OK if you're doing surveys—though it's important not always to use the same numbers or you end up sampling the same people every time which of course skews the sample a bit, if only because people get annoyed with you calling them all the time. [Technical note: if you're going to sample repeatedly you want to have the samples be disconnected, otherwise you don't get any additional data when you take the second sample.] On the other hand, it's clearly useless for any adversarial application, since the attacker just needs to figure out what table you're using and they can predict the next numbers you're going to generate.

Now that we have computers, what's typically used are algorithmic pseudorandom number generators (PRNGs). These are functions that generate a uniform stream of values. One common design is to use a hash function or an encryption algorithm—for instance, you might use AES in counter mode. This is fine as far as it goes, but what do you use for a key? AES is a deterministic function: if the attacker knows the key, they can predict the output of the generator. That's why this function is pseudorandom, not really random. As before, we still want to generate a different stream of numbers each time we run the generator: you need to seed the generator with a different key each time you want to use it. For non-adversarial situations, you just need the seed to be unique—it's conventional to use the time of day. But for adversarial situations you need the seed (key) to be unpredictable to the attacker, which means that it has to be randomly generated.

This starts to look like turtles all the way down, but it's really not: if you can get a small amount of random data (e.g., 128 bits), you can bootstrap that up into a large amount of pseudorandom data that's unpredictable to the attacker by using the random data to seed your PRNG. This is how things are done in cryptographic/communications security applications (and what went wrong with OpenSSL on Debian was that this seeding got commented out of the code.)

In order to have a secure system in the adversarial context, we actually need one more property: given the output of the PRNG, it has to be computationally expensive to work backward to reconstruct the PRNG state/seed or forward from one output to the next output. Otherwise the attacker will just take output N and compute output N+1. Not all PRNGs have this property, though the AES-based one I described above does, as do the cryptographically secure PRNGs that people typically use. For a practical system, there's one more property you want: to be able to inject new seed data at any time, not just at the beginning and the PRNGs that people typically use have this property. It's a little tricky (and beyond the scope of this post) to figure out how best to mix in the new seed data, but it's a reasonably well understood problem nonetheless.

I want to make one more point: the output of a badly seeded cryptographic PRNG looks pretty similar to the output of a well seeded PRNG. While there are statistical tests you can use to measure the quality of random numbers, they only really test the generator, not the seeding. The only real way to determine whether a cryptographic PRNG is well-seeded is to try out candidate seeds until you find one that generates the output you're seeing, which is sort of a non-terminating process if the PRNG was well-seeded. Unfortunately, this means that if you want to be sure your PRNG is strong, you actually have to do so by construction—by making sure that the seeds are correct—you can't get a sufficient degree of confidence by testing the output.

Ars takes a look at the question that all mobile users have asked at one point or another: what's up with the number of "bars" of signal that we're getting on our cell phones, and why does that number so often seem to lie?

Read More...

Research into invisibility cloaks, which work by bending light around 2D objects, could end up protecting offshore rigs and vulnerable coastlines from water. Scientists at the Fresnel Institute in Marseille, France said that established cloaking principles can be applied to ocean waves, and built a 10cm model to show how carefully placed concentric pillars make objects in the center “invisible” to the sea.

Waves pass along the radial corridors, interacting with the pillars and producing forces that pull the water away from the innermost ring. The water is then pushed out of the cloaking area as if it had not encountered anything at all. The circular formation could be used to protect anything from oil rigs to islands, though very few islands can probably afford the amount of pillars needed to make this effect work. [New Scientist via Dvice]

Gearman is an open source message queuing system that makes it easy to do distributed job processing using multiple languages. With Gearman you: farm out work to other machines, dispatching function calls to machines that are better suited to do work, to do work in parallel, to load balance lots of function calls, to call functions between languages, spread CPU usage around your network.

Gearman is used by companies like , Yahoo!, and Digg. Digg, for example, runs 300,000 jobs a day through Gearman without any issues. Most large sites use something similar. Why would anyone ever even need a message queuing system?

read more

Stainless is a free browser demo for OS X based on WebKit and the multi-process ideology behind Google Chrome. It's young and a little feature-light, but until Google officially releases Chrome for the Mac, it could be a nice alternative to the rough-around-the-edges CrossOver Chromium.

“VCs are generally bombarded by requests for meetings, so a warm introduction helps an entrepreneur’s request float to the top of the list.”

Chris Wand, Managing Director, Foundry Group

Summary: The best way to get a meeting with an investor is through an introduction from someone he listens to. Entrepreneurs that the investor has worked with tend to make the best intros—but the specifics of your middleman’s relationship with the investor are more important than the middleman’s day job. Finally, skip intros from (1) investors who don’t have a good reason they’re not investing and (2) middlemen who barely know the investor.

The best way to get a meeting with an investor is through an introduction from someone he listens to. (You could cold call him but you better have a great elevator pitch. And you should read How Should I Approach a VC I Don’t Know?.)

But not all introductions are created equal. Who makes the best introductions? Introducing the Hierarchy of Middlemen:

1. Entrepreneurs that the investor (a) has backed and made money with, (b) wants to back, or (c) is currently backing (in that order).
2. Investors he (a) has co-invested with and made money, (b) wants to co-invest with, or (c) is currently co-investing with (in that order).
3. Lawyers, accountants, and sundry industry people like us.
4. Communists.
5. Someone they met at a party once.

This list is really rough.

The specifics of your middleman’s relationship with the investor are more important than this list. So figure out why the investor is going to pay attention to the introduction by asking questions like:

How do you know the investor? What did you work on together? What companies have you sent him that he has subsequently backed? What makes our company interesting enough for you to make an introduction?

Middlemen you should avoid.

You don’t want introductions from investors who don’t want to do the deal and don’t have a good reason why. An introduction by a middleman who can and should invest but doesn’t want to invest is a strong negative signal. Skip this introduction.

And you don’t want intros from people the investor doesn’t really know or doesn’t listen to—that just makes you look bad. If the introduction starts with “I don’t know if you remember me,” you’re in trouble.

I have a bit of a crowded mouth -- small mouth relative to jaw size -- so it's very difficult for me to scrub the sides of the rear molars. The Sulcabrush, which I've used for about 15 years, is still the only brush I've used that adequately cleans the far surface of my rear molars. The Sulcabrush works because it's thin, has a couple of good angles to it, and the bristles are medium stiffness, so they don't crap out very quickly. It's a pain flossing back there. Flosspicks (even the Reach flosser) are a little too big for my mouth. I've had some success with Reach toothbrushes and some Oral-B's with the stiffer bunch of bristles at the tip, but after about a week, these edge bristles splay and become less effective.

The Sulcabrush keeps working again and again. Since the Sulcabrush's bristle bundle is pointed, I think the total angle is a little more than if it were flat, and better than what I've experienced with average toothbrushes. I've found the pointed end lets me cover more of the molar sides (chewing surface is easily handled by regular toothbrushes). The downsides are that it's essentially another toothbrush to use and it's not particularly versatile -- i.e. I don't like using it to brush the rest of my teeth, because of the small area it targets and the stiffness of the bristles. However, I'm very happy with how it cleans the crud off the rearmost molars.

-- Ken Yee

Sulcabrush
$5
Available from Amazon

Manufactured by Sulcabrush

Bill Zeller and Ed Felten have published a report on Cross-Site Request Forgery attacks on popular Web sites:

We found four major vulnerabilities on four different sites. These vulnerabilities include what we believe is the first CSRF vulnerability that allows the transfer of funds from a financial institution. We contacted all the sites involved and gave them ample time to correct these issues. Three of these sites have fixed the vulnerabilities listed below, one has not.

CSRF vulnerabilities occur when a website allows an authenticated user to perform a sensitive action but does not verify that the user herself is invoking that action. The key to understanding CSRF attacks is to recognize that websites typically don't verify that a request came from an authorized user. Instead they verify only that the request came from the browser of an authorized user. Because browsers run code sent by multiple sites, there is a danger that one site will (unbeknownst to the user) send a request to a second site, and the second site will mistakenly think that the user authorized the request.

The chaps share deatils on the following attacks:

1. ING Direct (ingdirect.com)

Status: Fixed

We found a vulnerability on ING's website that allowed additional accounts to be created on behalf of an arbitrary user. We were also able to transfer funds out of users' bank accounts. We believe this is the first CSRF vulnerability to allow the transfer of funds from a financial institution. Specific details are described in our paper.

2. YouTube (youtube.com)

Status: Fixed

We discovered CSRF vulnerabilities in nearly every action a user could perform on YouTube. An attacker could have added videos to a user's "Favorites," added himself to a user's "Friend" or "Family" list, sent arbitrary messages on the user's behalf, flagged videos as inappropriate, automatically shared a video with a user's contacts, subscribed a user to a "channel" (a set of videos published by one person or group) and added videos to a user's "QuickList" (a list of videos a user intends to watch at a later point). Specific details are described in our paper.

3. MetaFilter (metafilter.com)

Status: Fixed

A vulnerability existed on Metafilter that allowed an attacker to take control of a user's account. A forged request could be used to set a user's email address to the attacker's address. A second forged request could then be used to activate the "Forgot Password" action, which would send the user's password to the attacker's email address. Specific details are described in our paper.

(MetaFilter fixed this vulnerability in less than two days. We appreciate the fact that MetaFilter contacted us to let us know the problem had been fixed.)

4. The New York Times (nytimes.com)

Status: Not Fixed. We contacted the New York Times in September, 2007. As of September 24, 2008, this vulnerability still exists.

A vulnerability in the New York Time's website allows an attacker to find out the email address of an arbitrary user. This takes advantage of the NYTimes's "Email This" feature, which allows a user to send an email about a story to an arbitrary user. This emails contains the logged-in user's email address. An attacker can forge a request to active the "Email This" feature while setting his email address as the recipient. When a user visit's the attacker's page, an email will be sent to the attacker's email address containing the user's email address. This attack can be used for identification (e.g., finding the email addresses of all users who visit an attacker's site) or for spam. This attack is particularly dangerous because of the large number of users who have NYTimes' accounts and because the NYTimes keeps users logged in for over a year.

Also, TimesPeople, a social networking site launched by the New York Times on September 23, 2008, is also vulnerable to CSRF attacks. We hope the New York Times will decide to fix these vulnerabilities now that they have been made public.

And, what about mitigation?

Our paper provides recommendations for preventing these attacks. We provide a server-side plugin for the PHP MVC framework Code Igniter that can completely prevent CSRF. We also provide a client-side Firefox extension that can protect users from certain types of CSRF attacks (non-GET request attacks).

Focus and recompose is a frequently used technique by many photographers. It is often used when you want to compose their subject in an area of the frame that doesn’t have an autofocus point nearby. On many cameras which have just a few focus points, focus and recompose is sometimes the only strategy that you will have at your disposal. When shooting in bright light with small apertures, this strategy can work just fine. However, when you shoot with wide apertures, focus and recompose can lead to poor results, even failure.

Failure? Why should focus and recompose ever fail? After all, if you focus on somebody that is 10' away and then recompose your shot so that their face isn’t in the center of your viewfinder, that person is still 10' away and should still be in focus, right? Well, not so fast. You see, when you focus on a point 10' away, the the area in focus is actually a plane that is parallel to the sensor in your camera. Here’s a very simplistic two dimensional illustration of this:

This illustration shows the field of view of a normal 50mm lens mounted on a full-frame camera, around 45º. It also shows the approximate depth of field in front of and behind the focus plane at around f/2.0. On a full-frame camera, the depth of field is bit over a foot in depth at 10'. Keep in mind, however, that this depth of field is the range that is considered “acceptable” focus. The line between acceptable and not acceptable varies between people. Personally, I go for tack sharp when I can and only settle for “acceptable” when I don’t have a choice in the matter.

In any case, here’s what happens when you rotate the camera to the right so that your subject appears on the left side of your frame:

The red lines illustrate the recomposed frame of view, focal plane, and depth of field. As you can see, by rotating the camera, the focal plane is being rotated as well. Your subject is still 10' away from you, but the rotation effectively pushes the plane of focus behind where you want it to be. The result is that after recomposition, the area that you focused directly on is now somewhere just on the edge of the depth of field. When you take the photograph, your subject won’t be tack sharp and may not even be acceptably sharp, depending on your criteria for acceptable.

Furthermore, this illustration assumes a simple rotation of the camera. When you recompose out in the real world, you’re likely to introduce a bit more error into the process unless you use a tripod. If you lean forward while you recompose, you’ll throw things even further out of focus. On the other hand, if you happen to lean back, maybe you’ll bring your subject right back into the plane of focus if you’re lucky. Relying on luck, however, isn’t usually a good strategy for these kinds of things.

What about if you use a longer lens than 50mm? Well, at 100mm, the depth of field at 10' for a full frame camera is around 5". Using a 100mm lens at 10' isn’t uncommon when making portraits. Having 5" of acceptable focus isn’t a lot. And, if you want the eyes of your subject to be tack sharp, even shifting things around a bit can lead to poor results, again depending on your definition of “acceptable”. It gets worse the longer you go. The depth of field for a 200mm in this situation would be under an inch.

This, in a nutshell, is what you have to be careful of when you use the focus and recompose technique. If you do need to focus and recompose, you should try to alleviate any potential issues by stopping down your aperture. For example, the depth of field in our setup above at f/8 would be a bit over 6'. Focus and recompose in this case would most likely produce decent results. The issue can also be alleviated by shooting with a wider lens. For example, using a 35mm lens in the above setup at f/2.0, the resulting depth of field would be around 3 feet. Of course, then you have a relatively wider angle of view and a different photograph entirely.

So, what should you do? Well, if you are using lens and aperture combinations that give you a lot of depth of field to work with, focus and recompose can work out fairly well. On the other hand, if you’re working with wide apertures or long lenses, then you’ll need to be more careful. No matter what the situation, your best bet is to manually select the focus point that is closest to your subject if you can and avoid recomposing altogether.

Finally, the desire to avoid recomposing is why photographers who own a camera with 45 or 51 focus points really dig their systems. With so many points, it’s more likely that they can manually select just the right one to use to make a photograph composed just the way they want it without recomposing. Then when their subject’s expression changes—say when something emotional happens—they can snap off the next picture immediately using the same focus point placed in the same place.

Last week, while visiting Criterion Collection headquarters to observe their transition to Blu-ray, I brought up the subject of digital downloads. To my surprise, they let slip a little detail that sheds light on how a master disc maker like Criterion will manage in an all-download future.

As we've seen, even "HD" digital downloads are far from the quality of Blu-ray, so there's a hesitance to offer up their restorations in a format that doesn't live up to their very high standards. Lee Kline, Criterion's Technical Director says "I would be depressed if we just went from standard-def DVDs to standard-def downloads."

David Phillips, who works in DVD development at Criterion, explained further:

When you're talking about a dual-layer Blu-ray disc, you're talking about 50GB of data. Now, a lot of our films might not necessarily take up all that space, but even if they're taking up 25GB on a single layer disc, you're still talking about a heck of a lot of data to download. Now, the way that broadband infrastructure is in this country, any films you're downloading aren't going to have the data rate or resolution of Blu-ray.
When you work on the mastering part of it and the restoration and you see how good that image looks, it's really hard to say, OK, we're going to squash this down to the point where it'll fit through everybody's pipe.

However, according to Kline, digital downloads are on Criterion's radar.

We're pretty close to figuring out what we want to do with downloading, and I think our new website will cover that, which you'll see in a few months. I don't want to give any details yet, but we're not dismissing that as a viable option right now. But until it's faster and we're sure that we're going to give people a download that works in an acceptable amount of time, we'll go there when we need to go there. We're not scared of it, but we're also not ready to do it yet.
There'll be some sort of downloading and some sort of information regarding… OK, I'm going to stop, I'm giving away too much.

My guess is that there will be downloading of some sort, but it may or may not be full films. Who knows? Maybe it will be short scenes from classic movies, shown at higher-than-ever-before bitrates.

Would you be interested in downloading Criterion's restorations even if the quality wasn't that great? Or does that kind of go against everything that Criterion is about?

Le Project Triangle is one of those buildings that make us think that we may actually drive flying cars one day. To be completed by 2014 in the Porte de Versailles area in Paris, its most impressive feature is that, according to the architects, it won't cast shadows on adjacent buildings. The trick is the orientation and it's shape: While it looks like a massive pyramid from one side, the other side shows that it really is an ultra-thin triangle resembling a shark's fin:

My guess is that it is oriented in such a way that the sun doesn't project shadows over the buildings around it. That or it's made of cloned cells from the Invisible Girl. Architects Herzog & de Meuron say that their stunning structure's shape will also allow for "optimum solar and wind power generation".

Le Projet Triangle, Porte de Versailles
Paris, France
2006 –, planned completion 2014

“Le Projet Triangle” is primarily perceived on the metropolitan scale of the city of Paris. Its elevated stature will lend major visibility to the Porte de Versailles and the Parc des Expositions site within the overall conurbation. It will also permit its integration in the system of axes and perspectives that constitute the urban fabric of Paris.

On the scale of the Porte de Versailles site, the project will also play a significant role in the reorganisation of flows and perception of urban space. The Parc des Expositions site currently forms a break between the Haussmanian fabric of the15th district of Paris and the communities of Issy-les-Moulineaux and Vanves, emphasised by the visual impact of the peripheral boulevard.

The construction of an ambitious building on the Porte de Versailles site will mark its opening and restore the historical axis formed by the rue de Vaugirard and avenue Ernest Renan.

The square of the Porte de Versailles is a complex space in its current configuration. Its initial semi-circular organisation is difficult to interpret given the many visual impediments and lack of clearly identified public spaces between the Parc des Expositions and the buildings opposite.

Building on the square itself would intensify this problem of perception: our project therefore proposes to free this space by positioning itself along the avenue Ernest Renan.

This move offers three major advantages :

it permits the creation of a public square between the boulevard Victor and Hall 1 of the Parc des Expositions, by reorganising logistic flows.
It creates a strong link between what are known as the “petit” and “grand” parcs, the two parts of the Parc des Expositions.
It marks the Paris / Issy-les-Moulineaux axis, allowing the urban space to cross the peripheral boulevard by activating the entire facade of the avenue Ernest Renan.
Situated along the avenue, the project is located at the heart of the Parc des Expositions site, set back from the surrounding residential areas. Its volumetry also takes into account the impact of a high building on its environment. Its triangular shape actually means that it does not cast shadows on adjacent buildings. The environmental approach of the project is also perceptible in this simple, compact volumetry which limits its ground impact and allows the optimum utilisation of solar and wind power due to its excellent positioning.

Apart from its structural and technical qualities, the filigree, crystalline nature of the project permits its integration in the system of perspectives formed by the Hausmannian axes. This dialogue with the city is not however limited to its silhouette, but also defines the internal organisation and texture of the project.

The Triangle is conceived as a piece of the city that could be pivoted and positioned vertically. It is carved by a network of vertical and horizontal traffic flows of variable capacities and speeds. Like the boulevards, streets and more intimate passages of a city, these traffic flows carve the construction into islets of varying shapes and sizes.

This evocation of the urban fabric of Paris, at once classic and coherent in its entirety and varied and intriguing in its details, is encountered in the façade of the Triangle. Like that of a classical building, this one features two levels of interpretation: an easily recognisable overall form and a fine, crystalline silhouette of its façade which allows it to be perceived variously.

This “vertical city” district stands in close relation to its environment and is accessible to a highly diverse public. Taking up the analogy of urban squares, it offers each individual the opportunity to enter a complex of spaces open to all on its levels.

The base of the project is open to all, from the square of the Porte de Versailles and along the avenue Ernest Renan which regains the appearance of a Parisian street, with its shops and restaurants. An elevated square, on level with the roofs of Paris, will offer everyone a unique view of the district and the whole city. This visit might then be extended in the higher reaches of the Triangle, from where the entire metropolis can be discovered.

The Triangle will thus become one of the scenes of metropolitan Paris. It will not only be a landmark from which the urban panorama can be viewed, but also an outstanding silhouette in the system of axes and monuments of the city.

Herzog & de Meuron, 2008

[Dezeen]

Background

The introduction of the MagSafe connector for MacBooks and MacBook Pros was NOT good news for users of iGo or Kensington airline/car/boat power supplies. Neither manufacturer has yet come out with a MagSafe tip, for reasons probably related to Apple’s patent.

This hint describes a simple method of using an iGo power supply with a MacBook. Some simple soldering is required, and following these instructions will obviously invalidate your warranty for both the power supply and your MacBook. The author takes no responsibility whatsoever for any damage caused!

If you already have an iGo (mine came with tip 4 included), this hint will set you back £2.08.

The principle is very simple: Insert an in-line plug and socket into the cable of the original Mac power supply. There's more »