Bad Bus Security

Joseph Reeves has an interesting little story about how a badly designed e-commerce system results in both an obvious security flaw and a missed opportunity for better customer relations over in Oxford. This all started when the bus driver refused to accept the email displayed on a phone, but wanted a paper copy, even though he had no way of verifying either as being legit! Quite how the driver thinks that printing out a copy of an email you have makes it more legitimate than the electronic version is left as an exercise for the bemused.

Exploiting the hole in the Oxford Bus Company’s awful system is easy; print a genuine looking email that contains the details of any bus journey you want to take. The bus driver only wants to see an email and your ID, they have no access to any passenger lists; should anyone with a passenger list board the bus (some kind of ticket inspector, I guess), you can remind them that the customer is always right; furthermore, act mortified at the fact that they blame a failing of the booking processing system to register your journey as some sort of criminal action on your behalf.

Josephs suggestion of how this should work is straightforward:

Fixing this bus ticket problem would be very simple – the Oxford Bus Company just needs to generate a unique ID number that it includes in emails to customers and to provide drivers with access to a passenger database. Buses are already fitted with Internet connections to be used by passengers on the journey, so all that needs to be provided is a very simple device to the driver.

Leading to possible improvements in service, like:

A passenger boards the bus, hands over their ID and says “my number is 546672”, the driver taps this into the machine and replies “ah yes, hello Mr Reeves, I’ll let you know when we’re at Heathrow Central bus terminal”.

It may be that the Oxford Bus Company has done a risk assessment and believes that the loss due to the fraudulent use of the service is lower than the cost in equipment and time taken for the driver to validate a ticket, but I doubt it. In contrast the Melbourne SkyBus service (from memory) lets you buy online, you then have to print out a ticket which has a barcode on it which the driver scans to validate it. Of course that means that you can’t carry it around electronically (well, not easily on a phone I guess) but does have the advantage that the barcode scanners are pretty quick, much faster than having to have someone type it in (and maybe get it wrong).

Debian Gives Up on Glibc (Updated)

It appears that the Debian developers have finally gotten to the ends of their tethers trying to deal with the foibles of GLIBC and its maintainer. There’s a post on Aurélien Jarno’s blog saying:

I have just uploaded Embedded GLIBC (EGLIBC) into the archive (it is currently waiting in the NEW queue), which will soon replace the GNU C Library (GLIBC).

He gives a list of reasons for the change, all of which seem to make good sense. My concern (like many others) is that I worry about the impact if they are unable to keep compatibility with glibc based distros – though it’d be nice if they followed Debian’s lead on this (which they may do if this leads to a much easier working relationship with the maintainers – which doesn’t appear to be that hard to achieve!).

Update: If you’re curious to see what packages will be affected there is a list of the Debian packages built from the eglibc sources available.

(Via LWN)

Google Student Photography Prize

Google is running a photography competition to develop themes for iGoogle in conjunction with the Saatchi Gallery London for higher education students around the world. You’ll need to submit 5 photos to make up a theme.

36 shortlisted students will get their photos turned into iGoogle themes, 6 finalists will get exhibited at the Saatchi Gallery and the winner will get a GBP 5,000 bursary and a day with the documentary photographer Martin Parr. Entries close 31st May so if you’re interested (and eligible) you’d better get your skates on!

Tram Meets Car

Courtesy of Jeremy, a YouTube video of cars trying to turn in front of trams in an unnamed city in America. Most of them are people either turning illegally or just not paying attention, sigh… 🙁

What makes this one more than just a curiosity is that I stumbled across a FOI response about such accidents in Houston, Texas and happened to notice that the dates on the video matched the ones in the PDF, and that the tram numbers and descriptions of the vehicles involved matched too. The document even names the drivers and lists the amount of damage they caused!

PS: Thanks Gary for the (hopefully) XHTML 1.0 Strict way of embedding YouTube videos!

Oracle buys Sun ? (Updated)

Thanks to Chris Dagdigian on the Beowulf list for pointing out:

It’s official:
http://www.sun.com/third-party/global/oracle/index.jsp

That link says:

REDWOOD SHORES, Calif., April 20, 2009 — Oracle Corporation (NASDAQ: ORCL) and Sun Microsystems (NASDAQ: JAVA) announced today they have entered into a definitive agreement under which Oracle will acquire Sun common stock for $9.50 per share in cash. The transaction is valued at approximately $7.4 billion, or $5.6 billion net of Sun’s cash and debt.

First thought – what on earth does that mean for MySQL ?

Update: this appears to be answered (well, as much as you can in a paragraph) in this FAQ document on the Oracle website (PDF):

MySQL will be an addition to Oracle’s existing suite of database products, which already includes Oracle Database 11g, TimesTen, Berkeley DB open source database, and the open source transactional storage engine, InnoDB.

Second thought – what on earth does it mean for the Sun NCI/BoM HPC deal in Australia ? HPC is hardly Oracle’s market..

Update – it appears the Oracle website can’t cope, currently it’s saying:

No Response from Application Web Server
 There was no response from the application web server for the page you requested. 
Please notify the site's webmaster and try your request again later.

I wonder if they need a LAMP stack to help them out ? 😉

Update 2Joe points out in his take on the deal that Sun employ(ed) a bunch of core PostgreSQL developers too, which could make life even more interesting..

Final thought for the night – what does this mean for btrfs, ZFS and Solaris licensing ? Oracle have said they are still committed to Linux, so perhaps we’ll see them trying to resolve the NetApp/Sun WAFL/ZFS patent lawsuits in a GPL compliant manner and then relicensing Solaris under the GPL – that would be sensible I think from their point of view as they could then use the good points of Solaris (dtrace and ZFS) to help improve the Linux kernel and benefit from a much larger developer community than they could otherwise get their hands on (OpenSolaris being a niche OS). Of course I won’t hold my breath, but it wouldn’t surprise me either..

Jaunty gotchas..

A couple of things to be aware of before you upgrade to Jaunty (9.04)..

  • Amarok v1 has been dropped, so if (like me) Amarok2 doesn’t do all you need with iPod’s, etc, then you’ll need Bogdan Butnaru’s Amarok 1.4 PPA to get the classic version for Jaunty.
  • Currently there are issues with MytTV and ATI cards in Mythbuntu (and presumably all other Ubuntu variants) where it won’t display fonts, there’s a Launchpad bug for it and a proposed fix in Mesa waiting for approval at present. The work around is to disable DRI in you xorg.conf for the ATI card, or you can add Mario Limonciello’s PPA containing Mesa builds with his proposed fix.

Other than that I’ve been happily running Jaunty on a number of boxes for a while and it’s been pretty painless so far – though I’m using the mainline kernels on all of them.

Microsoft Guilty of Patent Infringement (again)

A patent infringement battle that’s been going on in the US for 6 years between Uniloc and Microsoft over an Australian invention that lies behind the product activation used in Windows and MS Office, etc has been resolved – and Microsoft has lost to the tune of a cool US$388 million – that’s over half a billion Australian dollars…

On Wednesday, the jury found Microsoft wilfully infringed the patent.

Wilful infringement means that Microsoft knew about it and didn’t care, rather than just not knowing it had been patented. Microsoft tried to argue that the patent was invalid, but the jury didn’t buy that argument. All rather ironic after the Tom-Tom issue (they settled as Microsoft were about to get their imports to the US blocked prior to any judgement on whether or not it was a real issue)..

There’s an interview with the CEO of Uniloc, Brad Gibson, about the verdict on the ABC website.