Hashemian Blog

DNS Vulnerability

2008-08-28T22:42:00.002-04:00

While programming is my main focus at my company, one of my side jobs at work is networking. I have no complaints as I'm curious and interested in the inner workings of computer networks. Our IT department handles most of the networking tasks, but I usually find myself getting involved in setting up connectivity in the company. Whether it's a firewall, a router, a reverse proxy, or a DNS server, I find the networking field too fascinating to ignore.

That's why when the latest DNS vulnerability, discovered by Dan Kaminsky, came to light in April 2008, I began investigating our DNS servers to determine the risk factors. Dan's site contains a simple tool to assess the risk and it identified all of our caching DNS servers as vulnerable. A patch from Microsoft took care of our Windows-based DNS servers, but there was also a Fedora server in the mix running an old version of BIND that needed attention. Patching that server would have required upgrading to a newer version of Fedora.

I knew I could buy some time using the safety-in-numbers logic, but today I finally decided to tackle that server and plug the hole. My intention was to install the newest version of Fedora (version 9) on a new hardware and then add a patched version of BIND on top. BIND is a great name server product but it has a large footprint that seems like an overkill as a caching server. There are several other free DNS products out there so I began to look for an alternative.

My search eventually led me to PowerDNS (PDNS) and I decided to give that product a try. After installing Fedora 9 on the server, I downloaded the latest RPM of PNDS and promptly installed it on the server. PDNS comes in two flavors. The authoritative version and the caching version, known as Recursor which is the one I was interested in. The install was a breeze and the configuration was as easy as importing some of the data from the old BIND server and making some quick edits to the recursor.conf file. A server restart to make sure everything is in order, and I had the new caching server up and running, resolving names.

PDNS has been free of the DNS cache poisoning vulnerability for a few years now, and Dan's site confirmed that the new server was indeed running at much safer levels.

There is little doubt that the bad guys are hard at work to poison as many DNS servers as they can get their hands on. If your unpatched servers haven't been targeted yet, it's only a matter of time before they are. Whatever method or product you use to avert this risk, the sooner you do it, the better. As a quick alternative, you can use one of several free and already safe services like the one offered by OpenDNS.com as direct name servers or as forwarders on your caching servers.

dns,dns vulnerability,dns hack,fedora,bind,powerdns,opendns,networks,named

Online Car Registration Renewal, Finally

2008-08-27T22:00:00.001-04:00

It's taken a long time. Perhaps a decade late for the Connecticut Department of Motor Vehicles to carry out some transactions online, but better late than never. While most of the private industry has shifted their operations online, the government is painfully behind on that front. The reasons range from the government being generally slow, to having under-paid technology workers and to shunning change. But change is inevitable and the DMV has finally taken some steps to that end.

When I received my registration renewal papers in the mail a couple of weeks ago as I have for years, I started to reach for my dusty checkbook to write a check and mail it in. that's when I noticed a new section on the paperwork detailing their online renewal service. I thought this was one of those payment processing sites that handle credit card payments on behalf of the government offices and charge an extra fee. But no, this was the real deal. An actual DMV site that handled renewals and accepted credit cards with no extra fees.

It took a mere couple of minutes to take care of the business on the site and I had an email confirmation soon after. The renewal document and sticker followed about a week later. It took them quite a long time to get on with the technology but I'm happy that they finally made it. I just hope that enough people make use of it and there are no major glitches to force them back to the old way. Online payment sure beats writing checks and licking stamps.

dmv,car registration,online payments

Herniated Disc, Six Months Later

2008-08-13T22:59:00.002-04:00

It's been nearly 6 months since I was diagnosed with a herniated disc. During that time I have had to make some lifestyle changes, but looking back, the adjustments haven't been as drastic as I might have feared initially. Or perhaps I am now just used to dealing with the condition.

When I was in the throes of the torturous pain, all I could think of was that my life as I knew it had ended. There would no longer be any running, no motorcycle rides, no hiking and no getting in and out of the car without the excruciating pain. Fast forward 6 months and those dramatic changes I was afraid of didn't quite materialize. There has been some changes to be sure. No lifting of heavy objects, no fast running, and occasional pain in the lower back and down the leg to contend with. But with daily exercises, sleeping on a hard surface, and avoiding long periods of sitting, I have been able to reclaim some of the freedom I used to enjoy.

Thankfully, so far I have been able to avoid steroids shots or more drastic measures like surgery. I have done quite a bit of research during this time and realize that many people aren't as fortunate as I have been, but at the same time many others live normal lives with their herniated discs.

As far as I can tell and as explained by my doctor, the herniated mass has probably shrunk with time, relieving the pressure on the spinal cord and affording me more freedom of movement. That is not to say that I am completely pain-free. There are occasional bouts with pain and discomfort which I manage with patience and a few doses of pain killers. But generally, I have resumed a relatively normal life. The prospect of another attack is on my mind every day, but I try not to let it rule over my life.

My approach to my condition has been not to succumb to a state of hopelessness. It's difficult not to, but after accepting the situation, I decided that the best way to manage it was to continue with my activities the best I could. Ditching the bed for a thin pad on the floor has helped. So have daily back exercises and conditioning. As much as I wanted to continue with my running routine, I initially down-shifted to walking. Even that was painful at first, but as time passed I was able to slowly incorporate some jogging in my daily walks until I was ready to completely switch over to jogging. On good days, I would increase the distance to 4 or 5 miles. Currently I'm on alternate days of jogging and walking and that has been relatively steady. I have also learned not push it too far. When there's pain during a jog, I heed my body and slow down to a walk. There's no reason to be stubborn and risk paying a big penalty later on.

The point is that if you are an active person who has suddenly been struck with a herniated disc don't lose hope and wallow in grief too long. It doesn't have to be all or nothing. There's always a middle ground. Accept what has happened and then make the right adjustments to battle your way back. You may never be the same as before, but concentrate on what you can salvage rather than fussing over what has been lost.

herniated disc,back pain,running,walking,jogging

Yahoo Slurp Versus Googlebot

2008-07-19T12:05:00.001-04:00

As a part of my early morning routine at my job I scan a daily notification on our web site visitor patterns, specifically looking for abusive or abnormal page requests to identify rogue hosts. I wrote the program years ago, but it has become one of my most effective tools in identifying abuse.

No surprise that search engine robots (spiders or crawlers) always top the list. Spiders are necessary evils. You want them crawling and indexing all your pages frequently, but that leads to spiders with voracious appetites that can rob the infrastructure of performance.

Speaking of voracious appetites, for years Googlebot used to top our crawl volume list, far and away from the second position, usually (but not always) occupied by Yahoo Slurp (Yahoo's spider). As of a few weeks ago I am noticing that Yahoo Slurp crawl volume is surpassing that of Googlebot. The first few days I considered it an anomaly, but the levels have remained consistent, knocking Googlebot out of its first position. Googlebot still registers with more or less the same numbers, but Yahoo Slurp has been consistently beating those numbers, sometimes by twice as many. That's a considerable spike in Yahoo's crawl activity.

I find it interesting that Yahoo's crawl volume started to rise in the midst of its take-over battles with Microsoft. Search engines have always competed on who has the most indexed pages. It's a bragging right, more than it is a practical or useful matter in search accuracy. But accuracy in search results is subjective, while page volumes are concrete numbers and that's why they are sometimes used as key differentiators between competing search engines. Still, the timing of the jump in Yahoo's crawling activity is intriguing. Could the motive be to enhance its index size (considered a key asset), thereby adding to the company's value? One wonders.

Meanwhile, sites need to consider the battle repercussions between the search engine titans as their increased crawl rates could put additional pressure on their infrastructures. One way to mitigate the effects is to set up mirror servers and deflect the spider/robot traffic to them using application-aware appliances, but that there's some effort involved and there's room for error as the servers need to be synchronized in real-time, specially for those such as news-related sites that continuously publish new pages and fresh content. The other consideration is bandwidth management to accommodate increased traffic. At the least, faster servers and fatter pipes are in order. As a reference here are the current signatures left behind by Google and Yahoo crawlers:

Googlebot's user-agent:
Mozilla/5.0+(compatible;+Googlebot/2.1;++http://www.google.com/bot.html)

Yahoo Slurp's user-agent:
Mozilla/5.0+(compatible;+Yahoo!+Slurp;+http://help.yahoo.com/help/us/ysearch/slurp)

google,yahoo,search engines,http,seo,googlebot,web

The ANWR Oil Debate

2008-07-07T00:09:00.001-04:00

Lately I've seen a number of Web sites and emails exhorting Americans to press their government to explore for oil in a parcel of land in ANWR, the Arctic National Wildlife Refuge in the northeast corner of Alaska.

The ANWR debate is nothing new and it was a hot topic back in the 1970's oil crisis. Proponents argue that this location may hold vast deposits of oil which could bring relief to the current shortages of oil and thus tame the high prices in the US and the rest of the world. Opponents include the natives and environmentalists who fear that such exploration and subsequent drilling could endanger this natural setting robbing it and its inhabitants (humans and animals) of its ecological diversity and wealth.

I am not sure which side of the debate holds the better argument. Personally I don't like to see natural settings overrun by industrial concerns, i.e. the oil companies. What I do know is that Exxon-Mobil's earnings topped $40 billion in 2007 and surely they will easily exceed that figure this year. As people learn of these outlandish profits by the big oil while their savings are being squeezed, there is bound to be some backlash. That has manifested itself in the form of calls for special taxes on oil companies.

Couple that with the inevitable emergence of fuel economics and alternative energy and it's not hard to guess that oil companies are worried about their prospects. To me, these pro- oil exploration campaigns are not about alleviating oil shortages, but more about distracting the public from the abuses of the oil companies. Many go even further to shift the spotlight away from the big oil and cast it on the liberals, democrats, or Arabs in a shameless effort to create public sympathy and support for the oil companies. One wonders who the real authors are.

Oil companies already have millions of acres of land they can start exploring, but that's not enough. ANWR may hold large reserves of oil, but this campaign smells more like a land-grab and less like a sincere effort to help calm the oil crunch. Blaring their propaganda machine in times of panic and despair is always a good way to assure power and profits.

Review history and see how dictators and tyrants have come to power. Their reigns have almost always preceded by periods of unrest and panic when people are at their most vulnerable and can be easily deceived by empty promises and blustering rants. Once they tap into the herd mentality, they are assured of their golden positions. I want a way out of this oil mess too, but not enough to sell out this country to oil thugs. They're beyond rich enough already.

oil,anwr,alaska,oil companies,exxon

RSS/ATOM SyndicationFeed in .NET 3.5 Framework

2008-06-29T21:20:00.003-04:00

Among some of the new classes introduced in Version 3.5 of the .NET Framework Class Library (FCL) were the syndication-related classes. While other technologies such as LINQ, extension methods and lambda expressions have been grabbing most of the attention the new syndication classes also deserve a nod. Part of the System.ServiceModel.Syndication namespace the classes offer a variety of methods to easily generate or consume syndication feeds in RSS 2.0 or ATOM 1.0 formats.

It's not that reading or writing feeds were exceedingly difficult before. FCL comes with a number of XML classes that facilitate working with XML data which all syndication feeds emanate from. No doubt there are plenty of sample code out there that made the task as easy as copy, paste and tweak. But now FCL comes with its own native classes to handle feeds, with advanced settings, intellisense, and potential of extension.

To demonstrate ease of use, here's a sample code that pulls in a sample feed from Google, and scrapes and saves the content of each link to a file:

var wc = new WebClient();
using (var rss = XmlReader.Create(
       "http://finance.google.com/finance?morenews=10&q=NASDAQ:INTC&output=rss")) {
  var feed = SyndicationFeed.Load(rss);
  foreach (var x in feed.Items) {
    var uri = x.Links.Last().Uri;
    wc.DownloadFile(uri, @"c:\rss\" + Regex.Replace(uri.LocalPath, @"^.*/", ""));
  }
}

That was easy, eh? Just remember to add System.ServiceModel.Web.dll as a reference to your project. Happy syndicating.

rss,atom,microsoft,net,asp.net,xml

DNS Mystery, NameServers, IP addresses

2008-06-18T00:18:00.003-04:00

Today I was trying to reach 1&1's home page, but the browser kept failing to pull up the site. Mysteriously I was able to reach 1&1's home page when I changed my DNS servers to those of OpenDNS.org. Feeling curious I decided to investigate the matter in depth. My default DNS server was reporting the IP address of www.1and1.com to be 217.160.232.1. While that address belongs to 1&1, it's really one of their routers or gateways and not a Web server. No wonder I was unable to access the site. the working IP address reported by OpenDNS.org and a number of other DNS servers was 217.160.226.203. That is indeed the correct IP address for www.1and1.com. So why was I seeing different results from different DNS servers?

As you may know the job of translating a host name to an IP address falls on a program known as the resolver which queries its designated DNS server for the answer. If the DNS server can not produce the translation (from its cache or authority zone), it issues what it's know as a recursive query to the DNS network on the Internet. The host name is broken to its fragments and each fragment from right to left is queried successively. The results generally consists of hosts known as NameServers, which get the query one step closer to the final result. The final NameServers produce the IP address translation. However, if any of the NameServers along the way can produce the translation, the query stops and the IP address is sent back to the resolver.

Using the Unix/Linux dig command I followed the name resolution for www.1and1.com one step at a time. Results are shown here and shortened for brevity.

This command displays the root servers:

# dig
;; ANSWER SECTION:
.                       451081  IN      NS      M.ROOT-SERVERS.NET.
.                       451081  IN      NS      A.ROOT-SERVERS.NET.
.                       451081  IN      NS      B.ROOT-SERVERS.NET.
.                       451081  IN      NS      C.ROOT-SERVERS.NET.

This command queries one of the root servers and produces NameServers for "com." TLD (Top Level Domain):

# dig +norec @A.ROOT-SERVERS.NET www.1and1.com
;; AUTHORITY SECTION:
com.                    172800  IN      NS      K.GTLD-SERVERS.NET.
com.                    172800  IN      NS      L.GTLD-SERVERS.NET.
com.                    172800  IN      NS      M.GTLD-SERVERS.NET.
com.                    172800  IN      NS      A.GTLD-SERVERS.NET.

This command queries one of the "com." NameServers:

# dig +norec @A.GTLD-SERVERS.NET www.1and1.com
;; ANSWER SECTION:
www.1and1.com.          172800  IN      A       217.160.232.1
;; AUTHORITY SECTION:
1and1.com.              172800  IN      NS      ns27.1and1.com.
1and1.com.              172800  IN      NS      ns28.1and1.com.

Generally the previous command shouldn't produce and IP address, instead the authority section would prompt a final query to one of the 1and1.com NameServers (which by the way have the correct IP translation.) Instead somehow an IP address is produced at this level and the query ends with this inaccurate IP translation. I've tried the same query with the homepage URL's of Microsoft, Google, Yahoo and a few other sites and none return an IP address at this level.

It remains to be seen if this erroneous translation would eventually spread around, causing 1&1's homepage to become widely inaccessible. Anyone knows how that IP translation ended up in of the "com." NameServers? Am I making wrong assumptions here? Feel free to let me know.

dns,nameservers,domain names,ip addresses,internet

The Inverted CD Yields

2008-06-02T23:59:00.004-04:00

I was checking ING DIRECT's CD (Certificates of Deposit) rates today and wondered how long will they continue to be inverted. A 6-month CD currently has an APY of 3.3%, while that of a 4-year CD stands at 2.5%.

What I would really like to see is a normal curve, where the longer the CD term, the higher its yield. Bank yields generally follow the economy and when you see this type of anomaly, one interpretation is that there's more uncertainty with the short-term economic outlook than that of the long-term. Another way to put it, there is more perceived risk in the short-term and hence the investment rewards are higher.

So what is the person with a long-term goal to do? My approach is not lock in my money for such a long time when shorter rates pay nearly a full percentage more. That can amount to quite a bit of interest. Sure, there's always the risk of buyer's remorse if the rates headed lower, but to me eschewing the long-term, low-yield CD is a calculated risk.

I would opt for a short-term, higher-yielding CD and keep rolling it over until the longer-term CD rates become more favorable. In fact, it may make sense to completely bypass CD's for a savings account with a decent rate. ING DIRECT's savings account currently has a 3% APY, and the funds remain completely liquid with no early withdrawal penalties. If and when CD rates become more enticing, one can quickly kick some money from the savings account into a CD.

savings accounts,banks,cd,apy,apr,yields,interest rates

Phoenix's Mars Landing

2008-05-24T23:04:00.003-04:00

I bet the team in charge of the Phoenix spacecraft is not going to enjoy a restful night as they prepare to land this hunk of metal near Mars's north pole tomorrow. I'll probably sleep fine, but I'm hoping for good news tomorrow.

This landing is specially poignant, since the last craft (Mars Polar Lander) that attempted a powered landing using retro rockets went MIA on Mars over 8 years ago. The rovers sent up since then have all utilized successful airbag landings, but Phoenix is going for the traditional soft landing and that means edgy nerves while awaiting a successful touchdown signal nearly 9 ½ months after its launch.

Unlike the rovers, Phoenix is a stationary craft, designed to survey the area for water and primordial matter. Depending on its discoveries, it could pave the way for future missions, culminating in manned exploration of the red planet.

For me this is an incredible triumph of science and engineering, specially since I'm still amazed at seeing 500-ton airplanes getting airborne and traveling vast distances. The fact that a tiny craft can be controlled from 35 million miles away is nothing short of miraculous.

Here is the Phoenix blogs updating the events surrounding this mission. Good luck, guys.

space,mars,nasa

Sales, Politics, and Religion

2008-05-23T23:09:00.001-04:00

For a brief period in my career I was encouraged to try my hand at sales. I was ok at it and made decent commissions but in the end I knew that sales wasn't my calling and I returned to my passion, technology, mainly programming. That brief stint taught me one lesson in salesmanship. When on a sales call, steer away from passionate topics, specially when you don't know which way the prospect is leaning. References to religion and politics should be avoided in favor of more neutral topics, unless the product is geared towards a certain persuasion.

Today I was shown an online demo of a Web product. The salesman had worked hard to secure a slice of my time to showcase his product. The part I found curious was the demo Web pages I was being shown. They included news articles about the Pope's Visit with Bush, Christianity, and the Church. Now I have no problem with these topics when used in the context of product demonstration, but I wondered if the salesperson knew about my liberal, religion-free mindset, would he have still picked these topics for his product demo.

The salesman never lead the conversation towards politics or religion, and we kept the conversation on-topic, centered around the features of the product and the cost of implementation. But I could imagine that another liberal person might have reacted negatively to all this and written the whole thing off.

The point is that avoiding emotionally charged topics such as religion and politics, however indirect, is a prudent policy when making a sales pitch to someone you don't know. This salesman may experience much higher success if he picks safer, more neutral examples for his demonstrations. For example, I'm not interested in team sports, but I doubt anyone would have a negative reaction to samples depicting baseball bats . Why take a chance on distracting or alienating your prospects when your goal is to secure their business?

sales,politics,religion,pope

Particle Accelerator and Black Holes

2008-05-21T22:31:00.003-04:00

I'm no scientist, but I do have a keen interest in science. That's why I was fascinated with the The Large Hadron Collider experiment that's about to be commenced at CERN in Switzerland. The basic idea is to replicate (or try to) the conditions moments after the alleged Big Bang by creating a high-energy collision of sub-atomic particles in a gargantuan tunnel and see what happens next, as in, if that results in any matter being created.

The reason I use the word "alleged" with Big Bang is that the phenomenon is really a theory. No one knows exactly how the world came to be and obviously that has been a dead-locked debate between creationists and evolutionists.

But before this cosmic experiment can reach its full momentum, there are a couple of earthly hurdles for CERN to clear in the form of lawsuits. Apparently a few scientists are worried that this experiment could create a man-made Black Hole which could envelope Earth and extinguish life as we know it. So they are trying to put a stop to the experiment to save mankind. Perhaps CERN should play the song "It's the End of the World as We Know It" by R.E.M. as they fire up the instruments. Or how about "Black Hole Sun" by Soundgarden?

Most of the scientific community dismisses such claims as baseless, but one wonders about the what-if factor. I suppose there's a slight probability that a cataclysm could occur as a result of the collision which may engulf our planet. If that comes to pass, I hope it's quick and painless. I'd hate to wake up one day and see a black hole encroaching on my yard, sucking in everything in its path as it expands. At current gas prices, I might think twice about jumping in my car and speeding away.

cern,black holes,big bang,quantum theory,physics rem

Seatbelts and Risks

2008-05-13T22:17:00.003-04:00

Since my last seatbelt ticket I have given the seatbelt law some thoughts. While in my mind this is an oppressive rule, there is one other side of this law that I hadn't considered before. I have always argued against mandatory seatbelts due to infringement on personal freedom. I don't disagree that they can help save lives and minimize bodily harm. And yes, there is the potential for curbing additional societal cost (police, medical, etc.), but that could lead to the slippery slope of banning many activities since there's always some level of risk and potential financial loss associated with them.

My position is that as long as the risk is generally on the risk-taker, personal freedom should trump protection of self by coercion. In extending that argument to seatbelts, I had neglected to consider another side of this issue and that is the possibility of severe financial and emotional risk to others.

The new perspective popped into my head while driving to work the other day. Suppose that due to my negligence I cause an accident. And suppose the other driver wasn't wearing his seatbelt and as a result he is gravely injured or he dies. Since the accident was my fault I would be faced with a large financial liability, not to mention the emotional guilt I would suffer for causing injury or death to another individual. If only he was wearing his seatbelt, he might have walked away from the accident with superficial wounds. I would still be liable for property damage and medical treatment, but the scope of damages would be much smaller and my emotional stress would be nowhere near that of the first scenario.

So it can be argued that by not wearing my seatbelt I'm creating additional risk not only for myself but more importantly for other drivers as well. Looking at this argument from a non-selfish point of view I have now begun to realize that if I am the cause of an accident I hope that the other driver was buckled up. But even if the fault was with the other driver and he wasn't buckled up, I might still suffer the trauma of having been involved in a fatal collision. Judging on that, perhaps the seatbelt law isn't as oppressive as I had initially thought. Of course this argument can again enter a slippery slope and extend far beyond wearing seatbelts, but that's a subject for another time.

btw, which is the correct spelling, seatbelt or seat belt, or both? If had to guess I'd go with the latter (Wikipedia also has the latter), but I have also seen the former used frequently.

seatbelts,traffic laws,accidents,lawsuits

Seatbelt Ticket, Again

2008-05-08T23:17:00.002-04:00

And so the law caught up with me again for the third time, barely 9 months after my last seatbelt ticket. This time I was caught in my own little hometown while driving to work. I was alert enough to see the cop standing by the side of the road looking into cars. I scrambled to grab the belt but it kept slipping out of my hand and by the time I had a good grip, I was spotted and got pointed out of the traffic. Game over.

As I waited for the cop while he was checking my license and registration, I thought the only thing I hated more than wearing the seatbelt was to pay the fine. I could mount no defense. I had clearly broken the law and the officer was just doing his job. Other than that, I consider myself a law-abiding driver. I drive defensively, observe all traffic rules, and I don’t chatter on a cell phone. I don't even have a cell phone. The policeman's gruff manner had changed by the time he returned. He actually apologized for taking long to check my papers (I had handed him an expired registration) and gave me a $37 ticket. Not too painful, considering the fact that my last one was over $100.

I suppose being a town resident had something to do with softening him up. The police department is requesting a sizeable budget from the town for upgrades and there's a lot of grumbling from the taxpayers who are fed up with high taxes. The referendum is coming up soon and there's no need to harass the already irritated residents.

As I continued my commute with the seatbelt fastened I kept fighting the contraption to get some breathing room. I felt like a shackled prisoner in my car, trapped and pinned down to my seat. Several times I was distracted from the road while I kept yanking on the belt to loosen the death grip. Clearly this wasn't going to work.

Obviously fighting this law through civil disobedience was going to cost me a lot of money and a bad record. The apparent solution was in the form of a small keychain store card. I pulled the belt far enough to keep it loose about me and then jammed the card through the slit on the top hook. That put enough pressure on the belt preventing it from being recoiled by the spring. After adjusting the length several times, I think I finally achieved a good balance between looseness and a buckled seatbelt.

I'm not sure if what I've done is illegal or constitutes tampering, worthy of a fine. while I have slightly inhibited the natural operation of the seatbelt, I haven’t made any changes to the mechanism itself. I consider it more of a superficial adjustment, but I suppose it has somewhat reduced the belt's safety factor. For now this allows me to be a more alert driver, while hopefully dodging another ticket.

By the way, I don't recommend anyone doing this. Drive safely and wear your seatbelts.

seatbelts,law,seatbelt law,traffic,police,traffic laws

Yahoo's Fate After Microsoft

2008-05-04T22:59:00.001-04:00

While many are preparing for a dark day for Yahoo's share when the market opens on Monday, I don't think the shares will get battered too roughly, although there will be volatility. Microsoft's withdrawing of its offer isn't good news to many, but speculation on what Yahoo may have up its sleeve might keep the stock from slipping too far.

It's possible that Yahoo overplayed its hand, but it's also possible that Yahoo may have had other plans, yet to be revealed. The plans could involve Google, or private equity, or even something far-fetched like Oracle. And in the end, nothing says they can't get back to negotiating with Microsoft. Only this time, they would probably keep it quiet, until a final deal is stuck.

Yahoo,microsoft,google,oracle,finance

Amazon Bezos Kindle Letter

2008-05-04T22:22:00.004-04:00

Amazon.com has been displaying a letter from its founder/CEO Jeff Besoz on its homepage touting Kindle. In case you don’t know, Kindle is Amazon's ebook gadget. After users buy the book-sized device, they can download and read various books and publications from amazon for a fee.

Apparently Amazon underestimated demand on initial release, but now it has caught up and that's what Bozos' homepage letter is trying to convey.

What's interesting about this letter is that it is entirely a PNG image, not HTML text and tags as one might expect. An image map is used to activate a few hyperlinks in the letter.

I can't figure out why this letter needed to be an image. At first I though that perhaps its content is being protected from search engines, but then I noticed that the entire letter content was stuffed into the alt parameter of the <img> tag, something search engines can easily read. The images is served from the host "g-ecx.images-amazon.com." Interestingly entering this URL in the browser redirects the page to "www.imdb.com", an Amazon company.

Surely most people wouldn’t even notice the format and the ones who do will have a who-cares reaction. In my case I like to understand why things are done in a certain way. I've seen amateurish sites constructing Web pages from images. Amazon is a technology powerhouse. There had to be a reason this homepage letter was not in standard HTML, but that reason escapes me. Someone must know.

amazon,web,kindle,jeff besoz,html

Google Image Labeler

2008-05-01T23:38:00.004-04:00

Here comes Google with yet another Beta version of a product. Only this one is like a game with a fun twist and could get quite addictive. The object of the program is to use human intelligence to label images. As powerful and ubiquitous as computers have become, there are still many tasks that us humans are still more skilled at. In this case, identifying a photo or an image (especially a blurry or a vague one) is a task best left to the human brain.

Amazon has capitalized on the same concept with its Mechanical Turk site. In that site people create tasks, called HITs (Human Intelligence Tasks) and invite others to respond. They could be research quizzes, surveys, categorizing web sites, or writing articles. Responders are paid for successfully finishing the tasks and Amazon keeps a commission.

In Google Image Labeler, Google harnesses its vast visitor pool to assign labels to images. Two people are paired at random for each round and for 2 minutes are shown random images in sequence. Participants are tasked with coming up with as many labels as they can for each image. One side doesn't see the other side's suggestions. If one of the labels match, the participants are given a score and they move on to the next image. Or they can skip the image.

What's in it for the participants? A journey into the psyches of 2 randomly connected people for 2 minutes at a time, and accumulating scores, perhaps for bragging rights. And for Google? A cost-free experiment to more accurately identify the images in its vast database. Since participants don't know each other and time is short, they are motivated to quickly suggest the most appropriate labels based on their visceral reactions.

If you get a chance, give Google Image Labeler a shot. Just be warned that it could get addictive. I had to stop myself after a few rounds, lest I waste hours in oblivion.

Speaking of Google, the stock climbed another 19 points or 3.25% percent today to $593. Since its low of $413 on March 10 (barely 7 weeks ago), it has risen nearly 37%. Could've, should've, would've.

google,amazon,images,human intelligence,mechanical turk,psychology

Google Toolbar 5 Beta

2008-04-29T19:15:00.001-04:00

Google toolbar is out with a new version 5 in beta. While I find myself using Firefox more often than before everyday, I’m still on Internet Explorer the majority of the time, perhaps due to force of habit, or the fact that some sites display better on IE. I have refused to upgrade IE 7 however. Version 6 runs just fine for me.

Ironically, what keeps IE a viable browser for me is Google toolbar. There are plenty of useful and time-saving utilities in the toolbar from quick access to Google search to spell checking, to auto-filling forms.

The new toolbar is similar to the last version, but there is one feature that I stumbled on by accident that really made this version worth the upgrade. The toolbar hooks itself into the search function (Edit-Find…Ctrl+F) of IE and displays a Firefox-style search bar at the bottom of the page with similar functionality as that of Firefox. The web page document is searched and the first match is highlighted as the search term is being typed. It's a giant improvement over IE's stodgy pop-up search box.

I'm not sure if the Beta version is available for Firefox yet, but if you want to try the toolbar out on IE, pick it up here: http://toolbar.google.com/T5/

google,google toolbar,internet explorer,Firefox,ie

Religious Contextual Ads

2008-04-24T22:07:00.003-04:00

Sometimes contextual ads can reveal interesting facts about a site and its visitors. For some time I have noticed that Google Adsense has been displaying a certain banner for a site targeting Muslims seeking marriage partners.

Personally I don't mind religious ads on my site. It's all about business. I consider myself an agnostic (as in, I can not with certainty prove or disprove the existence of god or the validity of any religion,) but I have a liberal view towards faith. People should be free to choose whatever creed works for them as long as they don't force it on others.

I don't know what algorithm Google employs in targeting Adsense ads, but I must assume they strive to maximize click-through rates. It's possible that many of my site's visitors are Muslims (or Moslems, as Persians pronounce it), or perhaps my middle-eastern last name, Hashemian, triggers these banners. My bet is on the latter. To the algorithm, I'm just an unknown visitor from the U.S. who happens to be visiting the site.

At any rate, there must be some religious profiling at work here. I haven't seen any Christian or Jewish or Hindu-oriented ads on my site. Certainly I haven't seen anything for matching Agnostics or Atheists.

If the site helps two Muslims find each other and become a couple, that's cool with me. But if the marriage produces a male child (or female, for that matter,) I only hope they resist the temptation to have their child genitally mutilated, or in euphemistic term, circumcised.

islam,agnosticism,atheism,marriage,dating,circumcision,persia,iran,adsense

Yahoo Beats, Microsoft Next

2008-04-22T22:53:00.002-04:00

As I had expected, Yahoo reported good earnings, but nothing spectacular. The stock has received a slight dent in after-hours, most likely the effect of selling into the good news. Chances are, barring any big news, it'll stay relatively flat tomorrow.

The question still is whether Yahoo can maintain the earnings going forward. I believe most people don't have much faith in that. One quarter is hardly an indication of a trend.

The bigger question, however, is the status of Microsoft's offer. A better indication might arrive on Thursday when Microsoft reports its own quarterly earnings. Even with Vista's slow uptake, my feeling is that it will show healthy earnings. Microsoft has a long history of under-promising and over-delivering on earnings. The weak dollar will probably help its bottom-line considerably as well. Many U.S. companies have gotten a boost from the weak dollar, offsetting their weaker domestic intake with higher overseas revenues.

While many believe that Microsoft's acquisition of Yahoo is inevitable, there is still plenty of twists and turns left in this saga, including piercing the defenses of some heavy-weights such as Google, News Corp., and Time Warner, who would want to see this takeover derailed.

microsoft,yahoo,google,earnings,weak dollar,vista

Yahoo's Earnings

2008-04-21T23:21:00.003-04:00

Yahoo is slated to report its earning tomorrow after the market close. If it can pull off what Google did last week, the stock should rise to about $35.

Then again, that was Google and there was plenty of pent-up demand from buyers. The stock had been pounded so bad that there was nowhere for it to go but up. The good earnings news only gave it the additional momentum it needed to explode way up. Yahoo's stock probably won't see a 20% rise on Wednesday no matter how good its earnings.

Given Yahoo's snobby attitude towards Microsoft's advances, one has to surmise that it's feeling pretty comfortable with its earnings. A good report will validate its position in resisting Microsoft and holding out for a higher offer while giving it much bigger bargaining power. On the flip side, if the earnings are dowdy, little doubt will remain that Microsoft would prevail in its takeover efforts.

It's ironic, but I'm sure Google is rooting for Yahoo to report stellar earnings and fend off Microsoft. I've already seen Yahoo ads on Google's network and Yahoo is probably getting a good deal on these.

If early indications have any value, my bet is on Yahoo reporting decent earnings. If nothing, that would be another signal of strength in the Internet market. Of course, if I were so sure, I would have picked up a few call options myself, which I haven't. The May 08, $30 call strikes saw plenty of activity today. No doubt, more of the same tomorrow. Then again a lot of it could be from traders protecting short stock positions.

stocks,options,yahoo,google,microsoft,earnings

Bank Service Agreement

2008-04-15T23:00:00.001-04:00

Every time I receive a new service agreement from a bank or a credit card company I know they've devised a new way to profit from the consumers.

Remember when many credit card companies shortened the payment cycles (grace periods) from a full month to three weeks or less. That was their ingenious way to snare more consumers into their penalty list, charge them extra interest, and jack up their interest rates.

Or another time when they changed their dispute policies by curtailing consumers' right to lawsuits, replacing it with arbitration. No doubt their hand-picked arbitrators would always side with the banks, forcing consumers into unjust settlements.

Here's another Service Agreement I received recently addressing online payments:

We may delay or cancel a request to transfer or charge money back to the Pay From or other account at our discretion including if the payment:
Looks suspicious or fraudulent
Appears to have incorrect amount or recipient information
Seems to duplicate another payment

Of course this is spun to appear as if the bank is attempting to protect its clients against fraud. But what it's really saying is that the bank has given itself arbitrary and broad powers to do as it pleases, including charging fees, if it the transaction doesn't seem right, based on its own vague definition. Look at the verbs used: "Looks", "Appears", "Seems". What kind of rules are these? I mean why even bother with a service agreement? They should just replace all that with a terse statement like: "We will charge you whenever, however, and whatever amount we feel like. Have a nice day."

service agreements,banks,credit cards,online banking

Political Contextual Advertising

2008-04-06T13:37:00.010-04:00

When a site like this one makes the decision to put up advertising from ad networks such as Google Adsense, it loses some capacity to make a quick first impression.

Years ago when the fears of Indian outsourcing was at its peak and people in the U.S. were terrified of job losses, a company put up a Web site in defense of the American workers. When the company decided to monetize the site via Adsense, it was horrified to find out that most of the ads were touting outsourcing to countries such as India and Philippines. In other words the contextual ads were conveying a message opposite of the site's intended one and some users faced with those ads probably regarded the site as pro-outsourcing.

The image to the right is exactly about the same issue. Here is an ad by John McCain that has been coming up on this site for a few days now. It's quite possible that visitors to this site, upon seeing the ad, infer that this site is about politics or it's even pro-Republican.

Yes, I am interested in politics, no, I'm not pro-Republican (certainly not in its neo-con incarnation), and right now I don't really have a strong opinion about McCain or any other potential candidates. I do consider most politicians as greedy hypocrites and I may indulge in a rare pro-liberal banter in my blog, but this site as a whole is politically neutral. Anyone from any camp is welcome here, yet I wonder how many visitors, seeing this ad, would actually make that distinction.

mccain,politics,republicans,democrats,politicians,adsense

Tax Spam Season

2008-04-03T23:22:00.004-04:00

You know the income tax filing deadline (April 15th) is nearing when tax-prep companies rev up their spam engines.

This one from H&R Block is offering half-off their regular prices. Obviously trying to push through a few more sales before the filing season is over and they are back in the lull period. I'm sure I'll get a few more of these unbeatable deals right up to April 15th.

Thanks, but no thanks guys. This year I used TaxAct and it had a great price right from the start, free.

*Note: My endorsement of TaxAct is completely unsolicited. I just liked the product and the fact that it cost nothing.

income tax,taxes,taxcut,taxact,irs

Citibank Online Banking?

2008-04-01T23:35:00.003-04:00

If it was an April fool's joke, surely many people didn't find it amusing. While the stock market was rocketing up today, Citibank's online banking site was down and out, stranding thousands of their customers.

We're not talking about a short outage, this was an all day near blackout. What astounds me is that there was no admission and no warnings on the site indicating the problem. It was as if everything was running smoothly. Could it be that the people in charge didn't even know about the problem for hours, or perhaps they were too arrogant or too cowardly to admit the issue and warn their customers? Meanwhile many people who have come to rely on Citibank's online banking, no less at the encouragement of the bank itself, were shut out without any means of conducting their businesses.

I can understand that computers and Web sites go on the fritz sometimes. That's what redundancy and failover is for. Short of poor planning, Citibank could have at least had the decency to notify its customers of the outage and suggest alternatives. Instead it decided to bury its head in the sand and not even promptly respond to customer inquiries.

Online banking should no longer be considered a luxury, it's a necessity to many people. This is not a site about the latest escapades of Paris Hilton or Britney Spears. It's an integral part of many people's daily lives. With all the problems that's facing financial institutions these days, this is a sure way for a bank to send its customers rushing for the exit doors.

citibank,online banking

Prospectus Paper Waste

2008-03-31T22:27:00.002-04:00

Like many people I have a 401(k) account through my employer, invested in a few mutual funds. I can appreciate that by law mutual fund companies have to send their clients their prospectuses (prospecti?) whenever there is a change in their investment strategies, but I was getting tired of receiving these booklets in the mail.

I would just give them a cursory look and then toss them in the trash. I assume many people do the same. I doubt even a small number of people would actually read these from cover to cover and then promptly file them with their important documents.

So when the retirement management company gave us the option to receive these documents via email, I jumped at the chance. Alas, I'm still getting these tree-killers, like a large one arriving today via mail weighing in at 70 pages. Makes me wonder why I even bothered signing up for the electronic format.

Now I know these companies are erring on the side of caution. With so much fraud and mismanagement swirling around the financial institutions, they reckon it's better to be safe than sorry. So they just keep mailing the stuff, hoping to avoid a small chance of someone accusing them of hiding material facts.

That's all fine and good, but in this day and age of green living and electronic transactions, shouldn't they at least try to respect the wishes of those of us who opted in for email and adapt their systems? If they're incapable or unwilling to join the digital revolution, they can hire a bunch of Nigerian spammers to handle the task. The Nigerian scammers figured out years ago how to conduct their businesses via email and apparently they are very successful at it.

Even the U.S. government, the paragon of technical backwardness, has been going digital with programs such as e-Filing income taxes. It's about time mutual fund companies learned how to save those documents in PDF and attach them to email.

mutual funds,email,pdf,taxes,spam,nigerian scams