Quick Steampunk Book Review: Boneshaker

Cherie Priest has done something in Boneshaker I once thought foolhardy and absurd. She has given Steampunkers the world over a good reason to wear googles.

In Priest's alternate history world the Blight has caused the citizens in early Seattle to don elaborate headgear and rock the hell out while running from roving hoards of the rotting undead. The Blight also gives Priest a good reason to have airship pirates, mad scientists and mysterious Chinamen running the streets in a wasted urban landscape. In a strange parallel, she also has a tough lady as a retro-mechanical version of Gibson's Ratz from Neuromancer as bartender in the ex-patriot bar Maynard's.

Overall I liked this book, but I absolutely loved how Priest didn't go over the top with the Steam-ification of things. Not a single person went around with brass watch gears sewn to the lapels of their great coat! Top hats with random gears? NONE! This book is about the nitty gritty of life in an alternate history and these people don't have the time for silly and useless glommifications that seem to be substituting for style in the modern Steampunk fashion trends. Priest has done something I thought was almost impossible and thankfully skipped right over the silly parts of the genre. Until I read Boneshaker I thought Steampunk goggles were among the worst parts of it, right down there with the airship pirate theme. She has lifted them from the depths of absurdity and made them a necessary and believable part of the landscape for the book. Inside the novel is also her own version of a BFG, and the effects of the Blight give it a good reason to exist. None of the characters use silly little raygun pistols and I'm pretty sure I never read the word aether in the book.

Thanks, Ms. Priest! You've redeemed Steampunk from the downward spiral of mindless fashion trends and useless gizmos.

Dissecting a Simplex lock

Some guys at CCCKC brought part of an old-school Simplex lock down to the cave. I've always wondered exactly how they work and what kinds of vulnerabilities they have.

Pushbutton locks like this (and older designs with the buttons arranged in a pentagon shape) have been around for ages, but I've never had one in my hands before. I have always guessed that:

1. They are 100% mechanical (requiring no electricity)
2. The order doesn't matter.
3. Any combination from 1-5 digits would be viable
4. Each button can only be pressed once

I'll explain how these hypotheses work out as I go along.

Starting out, you can see where the inner door knob will attach on the other side of the wall. The nub at the top (or, to the left in this photo) is strange to me. As it turns out, it's used to reset the combination.

Once open, the lock mechanism inside is covered by a metal shroud. Some pivoting arms can be seen.

Here, I have swung the arm going to the combination mechanism out of the way, and I'm pulling the shield away. There's no power in here, so hypothesis #1 is true.

Here, I've re-attached the arm with the shield removed. Every time a button is pressed, the pawl associated with it rotates a little. The bar seen across the top of them will increment any of the lower numbers at the same time. If you press "1", only the first pawl moves. If you press "3", then pawls 1, 2, and 3 move at the same time. This means that the order in which buttons are pressed DOES matter. Hypothesis #2 is false.

Here is the other side of the combination mechanics. Visible is a gate with 5 fingers. When the outer knob is turned and the gate can't fit into the pawls (wrong combination) the furthest left bar (vertical in this photo) stays upright. The pivoting arm buckles, and the inner knob does not turn. The bolt work (not visible) is not withdrawn.

When the gate is aligned, the pivoting arms are allowed to swing up a bit (angled left a bit in this photo), and the inner knob is caught. The bolt is withdrawn and the door is allowed to open.

To reset the combination:

1. Enter the current combo
2. Activate the combination reset. I'm activating it with my finger in the above photo, but twisting that nub in the first photo does the same thing. It should "click" when you get it pressed. You do not need to hold the button.
3. Turn the door knob to clear the combination.
4. Enter the desired combination.
5. Turn the door knob again.
6. Test the new combination. You don't want to get locked out!

So what about hypotheses #3 and #4?

I got a few surprises:

• If you accidentally turn the knob twice during a combination reset, you end up completely clearing the combination. If this happens, the door will open without you entering anything. Obviously, if you DO enter something in this state, it'll be wrong and won't open.
• More than one button can be pressed at a time, and it's part of the combination. You can require any combination of keys to be pressed simultaneously, up to and including all five at once. 2/3, 1, 4, 5 is a valid combo, and you can't press 2, 3, 1, 4, 5 or 3, 2, 1, 4, 5 to make it work.

#3 was incorrect on a technicality. Any combination of 0-5 keypresses is valid.

#4 is correct. Once a button's been pressed, pressing it again does nothing, but you CAN press multiple at once to increase the complexity of the combination.

All in all, this was a fun little way to spend an hour or so at the cave. I was happy to finally get to learn how these fascinating relics work. As with any combination lock, once you can see the mechanics of it while you mess with it, it's pretty easy to get it to pop open.

The sheer reliability and simplicity of the mechanics leaves me in awe. It's no wonder you can still see these in airports, hospitals, post offices and elsewhere. This is certainly one of the more clever locks I've dealt with.

Props to Rob K for helping me get some higher quality shots of the combination mechanics.

Viral marketing

As seen in my Facebook notifications. Facebook apps in general are shady business, but this just seems downright predatory.

For those who don't know, any application you add potentially gives the author carte blanche access to anything you can see on Facebook. Friends' updates, list of friends' friends, not to mention almost anything you've bothered to fill out about yourself. Think about that before you go handing the keys to the kingdom over to LivingSocial or any of the other application developers.

Related: Risk Analysis: Swine Flu, Facebook Privacy & Security Guide (v1.1) via Social Media

Security.

2600 Article: Roll Your Own Hive-Mind

Editorial comment: This initially showed up in the Autumn 2009 issue of 2600: The Hacker Quarterly,Volume 26 Number 3, which is on stands now! I wrote it almost a year ago. Today, I would say that Google Reader's new options make it a very important part of my personal hive-mind, allowing me to crowd-source my news by hand-picking a relatively small group of people who reliably share and comment on things that I find pertinent, urgent or fascinating -- often near real-time. At the time of writing, sharing with people in Google Reader wasn't nearly as intuitive so it got a lot less play. In the past few months, though, it has grown up to become far more than just an online RSS aggregator and a web filter evasion tool to me.

While I don't feel like this is my best work, I do make a habit of publishing all of my printed articles here after they've hit the newsstand.

There's no doubt that social networking is all the rage on the Internet these days. Places like MySpace and Facebook have become ubiquitous social hubs that start out as a circle of your real-life friends. Eventually, others join in that you've probably never met and might never meet in your lifetime. Your reasons for befriending them may be many: interesting photos or content, similar interests, or simply because they're a friend of a friend (of a friend of a friend). Maybe, you just like to compete in the popularity contest to see how many e-friends you can collect.

LinkedIn has a business focus. Maybe that's where you keep all of your professional contacts or hunt for job opportunities. Brightkite is a location-aware microblog with photo hosting ability; Like Twitter on steroids. Maybe that's how you find out who hangs out at your favorite local places to try to find new friends. Friendfeed can aggregate most content from your other social network accounts. Maybe that's where you go to get your 50,000 foot view of your online social sphere.

What if you wanted to craft a specialized hive-mind, though? I'm interested in security, and I've found that online, quite a few security geeks have blogs, twitter accounts, facebook profiles and the like.

Instead of just looking for your existing friends online, you can leverage microblogging services like Twitter to find and follow like-minded strangers. Obviously, self-described social media addicts have no problem finding their cliques, but everyone from World of Warcraft Gamers to Bacon-lovers can find a niche in most social networks. Security nerds like me have SecurityTwits.

The people you follow will frequently ask or answer questions of other folks. You can follow them as well, and pretty soon you end up with a news-feed of data you're interested in. Assuming enough of them follow you back, you will have a powerful hive mind at your fingertips: This collective will give input on ideas from within itself. It will refine, disprove, or validate answers given to questions within the collective. It will link to fascinating content elsewhere on the web that other members might not otherwise find. It will challenge you to participate by giving as much as you get.

I've found that this hive-mind functionality works best on lightweight services like the aforementioned Twitter, or with link-sharing tools like Delicious, Digg, and Google Reader. Facebook and MySpace are far too cumbersome and broad-sweeping in their content to be used efficiently. Plus, most of the services I mentioned have easy-to-use RSS feeds that can be indexed, processed, aggregated, and searched later.

Of course, if you want people in your niche to acknowledge your existence on these social networks, you need to establish your presence with relevant content that's as equally interesting to them as their content is to you. Jumping onto Twitter and following every single member of SecurityTwits, for example, won't immediately integrate you into the hive. By lurking, however, you can learn a lot.

OpenBSD 4.6 is released

Normally, OpenBSD is released every May 1 and November 1. The team was really trying to push 4.6 out the door by October 1, but problems with the CDs held it back. Still, they managed to ship the CDs early, and decided to release OpenBSD 4.6 today. I've been offline almost all day, so I just now saw it.

As always, the new release brings more hardware support and improved functionality. Check out the release notes for details. Order your 3-CD set, or hit the mirrors to download installation media images.

On cloud computing

It seems everyone is blaming a general failure of cloud computing for the massive data loss that hit Danger, Microsoft and T-Mobile over the weekend.

From what I've read, a failed storage upgrade occurred without a good, solid backup in place. That sounds a lot more like a failure in backup, planning and design than a failure of cloud computing to me. Had the storage folks at my office made the same mistakes, that's what would have been said -- right before the human resources folks came to "have a talk" with the team.

It just so happens that T-Mobile's sidekick phones rely on a lot of back-end storage, so there's the whole "cloud" element to things. I'm not familiar enough with the Danger platform to know how easy it is to back up your own data, but I'd hope it's possible.

I think it goes for any service where you've entrusted storage of your data to someone else: make sure you back it up yourself, if you think it's important. The difference with the Danger/T-Mo disaster, I think, is that it was a lot less obvious to end-users that the data wasn't all stored permanently on the phone. Clearly, "cloud computing" was collateral damage in the wake of a much more mundane failure. The fact that it was completely avoidable offers little comfort for those affected.

Shifting gears: Along comes this piece on how e-mail is becoming less and less relevant.
The thing that separates e-mail as we know it from other messaging platforms is the fact that e-mail is decentralized. Using information stored in DNS, all Internet-facing e-mail servers can properly send mail to the correct server for a given address. IRC is another decentralized communication protocol. The days of decentralized infrastructure are fading fast, though, being replaced by walled gardens that want your constant attention, and many of them requiring a separate account and password. These walled gardens are supposed to be "the new way" of communicating.

You can't easily backup everything you've received through Twitter or Facebook, and the people who communicate with you there have to have accounts. Sure, anyone can get an account. What about Google Wave? Very few of the people I REALLY want to collaborate with have an account. So, while I do see a lot of value in these services for certain things, I don't think that any of them are quite ready to fill the roll that e-mail currently provides. Chiefly: if I have a local e-mail client running on my system, I don't need to suckle at the teat of the Interwebs in order to rifle through my data. It's right there, on my computer. Web mail has indeed blurred the line, but the good web-mail providers still offer mechanisms to back-up your data or use an offline mail client such as Thunderbird.

OpenID somewhat fixes the need to have multiple accounts and passwords scattered all over the web, but shifting authentication "into the cloud" just means that each OpenID account we have will be more catastrophic if compromised. OpenID is tantamount to using the same username and password everywhere, and we know how well that works for security.

How do you backup your cloud data? Well, for starters, you can try a native-client RSS aggregator such as Liferea. One thing that "Cloud" is doing is making syndication possible through ubiquitous RSS feeds. Backups won't work perfectly on every site, for example: you won't actually download all of the photos from Flickr with RSS, you'll only get links to them. It will nicely archive text content, though. This is good for things such as blog posts, twitter conversations and the like.

Solving transit questions with PHP

When I saw Visualmotive's "Walk or Bus?" chart, I was fascinated. I love stuff like this! It answers the question of "If I have to be somewhere, is it going to be faster to wait for a bus, or just start hiking?"

I am a multi-mode commuter. I often use my bike combined with the bus to get myself downtown. Sometimes, I also need to get around the city. I almost always do this on my bike unless it's somewhere really close. Still, I felt compelled to create a chart that included bicycling, as well as walking.

The top header is how long you'll have to wait for the bus.Where there's a gray bus icon, it's faster to wait for the bus. Where there's a blue bicycle, it's faster to hop on the bike and ride. The yellow jogging man represents a brisk walking pace and the green foot represents trudging along with an average gait. I extended the chart out to 4.0 miles, which is about how far one can get on a bicycle in an urban setting within half an hour at 8 MPH. These are just guidelines, of course. Some people are considerably faster on bicycles. Others are slower. Same with walking and the bus, actually.

Click for big:

I ended up making a quick program in PHP to draw the main part of the above chart for me. I sourced the icons from the same place Visualmotive did (icons.mysitemyway.com) but opted to modify their icon colors, then added the headers manually in GIMP. I'll upload a .zip file (and link to it) later, with the icons.

The algorithm is pretty straightforward. Urban buses probably average 15 MPH with all their stops included, or about 4 minutes for every mile. Most people can get around on a bicycle at an average speed of 8 MPH (7:30) and so on and so forth as commented in the code below.

The code is pretty simple and very ugly. Not only did I use tables (ew) but I also barf out HTML with PHP. This is why I say there's a massive difference between programmers (like me) and developers (who code for a living).

<html><head><title>Walk, Bike, or Bus?</title></head><body>
<TABLE cellpadding='0' cellspacing='0'><TR>
<TD></TD><TD><CENTER>1</CENTER></TD><TD><CENTER>2</CENTER></TD>
<TD><CENTER>3</CENTER></TD><TD><CENTER>4</CENTER></TD>
<TD><CENTER>5</CENTER></TD><TD><CENTER>6</CENTER></TD>
<TD><CENTER>7</CENTER></TD><TD><CENTER>8</CENTER></TD>
<TD><CENTER>9</CENTER></TD><TD><CENTER>10</CENTER></TD>
<TD><CENTER>11</CENTER></TD><TD><CENTER>12</CENTER></TD>
<TD><CENTER>13</CENTER></TD><TD><CENTER>14</CENTER></TD>
<TD><CENTER>15</CENTER></TD><TD><CENTER>16</CENTER></TD>
<TD><CENTER>17</CENTER></TD><TD><CENTER>18</CENTER></TD>
<TD><CENTER>19</CENTER></TD><TD><CENTER>20</CENTER></TD>
<TD><CENTER>21</CENTER></TD><TD><CENTER>22</CENTER></TD>
<TD><CENTER>23</CENTER></TD><TD><CENTER>24</CENTER></TD>
<TD><CENTER>25</CENTER></TD><TD><CENTER>26</CENTER></TD>
<TD><CENTER>27</CENTER></TD><TD><CENTER>28</CENTER></TD>
<TD><CENTER>29</CENTER></TD><TD><CENTER>30</CENTER></TD></TR><TR>
<!-- Model View Controller what? -->
<?php
$Miles=.2; # .2 Miles. Just walk it. Jeez.
while ($Miles <= 4.0){
$Miles=$Miles+.1;
$TravelTime['Bus'] = $Miles * 4; # Bus ! 15 MPH (4:00 mile)
$TravelTime['Bike'] = $Miles * 7.5; # Bike ~ 8 MPH (7:30 mile)
$TravelTime['Brisk'] = $Miles * 15; # Brisk walk ~ 4 MPH (15:00)
$TravelTime['Walk'] = $Miles * 20; # Walk ~ 3 MPH (20:00)
$Mins=0;
print "<TR><TD><CENTER>$Miles</CENTER></TD>";
while ($Mins < 30){
print "<TD><CENTER>";
$Mins++;
if ($Mins >= $TravelTime['Walk'])
{print "<IMG WIDTH='45' SRC='img/iconwalk.png'>";}
elseif ($Mins >= $TravelTime['Brisk'])
{print "<IMG WIDTH='45' SRC='img/iconbrisk.png'>";}
elseif ($Mins >= $TravelTime['Bike'])
{print "<IMG WIDTH='45' SRC='img/iconbike.png'>";}
else
{print "<IMG WIDTH='45' SRC='img/iconbus.png'>";}
print "</CENTER></TD>";
}
print "</TR>"; #I know you're not supposed to print HTML. Byte Me.
}
?></body></html>

So, what started as a desire to have a cool chart to share with other bicycling/pedestrian friends of mine turned into an exercise in algorithms last night, with a little bit of PHP programming tossed into the mix. This is yet another example of a quick-n-dirty program I wrote for something simple.