Sunday, 19 May 2013

Google Finally Reverses Reverse Android Update Process

There is an article on Ars Technica today about how Google cleverly managed to update some of their Android apps without having to go though the rigamarole of releasing a new version of Android. Everyone seems to think that was a pretty good idea, but all I can think of is "Why? How did Google end up in such a silly state that they had to do this?"

Historically, the Google apps that exist in Android like Gmail, Gtalk, Google+, etc are tightly tied to the Android OS version. Therefore, upgrades to these applications generally did not happen outside of a full-blown Android OS update. In the beginning, this probably did not present much of a problem because there were few carriers and few handsets. Now that Android has deposed the iPhone as the most widely used smartphone on the planet, there are lots of carriers, lots of handset, and lots of problems keeping everything updated.

The basic problem is the cell phone carriers. In a typical computer world, the vendor just updates your software when they want. Consider the never-ending Windows updates or the magically appearing iOS updates. There is no middle man, updates just happen. In the Android world, the carriers are the middle man and they do not allow OS level updates without testing and certifying the version to be sure it will work on their network and not cause their users problems. This takes a lot of time (meaning money) and the carrier isn't going to ever get that money back from their customers or Google, so there is very little incentive for them to go through this certification process and push the update out. They tend to just let handsets rot at the level they were purchased at and it is very common to wait literally years for an Android update to be allowed through your carrier.

This table shows that the vast majority of Android handsets are sitting at version 2.3.3 which was released in early 2011. The current version is 4.1.2 and as far as I know, no carrier has pushed that out yet.

So Google effectively has their hands tied by the carriers. Google can put as much love and care into their apps as they want, but the general Android community may not see them for years. This is the problem that Google is seeking to solve by decoupling their apps from the Android OS updates. By treating their apps as apps instead of OS components, things like Google+, GTalk, Gmail, Navigation, etc, can be updated quickly and automatically from the Google Play store just like any other application on the phone. This means that updates to applications can actually hit the end-users' handsets overnight because the carriers do not care or certify application level updates. They just let them happen.

That's all well and good and the problem is now solved. But let's get back to my original question: how did Google end up in this mess? The technical explanation is easy - I've explained that above. The business and modelling decision is much more difficult to explain. For years (decades, maybe?) both sysadmins and developers have been madly abstracting processes of all kinds to make them less dependent on each other. Sysadmins have been adding load balancers in front of servers to abstract things like SSL termination and traffic maintenance. Developers have been using things like the Model/View/Controller (MVC) framework to develop their apps to keep their data abstracted from the GUI. Abstraction and separation are proven concepts used throughout the technical world and have been adopted everywhere possible because it prevents the dependencies that caused this precise problem. It's amazing to me that such a technically savvy company would decide from day one to bundle their apps into the OS given that this turns its back on years of proven processes.

To be fair, I doubt that Google anticipated how lazy the carriers would be about their OS updates. At the very least, it's reasonable to assume that a carrier would want to get security updates onto their customers' handsets so that they don't have malware running on their network, but that's evidently not the case. Given the statistics, it seems that almost no carriers have bothered to allow an update in over two years which probably caught Google by surprise. And, since Google has no leverage on the carriers, the annoyance became a big problem.

So what's the lesson kids? Separation, separation, separation! It doesn't matter if you're coding or hacking, break as many dependencies as you can so that your app/network is as flexible as possible. That's the only way to protect against unforseen actions by third parties.

Friday, 29 March 2013

How To Convert A Drupal Site To a Flat PHP Site

I am not a web designer per se, I'm a sysadmin but I necessarily end up in the web design/development world a lot. Everything I do is hard; the easy stuff I leave to the first year college design students.

One of the things I had to do recently was wrestle a copy of a website from a web host that was hell bent on not giving me anything that I needed. They were running a totally unnecessary Drupal multi-site and would not give me any meaningful access to the filespace or the database. So...what do you do when that happens? Simple, throw Drupal out and rip the site into a flat PHP site.

This technique will work for almost any website on the planet but it works best on  websites with the following criteria:

  • The website is fairly static. It's not an ecommerce site with daily product updates or a statistics site of some kind. You're going to rip a copy of the site as it is today, not the way it will change in the future.
  • There should be no need for the CMS aspect of the site. If you have users who are used to logging into their CMS and doing updates, this will not work for you. You are going to end up with a pile of static web files that can only be edited by someone who knows what they're doing.
  • You have a Linux box to do this on. Text file manipulation is something Linux rocks at and Windows sucks entirely at. But, if you're even thinking of attempting this, you've gotta have some chops so I assume you can lay your hands on a Linux shell somewhere.
There are three basic steps to this process. Rip the site, convert all the files into PHP files, and then internally rename all the links in the site to point to the new PHP files.

Step One: use the HTTrack Website Copier

HTTrack is the bomb. You point it at a website and it rips the whole thing down onto your hard drive. It clicks every link it finds to ensure that it gets every page. It saves them in flat HTML format.

Step Two: rename all your html files to php files

Using two awesomley useful Linux commands, you can find and mv all your .html files to .php files like so:

find . -name "*.html" | while read file;do
mv "$file" "${file%.html}.php";  
done

Great. Now you have all your files named foo.php instead of foo.html. This is great except that every single file has links to foo.html in it so you have to chase that down. Enter sed - quite possibly one of the most useful tools in the world. There, I sed it.

Step Three: use sed to fix your internal links

find . -name "*.php" | while read file; do
sed -i 's/\.html/\.php/g' $file ;
done

And you're done. Go get a gin and tell everyone how cool you are.



Thursday, 28 February 2013

From Bartering to Bitcoins. How Did We Get Here?

I doubt there's a single person alive in North America who is unaware of the financial mess the United States is in. Jumping from Fiscal Cliff to Sequestering, it's quite obvious to all of us that the "money" in question does not exist. Greece is in a no better state half-way across the world so it's pretty easy to make the argument that money is broken. When your country has over-leveraged its financial resources so terribly that you know, deep down inside, that your money and property can become worthless overnight with the flick of a pen in government house, what do you do?

Get new money, of course.

All Money Is "New"

Humans were trading stuff long before there was any concept of money. If I had an extra side of beef and I needed a bag of flour, I would take my side of beef and go wandering around looking for someone with a bag of flour they didn't want. The basic barter system is how modern commerce started and it still exists in a much smaller form today. Money, however, requires a third party - an issuer. Money issuers are always governments in some form or another; kings, regents, democratics and dictatorships are the central issuers of money. Commerce as we know it today stemmed from the relatively recent concept of this third party issued money.

Money Has Always Been Worthless

Bartering involved the trading of intrinsically valuable goods. My side of beef has value because a side of beef has value. Your bag of flour has value because a bag of flour is worth something. Money, on the other hand, has no intrinsic value. That $10 bill in your pocket is simply a worthless piece of paper with no actual value. It is worthless in itself.

Money's value is in what it represents, not in what it is. Money was created specifically to be a worthless third party that can be traded in for something of value. You can either trade it in for actual thing of value it represents (originally gold in the issuer's coffers) or you can trade it for something else of value with someone else who wants the money (like buying something in a store).

The reason money works is because we all agree on its value therefore we all want it. That's the foundation of an economy - trust in the value of the issuer's money. If we have that trust then we use money as a temporary repository of worth until we find something we want to trade it for.

Bartering Does Not Scale

The main problem with bartering is what is known as the "coincidence of wants". If all I have to trade is a side of beef and what I really need is a bag of flour, I may have to travel far and wide before I find the coincidence of someone with a bag of flour who also wants a side of beef.

The likelihood of the incidence of the coincidence (see what I did , there?) can be increased by things like marketplaces. If I take my side of beef down to a market where other people have things they are trying to trade, I have a better chance of finding my flour wielding trading partner among a bunch of people looking to trade than I do just wandering around aimlessly.

The reason bartering does not scale well is because it would require literally thousands of people with everything under the sun in order for a society to function completely on bartering. If there is no intermediate thing we can use to temporarily hold our value, then we're left with a one-on-one trading scenario which has long odds.

Bitcoin: The New Money

Bitcoin is an alternative currency used primarily by geeky Internet folk.

Bitcoins are generated and distributed by the general public. Bitcoins are not generated by a central issuer such as a government's mint and are therefore argued to be more stable because they are not at the whim of government shenanigans.

Bitcoin is a cyber currency; it does not exist in physical form and is therefore used solely for purchasing goods and services online. People can buy Bitcoins at any number of Bitcoin exchanges such at Mt Gox by using government issued money (currently a Bitcoin is worth about $23 USD) and then use those Bitcoins to purchase things from vendors who accept Bitcoin as a currency.

That, however, is silly. Everyone accepts real money, so why would you trade your widely accepted government issued money for Bitcoins which are accepted relatively nowhere? The smarter thing to do is generate Bitcoins for free.

Mining Bitcoins

There is only one way to put a new Bitcoin into circulation and that is by mining it. Remember there is no central issuer so someone can't just mint a new Bitcoin and put it into circulation. It has to be mined from the depths of cyberspace by computers working to further the Bitcoin economy.

When someone purchases something with Bitcoins, the transaction is recorded as a cryptographic hash in a log that is shared among everyone who is running the Bitcoin software. To prevent people from entering fraudulent transactions into this log, each transaction is verified by arbitrary Bitcoin nodes along the way. If you elect to mine Bitcoins, you will have to install a Bitcoin miner on your system it will get the latest copy of this log. It will then attempt to reverse the hashes that represents those transactions and if it succeeds, you will then be rewarded with Bitcoins. The more nodes that successfully reverse these hashes, the more confident the Bitcoin economy is that the transaction is valid and it becomes irreversible.

Bitcoin Is Bartering

In the 1990's there was a rash of Barter Networks. These were groups of companies and people that got together and agreed to accept some barter network currency for part or all of their sales. For example, if I was a web designer, I might be willing to accept 50% of my wage in "Barter Bucks" for work done for other members of the barter network and 50% in my country's currency. As I build more web sites for my fellow barter members, I would accrue more barter bucks which I can then use to purchase things from other members of the barter network. This is another example of an attempt to eliminate the need for a coincidence of wants by introducing some trusted third party thing of value to replace government money. However, since the barter bucks are only accepted by the relatively small number of members of the barter network, it mostly fails in any significant way.

It is my opinion that there is no difference between barter bucks and Bitcoins from a vendor's perspective. The vendor is agreeing to accept some portion of the transaction's value in some form other than government issued currency which can only be used within a closed economy of other vendors.

Bitcoin Income Is Taxable

If you agree with my assessment that Bitcoin = Bartering, then your country may tax that income. Canada's CRA and the United States IRS certainly do.

Bitcoin Is Only a Curiousity

Let's wrap this up. Bitcoins are only usable in a closed economy and they are taxable as income. You can only get Bitcoins by throwing stupid amounts of computing power at it to verify the work, or by exchanging actual money for Bitcoins. Further, since Bitcoins are computationally generated it is known that the maximum number of Bitcoins that will ever be put into circulation is 21 million and that won't be until the year 2040. So the question is: why would you exchange real money for something else of equally worthless intrinsic value that can only be exchanged for goods or services at about 150 places on the entire planet, has a very low amount of total money to begin with and has to tax advantages? You wouldn't.

I talked about Bitcoins on episode 5.2 of our podast The JaK! Attack and I reached the conclusion that they are merely a curiosity. While the method of generating Bitcoins is unique, the philosophies and ramifications of a limited circulation currency are old and have been tried and discarded over and over throughout history.

Until some currency comes along that I can spend at my local gas station, the pub, my utilities and my house mortgage, anything other than "real" money is going to fail.






Wednesday, 23 January 2013

3 Things I Love Most About Android 4 On My HTC One X

My contact recently expired with my carrier so I was eligible for a new phone, free, by simply signing my life away for another 3 years. Time and money are interchangeable in almost all cases, and since I don't have the latter, I frequently substitute the former.

I have been using a Blackberry Style 9670 for the past year. I have long maintained that Blackberries are a serious device. They're rugged, the battery life is legendary (except in the case of this 9670 for some reason) and they gently sip at your data plan instead of guzzling gigabytes like most other smartphones. However, Blackberries are simply not fun and now that I commute daily, I want movies and books and awesomely usable social media apps, etc. So it was time to go back to my first love - the droid.


I've been away from Android for over a year and there are some seriously neat things in Android 4 (code named "Ice Cream Sandwich" - stupidest name since "Windows Vista") and I've tried to pick my top three for this post. I am pretty sure there will be more posts because I discover more new and interesting things every day.

Task Killer

The older version of Android required a boring old task killer app that listed the running apps with X buttons beside them. Effective, but boring. In Android 4, you can simply bring up the recent applications list and then swipe any app you want to kill right off the screen. Awesome.

Sharing With Everything!

When  I click that little Share button while viewing a picture in my gallery, holy moly - a long, long, long list of options shows up. So long, in fact, that I had to take two screenshots to fit them all in. Check this out.



Data/Talk/Text Usage Monitoring

Not just a page showing you how much you've used, but a serious meter with limits and warnings and kittens and everything. I have my data limit set to 3GB which is the top of my plan and the phone will actually stop allowing cellular data usage if I hit this limit. I have a warning set at 2.8GB so I get a little heads up that I am getting close.

My plan includes unlimited local calling and messaging so I don't really care about the talk and text monitoring, but you might.


Off I go to find other neat things...

Tuesday, 22 January 2013

Troubleshooting MySQL LAMP Stack Outages

Database outages can be the most frustrating thing to troubleshoot. Honestly, this is mostly because the standard LAMP stack is generally employed by users who don't really know a lot about what they're doing other than they just know they "need a web server". In really heavy sites, things like Apache and MySQL are usually replaced in the stack with more efficient services.

However, since such a large amount of servers on the Interwebs run a LAMP stack, you're going to run into MySQL outages from time to time. Without having proper monitoring in place that can tell you what happened when the last outage occurred, it's very difficult to determine after the fact what happened. Did the host run our of RAM? Did the CPU run queue get overloaded? Or was the host fine and this is just something that only affected MySQL? All good questions.

Determining RAM and CPU issues is usually pretty easy. Implementing a very rudimentary monitoring application like Munin can tell you pretty quickly what the state of the host was when it went down. But MySQL is harder.

First, you need to be sure if you are looking at a MySQL outage or a host outage. The easiest way to do that is to put a static HTML file in the web root somewhere, and set a monitor on it from some place like Pingdom or UpTimeRobot. If the monitors indicate all is well while the host otherwise appears to be cratering, you're probably looking at a MySQL outage.

Far and away, the most common reason for a site outage that cannot be traced back to RAM or CPU overloads, is the mysql user hitting its ulimit which is the maximum amount of processes a user is allowed to run at any given time. If the mysql user hits its ulimit MySQL just ceases to work until such time that it drops below the ulimit again.

So how do you find out what the ulimit is for the mysql user? Like so:
  • Become the mysql user
ulimit -a | grep open
You should get something like this back:
open files (-n) 2048
Let's raise that to something more awesome:
  • Become root
echo -e "mysql soft nofile 10000\nmysql hard nofile 20000" >> /etc/security/limits.conf 
Now fix up /etc/my.cnf by changing the open_files_limit to:
open_files_limit=20000
Restart MySQL:
/etc/init.d/mysql restart
Have a nice life.

Friday, 11 January 2013

3 Awesome One-Liners With AWK

If you don't already know what AWK is, you're going to find this blog post really, really boring. Eyes glazed over, drooling a little bit, head bobbingly boring. 

This is you if you are a banana and don't know what AWK is while reading this post.
This is you if you are POTUS and you know what AWK is while reading this post


Are we clear? If you're the banana, you should leave now. This post is not for bananas.

Comparisons

While I knew that AWK could parse text files with amazing ease, I did not know until recently that it could do comparisons on the fly. I recently wanted to pull out the number of occurrences of various http response codes from a log file.

Given a log file format like this:
198.103.249.251 - - [11/Jan/2013:14:50:34 -0400] "GET /images/gallery/pause.gif HTTP/1.1" 304 - "http://www.phoenixhollow.com/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Tablet PC 2.0; .NET CLR 1.1.4322; .NET4.0C)"
Let's see how many 200s there are and print the IP addresses of those requests:
awk '{ if ( $8 == 200 ) { print $1} }' access.log
Now let your little sysadmin mind go wild with all of the possibilities of this. Pipe the output into sort and you can start to get some really interesting data very quickly.

Looping

Want to kill every damn process on the system? AWK up the PIDs and kill em:
for pid in `ps -ef | grep http | awk '{print $2}'`;do kill $pid; done
 OK, so this is more shell-ey than AWK-ey, but it would be pretty damned hard to do without the amazing AWK.

Change Field Delimiters

So far my two examples are great for text files that have their fields delimited by spaces. That's not the whole world though, my friend. There are lots of delimeters out there and sometimes even when you're working with a space delimited file, the data you want might not be perfectly delimited by spaces.

Back to this log. Let's suppose I want to get the Internet Explorer version (MSIE 8.0 in this case).
198.103.249.251 - - [11/Jan/2013:14:50:34 -0400] "GET /images/gallery/pause.gif HTTP/1.1" 304 - "http://www.phoenixhollow.com/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Tablet PC 2.0; .NET CLR 1.1.4322; .NET4.0C)"
Change the delimeter to the semi-colon with this invocation.
 awk -F\; '{print $2}' access.log
Like anything in *nix, the real power is in stringing these simple tools like AWK together. These three little tricks comprise about 85% of my AWK usage and make my life a whole lot simpler.

Did anyone turn into a banana?



Monday, 31 December 2012

3 Eco-Friendly, Geeky Ways To Live Better in 2013.

I'm all for saving the environment, buying local and reading what I am eating but I'm also as lazy as the next person so sometimes all that stuff is just too much work. I'm a geek. I like my gadgets and books and, let's face it, neither gadgets nor books have a great track record for sustainability. We've only had gadgets for 20 years and we're already running out of the rare earth metals needed to produce them. And cutting down trees to make books? That's become pretty unpopular. So what's a lazy geek supposed to do? Here's some ideas:

1. Buy Your  Books From Better World Books


Better World Books is an online bookstore that sells used books of all sorts. So why is this a big deal? From a practical perspective, it saves trees. Nobody is cutting down another tree to make that book for you. From a philanthropic "I feel awesome" standpoint, Better World Books has donated almost 7 million books to people in need. When you buy a book, they donate a book. They've also raised over $13 MILLION for libraries and literacy programs and recycled or reused almost 97 million books. Click the image below to visit their website and learn more about the amazing work they do. And then feel good.



Buy Books. Do Good. Support Literacy Worldwide


2. Generate Your Own Power With K-TOR® Human Powered Generators

K-TOR® designs and manufactures human powered portable energy generators that serve as portable outlets to provide electrical power on the go. There are hand cranks, there are pedal cranks - never be with a dead cell phone again. Just crank up your K-TOR generator and plug it in.

Human powered generators can be used in the event of natural disasters, search and rescue missions, blackouts, or any other emergency situation to charge essential electronic devices. Back packers, boaters, hikers, and outdoor enthusiasts will also find K-TOR® products useful.

Oh, and don't forget the huge neat-o factor! Click and visit:



3. Discover Your Green City With Ethical Deal

In a nutshell, ethicalDeal.com helps people make better choices. Their daily deals feature up to 70% off organic food, green cleaning products, healthy supplements, natural skincare, eco baby products and more. Think Groupon but for green products, green services and things like gluten free and vegan diets.

They're one of the first and most successful daily deal sites in the green vertical. Click the image below to sign up for your daily deals!


That should get you started on the straight and narrow in 2013. Enjoy!

Saturday, 29 December 2012

2 Simple Backup Programs For Non-Technical Folks

Online backup for your small business To be fair, these backup programs are equally as good for technical folk, but I have found them all so simple and intuitive to use that anyone can use them.

Backups are only as good as where you store them and there's a risk level associated with each location:


Backing Up Files To The Same Computer


If your backups consist of a copy of your important files in some other directory on the same computer, you may as well give up now. When your hard drive goes (and it will, never doubt that) all the copies of your files will go with it. Give up this practice now or at least recognize that it's worthless and you should be kept awake at night knowing you have virtually no protection.


Backing Up Files To A CD Or USB Stick


This scenario is a little more sane than backing up files to the same computer, but it still only provides a modicum of protection. If you believe that the worst thing that could happen to your computer is that it fails to work one day, then this backup plan will give you some peace of mind. When you get your computer fixed or buy a new computer, you can simply copy your files back onto it. However, you're being a little simplistic in your worst-case scenario.


Storing your backups in the same location (ie, your home) as the primary files does not protect you against bad things that occur in that location. A fire or other natural disaster completely destroying your house, a burglar stealing everything s/he can get his/her hands on in a robbery, or unattended children and guests accidentally wrecking your backups.


Backing Up Your Files Onto The Cloud


Aha..this, this is how your backups should be handled! Backing up the cloud means that your files are stored offsite, on the Internet, in a secure location. If anything, anything at all including the complete and utter destruction of your home should occur, you can quickly and easily get at your backed up files from any other computer on the planet including your smartphone. When you get a new computer up and running, you can simply download your backed up files to it and you're good to go again. Nothing beats this level of protection for your backups and it can be yours for about $60 a year.


Setting up offsite backups used to be something that only businesses could afford and only technical people could figure out. However, this is no longer the case. There are a number of cloud backup companies that provide simple software that you just install and walk away from. The software will automatically backup your important files the first time, and then continue to monitor those files for changes and back up new copies of them whenever you make changes. If you ever need to restore one or all of your files, there's a simple screen where you click the files you want to restore and presto, blammo they're back on your computer where they came from. It really is that easy.

Over the years I have used two different offsite backup companies. Each of them provides the simple to use software I described above and they are competitively priced:

Carbonite Online Backup Service

Carbonite Online Backup. Unlimited backup--secure and encrypted, for just $59.00 per year. Start your free trial today!

Mozy Online Backup

Computer online backup should be automatic. Get 2GB's of free backup or plans starting at $5.99

Over the years I have always had one of these programs running and it has saved my bacon more than once. Sometimes I accidentally delete a file, sometimes something bad happens to a file and once I lost my entire hard drive. In all three scenarios, I was very glad to have these offsite backups to recover from. For most of us, it's nice enough to know that our important spreadsheets and copies of letters are backed up. For small business people, consider how much offsite backups limit your liability if you should happen to lose something very important to a client. Not only is it harder to lose in the first place, but you may be able to defend against negligence claims by showing you have a backup system in place.

All in all, it's the best $60 you'll ever spend. Each provider offers a free trial or a free plan, so give it a whirl today and see how much better you sleep.

Wednesday, 26 December 2012

How Do I "Unlock" A Cell Phone To Use It With My Provider?

I originally wrote this post in 2011 and was going to re-post it as-is. After reading it I realized it was woefully out of date so this is a quick re-write which is hopefully more accurate at the end of 2012.

Please note that this article deals with the concept of unlocking as it pertains to using a handset on any provider's network. It does not pertain to jailbreaking the iPhone.

In order to understand what the term unlocking means, we first have to understand what handset locking is. Largely, the need lock handsets is born from the way the cellular market works. I am going to describe Canada since that is the only market I have any experience in, but its largely the same world-wide. 

Cellular phone providers make no money off the handsets they sell so they lock Canadians into long-term contracts with minimum monthly packages in order to make their money. Canadians are used to getting free or inexpensive phones and if it were not so consumers would be looking at $800 for the new iPhone 5 instead of $49 + 3-year contact deal. Since few consumers would be able to afford high-end smart phones if they had to pay for them outright, the providers have deeply, deeply discounted the handsets in exchange for a commitment of years of service. 

If providers did not bind their customers into contracts, it would be possible for a consumer to walk into a provider, buy an iPhone for $49 and then switch providers thus denying the original provider who ate the $751 discount the ability to recoup that money. There's a reason we have cell phone contracts in Canada and while they're not popular, most of us would not have a cell phone at all if these contracts didn't exist.

Back to locking. In addition to the contracts, providers also attempt to use technology to ensure you cannot use their handset with another provider. There are two broad category of phones in the world: those with SIM cards and those without SIM cards. If your phone does not have a SIM card then the provider's network is aware of what exact handset you are using. If your phone does have a SIM card, then the provider's network is not aware of what exact handset you are using. So what does that mean?

Scenario 1: Your phone does not have a SIM card.

In this case, you will only be able to use handsets that originated with your provider in the first place. This means you are limited to buying handsets from your provider, or finding used handset from your provider on places like eBay. To make it simpler: if you are a Telus customer and have a phone with no SIM card, then you can only use other Telus handsets. 

There is no concept of "unlocking" a phone without a SIM card. 

Scenario 2: Your phone has a SIM card but is locked

Now you have a little more flexibility. Since the provider can't actually see past your SIM card, they can't exactly tell what handset you're using; just that you are using an authorized SIM card. In order to prevent you from wandering to another provider before your contract is up, providers lock these SIM-card phones to ensure that the handset will only accept their SIM card. If you have a Telus SIM-card phone and try to put a Bell SIM card in it, for example, it would not work.

Scenario 3: Your phone has a SIM card but is unlocked

This is the best case scenario. Unlocking means that your handset will accept a SIM card from any provider; the mechanism whereby the original provider attempted to lock the phone to their network has been disabled. Cell phones are not locked when they are manufactured because the manufacturer doesn't know which provider will end up buying each handset. Locking is introduced later by the provider and because it is an after thought, it can be easily defeated.

Unlocking generally involves some arcane key presses and a code or two, all of which can be easily obtained from the Global Unlock website for under $20 (depending on the brand of cell phone). Plunk in your  handset model, manufacturer and carrier and you're good to go. To make you feel nice and warm, they offer a 100% money-back guarantee if you have any problems.

Understand that unlocking your cell phone and switching providers does not relieve you from your contractual obligations to your original provider. They will still pursue you for the minimum monthly payment that you agreed to in your contract. Therefore, unlocking is of most use when you want to purchase a handset from somewhere other than your provider and then use it under your original service contract. 

That's all nice, but how do I actually unlock my phone?

This is the best part. Select your model, manufacturer and click the Start Unlocking Now button. If you can find your phone in this list, then your phone can be unlocked.
There are a ton of unlock services on the Internet but you have to be very careful whom you choose. Entering an incorrect unlock code can permanently lock your phone to the current carrier or,  even worse, brick your phone entirely (can you guess that "bricking" means it turns your phone into a useless brick?). You must have confidence in the unlock code itself as well as the instructions you are following to enter it. I only trust Global Unlock. I'm not saying that other unlock code providers don't work or will definitely cause you problems, I'm just saying that I have never had a problem with Global Unlock so they're the only company I recommend.

Sunday, 23 December 2012

How Does Anonymous Take Down Websites?

Anonymous is a "hacktivism" group meaning that they are political activists, but rather than protesting in the normal sit-in type of protests they use technological means to wreak havoc on those they target. Hacker + activists = "Hacktivists". See what they did there?

The group is large, loosely organized and driven mostly by consensus.  A few senior leaders actually make decisions on who to target and the rest of the members come and go doing their parts to support the larger operations. Individual members may or may not take part in each operation depending on their level of commitment to the particular cause. Anonymous members typically describe the group as a "hive" which reflects the undulating participant levels at any given time.


Anonymous can generally garner enough members for each operation that they can take on very large targets. For example, during the time when Wikileaks was posting large numbers of classified U.S. diplomatic cables, all of the credit card companies pulled their support for Wikileaks in an attempt to cut off their money stream of donations from supporters (see Cablegate). Anonymous systematically took down most of those company's websites and they have also been successful in taking down websites belonging to governments of countries such as Syria during its (current as of the time of this writing) civil war (see article). Credit card companies and governments are not small targets; they are generally built to withstand these types of attacks so Anonymous has a lot of street cred for being able to take down these big guys.

So how does a group like Anonymous go about rendering a website non-functional? It's simple, the technique has been around for decades and its entirely possible that your computer has participated in an Anonymous attack.

Web servers are computers just like any other and as such they have a limit to how much they can do. Under normal operations, web servers do just fine happily serving up web pages to visitors. There are times, however, when the traffic to a website becomes more than the server can handle. When that happens, the server craters and the website goes down. At some point, hopefully, the traffic subsides and the server can recover and once again do its job.

Hackers can cause this situation to occur at their whim by use of what is called a Denial Of Service (DOS) attack. Hackers generate more traffic against the webserver than it can handle so it goes down which creates a "denial of service" meaning that the web service is denied to everyone.

At the dawn of the Internet hackers had a limited ability to do this because they generally only had access to the handful of computers that were under their immediate control. These limited attacks were pretty easy for the website owners to mitigate by simply blocking the small pool of the hacker's IP addresses to solve the problem. These days the base technique is still used but hackers have thousands, or tens of thousands of computers at their hands to launch these denial of service attacks. These new and improved attacks are called "Distributed" Denial of Service attacks, or DDOS, because the computers under the hacker's control are "distributed" meaning large in number and geographically dispersed across the planet. That extra D is a total bitch.

A DDOS attack is almost impossible for a server administrator to mitigate. Only web sites with serious enterprise-level architecture and hardware have any chance in doing so. This means that the vast majority of the websites on the Internet would have no chance against a large scale DDOS attack such as Anonymous is able to execute.

So how does a hacker get his hands on thousands of computers to do his bidding? Easy. He steals your computer to do it. You know all this stuff we hear about spam emails and phishing emails? Emails with links in them that you've been told never to click? A lot of people click those links anyhow and when they do, a piece of malware is installed on their computer. That nasty piece of business immediately calls home to the hacker and gives control of your computer over to him. There is no obvious indication on the user's computer that someone else is controlling it so an infected computer can remain so for a long time and end up participating in multiple DDOS attacks on Anonymous' behalf.

There are a variety of ways in which these pieces of software call home but probably the most common is through the use of the seminal Internal chat system named Inter Relay Chat (IRC). The hacker sends out batches of thousands of those emails, a couple of hundred unsuspecting users click the link per batch and and presto, in a few days or weeks hackery-boy has a couple of hundred computers under his control. Multiply that by every Anonymous member involved and it's easy to see how a botnet of tens of thousands of computers can be constructed in a short period of time. Now, all Anonymous needs to do is issue commands into the pre-determined IRC channel and those minions come to life and get to work on their dark deeds.

A DDOS attack is orders of magnitude more difficult for a systems administrator to mitigate. Rather than just simply blocking a handful of IP addresses he now has to blocks thousands of them. It would seem like the right thing to do is to block all incoming traffic, but if the systems administrator wants to attempt to keep his service available to legitimate users, he has to try to determine what traffic comes from legitimate users and what traffic is participating in the DDOS attack. In the maelstrom of incoming traffic it's nearly impossible to determine what traffic is valid and what is not. It's a loosing battle and while there are some architectures that can make this process a little easier, the very nature of the attack makes it virtually impossible to be very successful. At the end of the day only Anonymous will determine when the website they are targetting will return to full service. 

So what can you do about this? Renew your vows to not click suspicious links. Renew your vigilance surrounding odd emails from people you know with links in them. In general, just do all the things you've been told for years. Just do them better.