neal groothuis

“Security” through buck-passing.

When I try to follow a link to a Word document in IE, I get the following message:

Some files can harm your computer. If the file information looks suspicious or you do not fully trust the source, do not open the file.”

Thing is, I followed that link because I believe the document has information that is relevant to my interests. Now I have to choose between not looking at it, and potentially getting h4xx0r3d by doing so. Neither of these is an appealing option. (See also: the helpful “Security Center” in Vista.)

Instead of spending the time and effort to have Windows warn me before I open a file that’s of interest so that MS can claim it’s somehow “my fault” for getting pwn3d, why on Earth didn’t they fix Word so that simply opening a document isn’t a massive security risk? I don’t have to worry about this crap if I open a Word doc in Pages on my Mac or OpenOffice Writer on my Linux desktop.

It wasn’t so long ago that we made fun of people for believing that simply opening a document could infect them with a piece of malware. Remember the Join the Crew and Good Times “viruses”? Thanks, Microsoft, for making what most technically-inclined folks thought was unlikely possible; “looking for my virus scanner” is sure where I wanted to go today!

Here’s a not-too-infrequent scenario:

What’s up with that file on my flash drive? I’d really like to delete it, but Windows keeps telling me “permission denied”. I’m pretty sure I have access to that directory.

Oh, I see. It’s in use by an application. Which one? Oh, it’s not going to tell me that.

Guess I’d better download a copy of Process Explorer.

Ah, there we are. That’s what’s holding that file. Ok. Terminating that program… Yay, now I can delete the file.

Now I’m just going to stop the drive so I can safely remove it…oh, look, the drive is still in use; it won’t let me stop it. Let’s see what Process Explorer says is in use on E:\…

Nothing. The drive isn’t in use after all. Yet I still can’t stop it.

*sigh* *yank*

…and now it’s bitching that I have to stop devices before removing them or risk data loss. Thanks, Windows!

What is it with virtually every application you install, plus Windows itself, wanting to put crap on the desktop? (Or worse, doing so without even asking you?)

The desktop is my workspace. Mine, mine, mine, mine, mine!! If there’s something that I’m likely to be using soon that I really want sitting there, I will put it there. Further, to all you developers who helpfully include a by-default-selected option to add a shortcut to your crummy app on the desktop: YOU’RE NOT HELPING. There’s no point in putting an application shortcut on the desktop. If I use the application frequently, it’s going to be in the frequently-used section of the Start Menu. If I’m always using it, I’ll set it to start up when I log in. If I don’t use it frequently, there’s no conceivable point to having it on the desktop.

And why on Earth does Windows make it so blasted difficult to remove “My Computer”, “Recycle Bin”, etc. from the desktop? I don’t know of any way to do it short of registry hacking or using TweakUI. Gah.

</rant>

A cautionary note: using self-closing <script> tags generally will cause your browser to ignore the tag altogether. E.g., this doesn’t work:

<script type="text/javascript" src="foo.js" />

It took me a bit to figure out what was going on here, because it’s perfectly valid XML. However, since most web servers are going to mark webpages as HTML rather than XHTML+XML, it gets parsed as HTML, which doesn’t allow you to self-close tags that don’t have the EMPTY content model (like <br> or <hr>).

After many years of using Mac OS and Linux nearly exclusively, I’m in a job where I’m using a Windows PC and having to write programs targeted at Windows users in Microsoft-created languages. It’s been a long time since I’ve had to deal with the Evil Empire more than cursorily. Some observations, good and bad:

Good

• ASP.NET is a surprisingly well-thought-out development platform. It’s very good at keeping code and presentation separate, allows for modular design at a number of different levels, and allows you to do a lot of things declaratively instead of programmatically. It’s pretty fab for creating CRUD web applications.
• C# is a pretty nice language. It’s not Python, but it does have a lot of nice features, including “delegates”, which almost let you believe that functions are first-class.
• Visual Studio is really an amazing product. Intellisense is brilliant; a lot of times, you can type a couple of words, and then basically autocomplete your code. I hate to say it, but it might be on par with Emacs as a powerful IDE.

Basically, most of their tools for development are extremely well-done. The big problems crop up when they try to use those tools to create anything else:

Bad

Windows.

Oh, God, how I hadn’t missed this. Having to run anti-malware software because the OS is too dumb to prevent itself from getting infected in the first place. No way to conveniently enter characters that aren’t on the keyboard (I can has em-dash?) Third-party apps to do anything useful (you didn’t really want to play DVDs, did you?). Applications that require the use of the context menu to do important tasks. Stupid “Are You Sure?” confirmation dialogs. Rebooting because you changed the color of the desktop.

The thing that really, really agitates me, though, is the lack of control of the computer that Windows provides. Windows frequently decides that what it’s doing is more important than what you’re doing. You’ve got the start menu open, and an application starts up? The start menu’s gone; now you’re working with the application. Fire up an application, and then switch to another one while it’s loading? The new app will steal focus back when it creates its first window. Windows thinks you need to clean up your desktop/install anti-virus software/brush your teeth? Look, a little popup in the taskbar, getting me away from what I’m working on. And the modal dialog boxes!! Sure, you see them occasionally in any environment, but man, I run into a lot of them here. The bottom line in any computing environment is that I am supposed to be in control. At all times. The machine exists to serve me, not the other way around.

Internet Explorer 6

The bane of developers and users everywhere. Insecure. Buggy as crap. No debugging features that compare to other browsers. Unaware of standards that had existed for YEARS before it was released that every other browser has somehow managed to competently support . When you write a web app, you basically have to write your app twice; once for web browsers, and again for IE 6. It warmed my heart to see that IE 6 is not supported by the “new Facebook”, which will soon be the only way to use Facebook. Hopefully if another big player or two gives IE 6 the treatment it so richly deserves, it’ll be relegated to the junk heap before Microsoft officially puts a bullet in its head in July of 2010.

Outlook

Big. Evil. Doesn’t work well with anything other than Exchange. Clumsy, clumsy user interface. I was aghast to find that you can’t do ad-hoc searches of your mail. You want to find that message about TPS reports from a few days ago? Create a new search folder, make a new filter to tell it that you’re searching the whole message, type in “TPS”, save the folder, click on it, and wait. Then delete it when you’re done. On a Mac? Command-option-F TPS. Or Command-Space TPS and look through your entire system. People need to be able to search their mail quickly and conveniently. (Oh, and I hear that the HTML rendering engine in the new version of Outlook is the same one that Office uses, taking the dubious task of writing HTML email that will display reasonably on many clients from the realm of “difficult” to “impossible”.)

I recently ran into a situation where I wanted to be able to select a row in a GridView control when a page is loaded.

The obvious solution is just to (as suggested on many forums) add the “Selected” property to the row you’re interested in, but that’s fairly suboptimal. It doesn’t trigger the OnSelectedIndexChanged or OnSelectedIndexChanging events, and I don’t think it updates other properties like the SelectedIndex on the GridView. What I really wanted to do was trigger an event that would be identical to what would happen if you selected the row using the web interface.

Googling only revealed one place that claimed to have an answer, and of course, it’s the ever-annoying ExpertSexChange. I finally figured out a way to do it on my own, so I figured I’d share. (And, perhaps, deny the aforementioned site a bit of revenue. >:-) )

The trick is to use the containing Page object’s RaisePostBackEvent() method. It sounds obvious in retrospect, but I was looking for a method on the GridView object rather than the page. (There is a RaisePostBackEvent() method on the GridView object as well…but it’s protected.) Instead, you send the event to the Page object, which the control has registered itself with, and the page informs the control. Specifically, to select a row, make the event argument “Select$rowIndex”. Shazam!

I started using R in my financial data analysis course last year, and wrote up a set of notes detailing some of basic things you need to know to use it and differences from other languages like C++, Java, Python, etc. I finally got around to putting them online.

It’s the end of an era, it seems. Richard M. Stallman has handed off primary responsibility for development of GNU Emacs.

After reading the Wikipedia article on derangements and seeing how one goes about finding the number of derangements of a given size, I figured out how to generate a random size-n derangement without generating all size-n derangements and picking one. This made my Secret Santa program rather more efficient (O(n) is just a little better than exponential time!)

Also, in writing this program, I found a point in Python where two of its paradigms don’t mix well. Like most languages with first-order functions, python has map() and reduce() functions. However, method calls are handled more like C++ or Java: you call them as object.methodname(). If you want to get a list of results of a method applied to each element of a list, there doesn’t appear to be a straightforward way to do it. In this case, I wanted to strip whitespace from a list of strings. I ended up using a lambda that takes a string s and returns s.strip(), which isn’t too clumsy.

Edit: One of my friends noted that this could be handled nicely with a list comprehension. D’oh! Fixed, though the original line has been left in, commented.

For those who are interested:

#!/usr/bin/python
#
#     derange-strings.py
#
#     Takes a list of strings on standard input (one per line)
#     and prints it out alongside a random derangement of the list.
#     Can be used for secret-Santa-type gift-giving arrangements.
#
#     Copyright (C) 2007  Neal Groothuis
#
#     This program is free software: you can redistribute it and/or modify
#     it under the terms of the GNU General Public License as published by
#     the Free Software Foundation, either version 3 of the License, or
#     (at your option) any later version.
#
#     This program is distributed in the hope that it will be useful,
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#     GNU General Public License for more details.
#
#     You should have received a copy of the GNU General Public License
#     along with this program.  If not, see <http ://www.gnu.org/licenses/>.

import sys
import random

def swapElements(i, j, l):
    l[i], l[j] = l[j], l[i]
    return l

def randomDerangement(n):
    if n==2:
        return [1, 0]
    else:
        k=int(random.random()*(n-1))
        return swapElements(k, n-1, randomDerangement(n-1)+[n-1])

#names=map(lambda(s): s.strip(), sys.stdin.readlines())
names=[s.strip() for s in sys.stdin.readlines()]
n=len(names)
assignments=randomDerangement(n)
for i in range(n):
    sys.stdout.write(names[i]+"\\t"+names[assignments[i]]+"\\n")