Kalimat al-Mutafalsif

I just threw the new theme on my website and was poking around making tweaks this afternoon. I wanted slightly different colors, wanted to make the picture look cooler, maybe edit the footer to change the whole "Made by" to me, and give credit for being based on the theme I based it on. However, upon opening the footer.php, I found a very weird comment:

 
/* V8 - WARNING: This file is protected by copyright law.
To reverse engineer or decode this file is strictly prohibited. */
 

Well that's weird, because in the style.css we read:

/*The CSS, XHTML and design is released under GPL*/

(Side note, if you don't know what we mean by GPL, check out their site.)

No, they don't say PHP in there, however I read that (because 'design' is included) as "This theme is GPL'd". Poking around their website, I see no mention that you're required to keep any part of the theme the same.

If we read past the warning about reverse engineering, we see why they included it, a nasty big base64 encoded blob, then an eval command. Pastebin paste is here.

This piqued my interest, as I can think of very few legitimate reasons to do such obfuscation, or why there should be so much (footer.php is 47kb!). My initial thought was that I'd opened a backdoor into my site, with lesser thoughts to them being able to push random stuff into my footer (the last way I was infected), and finally just trying to control the links on the bottom of the page so that even if I were to edit their theme (as is my right under the GPL) I couldn't take credit for it myself, they'd always have credit for it. None of those sat right with me, so I hit up the local IRC channel, and we started puzzling.

Read More »

Another game review coming at you, took about a week off for the holidays and worked in some PS3 time.

Game: Metal Gear Solid 4
Developer: Kojima Productions
System: PS3
Difficulty: Solid Normal (3rd highest of 5)

Background
Metal Gear Solid 4 is set in a bleak future where war is a driving force for the world economy. Instead of standing armies, countries turn to Private Military Companies (only referred to as PMCs) to fight their wars, and the game portrays these wars as being purely for business sake. The soldiers are all kept in control by nanomachines running throughout their body, and every piece of equipment is 'tagged' to respond only if an authorized user is using it.

Full review below the cut.

Read More »

Yesterday I posted a long write up of my thoughts on Fallout 3. In my haste to get that written and get off to bed, I forgot one of the main points I wanted to talk about, although in retrospect I think that it deserves its own post anyhow.

The Hacking Minigame
Scattered across the Wastes, whether in museums, house, or random places that just happen to have turrets nearby, you'll stumble across old computer terminals. These may be useless systems that just contain a random citizen's poetry about the current situation, or control the turret system you're about to walk into, or do anything in between. Some of the terminals are just open, these are almost always of the useless 'poetry' variety. Most, however, are password protected which gives you two ways to get inside of them. Ok, possibly three if there's a "D - none of the above" choice, Such as just blowing up the turret you want stopped.

The easiest way to get in is searching the surrounding area for a password. Yes, just like in real life, the denizens of the Wastes write down their password, and stick it in their desk (or in their pocket, or corpse...). I chuckled a little bit the first time I found one of these in a desk.

The normal way to break in to the terminal is the hacking minigame. I've seen a few of these over time, ranging from simple "Guess the password" Flash games, to HBH and Hack This Site, and this was probably the simplest one that captures the feel of real hacking.

When you open up a locked terminal, you'll see a screen like the following:

At the top you see 'Attempts Left', this starts at 4 most of the time, and counts down. If you ever use all your attempts, the computer is locked down, and unless you have a special skill you're out for good.

Below that is a bunch of plaintext and garbage. This is supposedly a recovered password file, and its up to you to figure out what's the correct password. You do this like Mastermind, you pick a plaintext string, and it'll tell you how many letters are correct, and in the correct spot. If the password was Grapes, and I clicked on Kitten I'd get back 1/6. Statistically this becomes very hard once you get up to hard terminals that have 8 characters and a bunch of choices. The way to make it easier is to look through the garbage for hints. Anytime you find matching braces, parenthesis, or brackets, you select the first one and it'll either remove a dud string, or replenish your allowance. Unlike the plaintext words, you must mouse over the first character in one of these garbage strings to see the whole thing highlighted. On my old TV this was a lesson in squinting and frustration, trying to pick out the parens from braces.

Once you correctly input the password, the computer is forever open to you (and you get 44 experience, regardless of level!).

The Reality
The reason I liked this minigame, is its darn close to reality. Not in the actual skills used, but through the sifting through of a bunch of garbage, trying to figure out what's valuable and what's just another corrupted file. You have to sit there, be patient, and keep trying. In some cases you have to cancel your attempt because you're about to lock the system, and start all over again. Sure, when script kiddies can just release a botnet these factors are mitigated, but at the heart of it all, it comes down to noticing the little things (oh, look, an old Apache install), having to piece things together (Hmm, they plugged all the holes in Apache, but I noticed there's .php pages, maybe mod_php is old), and hoping you're going after a user that's careless enough to leave their password laying on the desk.

And of course, there's always the ability to bypass getting into the system, and simply pick the lock on the safe, or destroy a turret or two and forget about the system.

I picked Fallout 3 up the night before I had surgery with the thought that I'll have tons of time to myself to plug through an RPG. We (a friend that was helping me out at the time and I) logged a good amount of play time, if I can find a way to find out exactly how much I'll edit the post to reflect that, during the next week while I was off from work. Having just hit two possible endings tonight, I felt it was time for a review.

Note: I will keep this as spoiler free as possible, however if you really don't want to learn anything, walk away now. I will give basic geographical/plot background information, and some limited meta information about endings, nothing about the endings themselves.

Read More »

I've been laid up for two weeks now due to my own stupidity. Ok, my own stupidity coupled with a 400 pound motorcycle and a extra 3 inches I wanted her in the corner. Ok, my own stupidity, Kari, a corner, and my father and I cracking jokes about hernias (he'd had two by then, I'd had one). So of course, Karma being the fickle mistress she is, she graced me with another hernia (I'm ahead of my father who didn't get his FIRST until my age!). The hernia itself didn't hurt much, it just felt uncomfortable enough while sitting up straight that I took that week off of work.

My surgery was scheduled for this past Tuesday, but I had a friend coming in last weekend for a concert and gaming. What's a boy to do? I took the noble way out, and holed up all weekend with the PS3, new Magic (the Gathering) decks, and a new (to me) game called Gloom in order to feel as good as possible for the concert. I have to say, this game is a winner.

Gloom is made by Atlas Games, a company that makes some fun and compact games, such as Lunch Money that are easily portable, and yet very engrossing. What intrigued me as I was reading the back of the box in a good local game store were the card design and feel of the game.

The cards are clear. That's right, clear. The image on the back of the box shows this:

(feel free to ignore the creepy clown, he's but one of 20 characters)

Every character has a portrait in the center, and some flavor text in various places (name, title, flavor). Each Modifier (What's that?! More later) card has flavor text (name, flavor text), modifiers in one or more of three locations (all on the left), optional rules, and an optional story icon. In the sample picture above, the top top card is an untimely death, but the Modifier card under it has a -10 modifier in the middle spot, see it? It also has a bat as the story icon (this is just a generic 'beast').

Basically the game revolves around stacking Modifiers on top of Characters (you control a whole family, the winner is whichever family has the lowest self-worth). Because the cards are clear you'll see Modifiers or story icons from all the cards below unless you play a card that has something in the same spot. The goal is to eventually kill off your Characters using Untimely Death cards when the have the lowest self-worth possible, hence the name, Gloom.

The fun part is the feel of the game. Knowing just the above the game seems, well, depressing, but it is simply hysterical. Yes, you can play just by tossing cards around like you might in Magic, but the whole point of the game is to tell the sad story of a certain family. Think of it like a good Poe story, if Poe was Dave Berry. In the rules it encourages you to tell more of the story as you play Modifiers and Untimely Deaths, kind of like the old campfire game of everyone adding a sentence to a story, since you can play cards on anyone's Characters. The fun bit here is the usual 'punish' on another player of hurting their character is flipped on its head. So you'll hear "Angel was unhappy since she got beat up by bums, but then she met the man of her dreams and got blessed by the church." "Nooooooo! Why?! I didn't do ANYTHING to you!".

The stories get fun. A friend who's holed up with me since his car is in the shop and has been for weeks was playing purely based on building good story lines. It doesn't get wins but I was dieing laughing at bits of it. For example (card names in italics):

Player 1 (owner of Grogar): "Grogar, the half alive Teddy Bear, went on a trip last week. He went to see his family in Africa, but forgot to bring his water purification tablets. Ever since he's been distressed by dysentery." (-25 total Modifier, -15 on top, and -10 in the middle).

Player 2: "Grogar was horribly distress by this disease, especially when he heard it affected his whole family back home as well. However, when his much-removed uncle, Jimmy, finally succombed to the disease, he left Grogar the family land, all of Egypt! Grogar really landed a legacy." (+15 total modifier, +15 in the center... which wipes out the -10 from above).

Player 3: "After Grogar landed his legacy. he became the talk of the town! A cute young teddy bear named Jenny introduced herself, and not three months later they were wondrously well wed!" (+20 total modifier, 0 on top which wipes out the -15 from Player 1's card, +20 on bottom).

Now in one turn Grogar has gone from being worth -25 (a decent score, all 5 members being worth that is -100 total. My wins usually come around -110 to -130) to +35, a rotten score. Thankfully there's very very few ways to kill off a Character while they have positive self worth, but it'll still take a few turns for Grogar to go back to getting points for his player. More importantly, we now know Grogar has land in Africa, and a newly wed wife, which lets us play an abundance of negative cards and stay within the story!

Overall, my two friends and I have really enjoyed this game. We played 4-5 games last weekend, and I've done 2-3 since then, way more than we played with the Magic decks we all bought. The games can take a while, the three player games lasted about an hour apiece using all five Characters in the families. I'd have to rate it a 4/5 for myself.

Why does it warrant a 4/5?

• It is unique, its not a rip-off of another idea (aka another CCG, or based off a computer game or movie).
• I still get a kick out of the clear cards, they look and feel darn cool. The humor is to die for (pun intended).
• The box is small, easily tossed into a bag, mayhaps even a purse (I don't own one, so I wouldn't know) to have if you're planning on waiting somewhere, or for a picnic.
• Its a smaller game company, I really like supporting companies like SJ Games, Atlas, etc over mass-producing places like Hasbro. The games feel more unique, and usually have a bit more 'flair'.

So why not a 5/5?

• After a few games we could tell what card the opponent would play just by listening to the story, a few more cards would be very welcome. There are add-on packs, and I may pick them up just to get a little more randomness.
• With even a 3 player game we got through the deck one and a half times before the end of the first game, so its something you can expect to happen.
• It comes in a box, not a tin. This is very common, and I dislike it. See box rant below.
• I feel a 5/5 is for games that make me sit back and think "Wow, am I lucky I experienced that. nothing better could be done." You know, like the movie Torque.

Box Rant:
Recently I've become very irked at games that are packaged in cardboard boxes, not tins. For a big game, this makes a bit of sense, such as Munchkin. Big box, can be made of study cardboard, in two parts like a normal box + top. However, for small games that are Chez Geek sized (and Gloom is the same size) or smaller, where the box is one cardboard box with flaps that need to close over the cards, this is not a good solution. It works fine when the cards are in their shrink wrap, but after one game they're a tad bigger, and the flaps never close correctly. They'll get bent, or let cards slide out, or not fit the rules, its just not a good solution, its a hack. Hacks, while clever, aren't right for long term solutions.

The real solution here is tins. Make a tin the same size as that cardboard box and it'll hold its shape. It'll hold the cards. It'll snap closed so you're absolutely sure no cards are falling out in your backpack. Tins work. I'm sure they're not used because of a price issue, but I'm always more inclined to buy a tined game than a boxed one. My hack to fix their hack is ziplock bags. All of my game cards, for all of my games, live in plastic ziplock bags. I know they're not coming out.

Ok, the title lies. but I'm cleaning up my desktop, and came across a screenshot from a few days ago. It is a CAPTCHA that I, for the life of me, could only make sense of as: Six E Pi Pi. So, in this case it worked, right? The human figured out what the letters should be, except as clearly as those are Pi's, Pi is not a letter on my keyboard. I figured I should get a screenshot to show where CAPTCHAs are going:

Sadly, CAPTCHAs are a technology we need to combat spam, which accounts for at least 80% of email today, not to mention message boards, instant messages, or text-messages. However, we're merely engaged in a technology arms race with spammers, this is *not* a technology that is winning any fights, we just try to stay one step ahead. This is increasingly hard with CAPTCHA entry being a job in countries with lower incomes, spammers cheating by offering porn in return for solving a CAPTCHA, and (in a case that doesn't just apply humans) CAPTCHA breaking drives AI research. Basically, no 'new' CAPTCHA technology is going to keep spammers out for long. A bleak future indeed. On the other hand, we already have 80%, how much worse can it get? I think the real answer lies in spam filters, although for the most part those are also in a mere arms race, but at least then you can control your own computer, not just leave the image out there for another human to crack.

Its been a few months since I announced I was going to try to write a PHP based Mafia game and in that time I've learned a decent amount.

First off, if you want a project done, you can't be getting distracted. Since I've started Thieves Tavern I've also fallen in love with motorcycles and started gun smithing. Both of those have stolen major programming time away from this project. Its only through the weather being downright cold lately, and parts for the gun being on back order that I've had the time to get gung ho on this project again.

Secondly, when dealing with databases, its really easy to tailor the database so that the game works. In fact, that's the whole point of editing the database: To test this bit, or that bit... but not the overall product. Earlier this week I'd reached a point where I thought I could push my code live, and invite some friends to beta test it. I figured, at the time that clearing out my database would make stuff work better, get rid of all the random edge cases I'd built up along the way. Well, after clearing out the database, nothing worked. I couldn't start games, I couldn't chat, nada. This is when I learned that it doesn't get easier after removing test data, only harder. It took another two days of testing, clearing, testing some more, as well as cleaning up my code, before I got it back to the 'working' beta state. Thankfully, now I know its working as intended (minus the obvious beta bugs, of course).

So now its off to beta test Thieves Tavern. I'm kind of excited to be playing this, I had loads of fun while playing myself in local tests, and I can imagine it being even better taking out friends online. If you'd like to help test, get ahold of me (in real life, I'll ask for signups for a public beta later on) and I'll send you an invite.

(And in the 10 minutes it took to write this I already have a laundry list of fixes/stuff I just plumb forgot)

I nabbed a plugin to fix my borked LJ Crossposting script... mine was not behaving nicely. So this is mainly a test to see if/how it works.

Test.

Test 2...

Big Test

Now we're testing an edit, and adding in a link to the plugin's home.

Tragically, there was another school shooting at the beginning of this week. This one was in Finland, and their second in 12 months which left 10 dead, 11 including the shooter. We can expect the cry for more gun control, both domestically, and in Finland, so I pulled out a post I've been saving due to not having time to finish it.

Finland

First I want to address the Finland shooting. Finland is third in the world in terms of gun ownership per capita, behind the US, and Yemen. This is because hunting is huge in Finnish culture, as one person puts it, "the national sport". And yet more people are killed by knives than guns (according to that article). The youth are raised around weapons, they can legally own a firearm at 15 with parental permission, and for handguns they must be a member of a gun club. Yet until 12 months ago, they'd never had a tragedy like this.

The conclusion we should be able to come to, is its not the gun's fault, its the human's. You have a person capable of cold-blooded, calculated murder, and no amount of laws will stop them from carrying out what they want to do. It requires human intervention: Parents who care, friends who realize when someone's hurting inside, kids that are strong enough in their self-image that they can get through school without bullying. As many are so fond of criticizing the War on Terror, its more than just people with guns, its a social problem that requires compassion, and understanding. However, if those fail, you had better be prepared to fight for what you love, because when a person reaches the utter mental darkness these killers were in, there's going to be no reasoning.

Its worth pointing out that in this most recent case the killer had homemade bombs with him, as did the Columbine shooters, if they had no access to guns, they would have still been able to kill.

But that brings us to Gun Control.

Gun Control

Gun Control: At its heart, the idea is fairly basic, to control the guns that are in public circulation so that bad people can't get them. While I know people who would argue against any limitation on weapons, I think most will agree that there are people out there who shouldn't own firearms, just like there are people who shouldn't be able to drive, people who shouldn't be allowed to practice law, and people who shouldn't be allowed to practice medicine. One obvious answer here is felons, if you're convicted of a violent crime, you forfeit your right to bear arms.

Unfortunately, in recent years gun 'control' goes way beyond 'control'. Now people want a gun ban in the name of gun control in some places, such as the District of Columbia (recently overturned), and Britain. Yes, this will keep guns out of the hands of law-abiding citizens, unfortunately we have to remember that these guys who shot up their schools were not law-abiding. They committed many acts of cold-blooded murder, and no gun ban would have prevented that. Now, it would have made it harder to get the gun, but as we can see from Britain, it would by no means have stopped them from getting guns. There violence went up once private citizens lost the right to bear handguns. I've heard first hand accounts from friends that if they ever did something wrong, and the bobbies wanted to stop them, they'd simply run, since the worst they had to face is a night stick, and they could out run the cops.

Piracy

Now, I'm going to play to my (intended) audience for a while. You know I'm not just some crazy gun nut, I also fancy myself a (white hat) hacker, and know most of the arguments for and against music|software piracy. What does that have to do with gun control? Lets examine DRM, or "music piracy control". DRM is a system whereby a company can have "absolute" control over their intellectual property, in this case lets say music. If I went to any hacker, and said that Congress passed a law requiring DRM on every digital music download, to prevent piracy, do you think they'd be put out at all? No, they'd laugh, and explain how in 3 minutes or less they'd be able to bypass the DRM (I'll refrain to linking to those news stories... I value my freedom). I know, I know, this is completely unrelated! Or is it?

In both cases we have an arbitrary control system, X, designed to stop the user from doing Y. In the case of gun control, X is "legal ramifications" and Y is "buying guns", and in the case of DRM, X is "DRM", and Y is "copying the music". In both cases it is the honest people that suffer here from a lack of freedom and security. In the case of guns its physical security and the freedom to defend yourself, and in the case of DRM its the lack of freedom to use what you've bought and the security that if your computer dies you can have a backup. So why is it that one of these is a perfectly smart move, and the other will never work?

As a security professional I know that there's no such thing as a secure system, I don't believe that for a computer with limited physical access and a decent firewall. So why would I believe that any country, or even any city, could pull off a complete gun ban, eliminating the ability for criminals to get their hands on them? Now, in the case of my computer, I plan for Bad Things to happen. I keep backups, I make sure there's spare hardware around just in case, and I look at my security logs to make sure. But how do we plan for Bad Things to happen when the gun ban falls through? Should we sit around, and pray the cops come quicker than the 5 minute average? I've had my car trashed before, had two friends of the criminal take their time, and walk away right past the cops who took 10 minutes to get to my call. Do I have faith that they'll be that much quicker when I call and say someone's held me up at gun point? Or that Someone's broken in and has a gun? Of course not! I'm not saying citizens should take the law into their own hands, just be given a chance to defend themselves until the cops can show up.

Deal with the Problem
For the sake of the argument, I'll say we have a completely 100% secure gun ban in effect in America. This won't stop violence, as Britain has shown us, there must be another cause. In the end, crime is a human (not social, humans created society, therefore its a human problem at its root) problem, and will be around as long as humanity is. What we, as a society and a race, need to do is recognize those human problems, and combat them, not the weapons used. When guns are banned, knives will be used. When knives are banned, shanks will be made (look at prison), when all sharp objects are eliminated from our society, ropes will be used to strangle (again, look at prison). There's no end to violence, the best we can hope to do is recognize what causes humans to become killers, and fix it.

The most obvious period, is during childhood. There's a recurring pattern of these school shootings where the kids doing the shooting were "outcasts" in their school, or were ridiculed, or bullied. Those are by no means reasons for murder, not even for retaliation! But, those killers should stand out to school counselors as people who need extra concern (not pills, actual human care), and stand out to the students as people who need their compassion. We're a society who wants to do away with moral and personal responsibility, when what we should be doing is recognizing that a successful society will care for each other.

Conclusion
In conclusion, I feel that the true control needed in our society, is that of controlling ourselves. Guns are regulated enough, we need to turn ourselves now to the people next to us in society, that man on the bus who's always looking sad, that driver who just cut you off, the quiet kid in your class that you all think is just a bit odd. Take it upon yourself to say hi, or not flick off the driver, or ask him to sit with you at lunch. Not because this may prevent a shooting, or a suicide, or an incident of road rage, just because they're humans too, and we all know the dark places a human mind can go to when depressed. I guarantee you, if we spent as much time and focus on helping those next to us in society (I don't mean hand outs, socialized health care, or any of that, I mean honest to goodness one citizen helping another kindness) then violence will go down in a way we'll never know through straight gun control.

As I mentioned before, I'm putting together an AR-15, and my next few posts will be the story of how its been put together. I'm also using this project to test out Picasa, so I'll use that to post my images (just as soon as it finishes scanning a few of my automated rip folders, such as icanhascheezburger, forgot I had all them!)

Before I begin, I'd like to link to a schematic which can be found here. This way when I mention random parts you can find them and play along!

This first post is about the lower assembly, which is the buttstock, lower receiver (has the hammer, trigger, magazine well, etc). At this point I'd like to note I'm using a great book by Walt Kuleck and Clint McKee, The AR-15 Complete Assembly Guide, its got nice pictures and very very good detail on how you'll screw stuff up if you don't listen. Well worth the $17!

Parts

Lower Receiver
I bought a DPMS stripped lower receiver from a local gun enthusiast, which cost $158.73 after taxes, cable lock fee, etc. On the AR, this stripped lower receiver, meaning it is just the frame, no trigger, hammer, nothing on it, counts on its own as an assault rifle, because it has the serial number on it. So I walked out of there with a piece of metal in a locked dry box with a cable lock through the mag well, to make it 'safe' to transport.

Lower Receiver Bits
I'm not too particular about my trigger yet, so I also picked up a DPMS Lower Receiver Parts Kit for $56.99 (Don't buy anything direct from DPMS by the way, you can always find it cheaper). Some may ask why I didn't just buy a completed lower receiver, but I wanted to understand how everything works, and say I built every inch of this gun.

Buttstock
All that was left was the stock, and I snagged a Command Arms 6-position stock assembly, for $92.99. Its a very nice stock, and am quite happy with the sturdiness of it, as well as the function. It has rails on the right side, and a 4 battery storage area on the left side (can be swapped for more rails) which is more functionality than I'll need for a while. Went on in about 5 minutes, including forgetting to put a detent in, and having to redo it.

Assembly
The assembly was easier than I expected in terms of simplicity (piece X goes in slot Y), but harder in terms of executing it (piece X really does not want to go into slot Y, and X's spring is fighting me too). It took about two hours, including redoing a few steps to make sure it was right, flinging detents all over the room as I learned why they say to do something one way, and searching my house for various tools I thought I already had.

The trigger guard's been the hardest part so far, since its roll pin just did not want to go in, and required a "motivator". After that went in, I put in the magazine catch, so I could mount the gun on a handy little bench I have, and then moved on to the trigger and disconnecter. Somewhere in there the bolt catch went in, and that's where I stopped last night. This morning I got up and put in the hammer, safety, pistol grip, and buttstock. It was very straight forward, but like I said above, there are a few places where you really should get a tool to do the job for ya, like the front take-down pin. Otherwise you're gonna shoot the spring all over the room, and don't even think about finding the darn detent afterwards!

So now I've gotta go order all the upper parts, a receiver, bolt/bolt carrier, barrel, and some hand guards. I'll be getting a scope eventually, but may pick up flip up sights due to cost for this first build, not sure. I have pictures of the whole process, if you know how to get a hold of me in real life I'll pass on the URL.