Author: mark

  • What physicists do for fun during a nuclear detonation

    During a test in the Nevada desert of a miniaturized nuke called Scorpion, theoretical physicist and weapons designer Ted Taylor used a parabolic mirror to light a cigarette. Ah the good old days.

    This is an extract from Under The Cloud by Richard Miller:

    Extract from Under The Cloud by Richard Miller
    Extract from Under The Cloud by Richard Miller

  • TimThumb users and WordPress Theme users using TimThumb, please upgrade

    News [April 24th, 2012]: I’ve launched Wordfence to permanently fix your WordPress site’s security issues. Click here to learn more.

    I’ve done a ton of work on TimThumb this weekend and there are a few great enhancements. E.g. if you have pngcrush or optipng installed, it will now use 66% less disk space and give you comparable quality images.

    Please grab the latest version of TimThumb on this page. Then let me know if you have any feature requests or find any bugs by reporting them here.

    Here’s the TimThumb changelog since I released 2.0 about 48 hours ago.

  • Poem: When I Heard the Learn'd Astronomer

    This is a wonderful poem by Walt Whitman where he explores how the formalization of science and nature robs it of it’s mystery and wonder. If you’re a programmer who has done any time at a University, you’ll recognize Whitman’s sentiment.

    It first appeared in the “By the Roadside” section of the standard 1892 edition of Leaves of Grass.

    When I heard the learn’d astronomer;
    When the proofs, the figures, were ranged in columns before me;
    When I was shown the charts and the diagrams, to add, divide, and
    measure them;
    When I, sitting, heard the astronomer, where he lectured with much
    applause in the lecture-room,
    How soon, unaccountable, I became tired and sick;
    Till rising and gliding out, I wander’d off by myself,
    In the mystical moist night-air, and from time to time,
    Look’d up in perfect silence at the stars.

  • Timthumb improvements

    I did a ton of work on timthumb today. Download the latest version to get a whole lot of security and performance improvements and bugfixes. It’s available now.

  • What does the S&P's AAA to AA+ downgrade for the United States mean?

    If you haven’t heard the news, S&P just downgraded us from AAA to AA+ and gave us a negative outlook to add insult to injury. But it’s not like we didn’t deserve it. In a democracy, people deserve the government they get. Remember that “We the people…” document? Well we the people just got a AA+.

    It’s the first time the US has been downgraded since we received a triple-A rating from Moody’s in 1917 and a AAA from S&P in 1941.

    Obama says “S&P’s analysis of the United States economy is deeply flawed.”. I think his chances of reelection just got deeply f***ed.

    Keep an eye on treasury bond yields on Monday morning. There’s a tension between interest rates going up since they’re now technically more risky and the reflex flight to risk causing treasury buying that drives their rates down. It’ll be interesting to see whether fear or common sense prevail.

    So what will happen going forward?

    • Interest rates in this country are bound to rise long term because, what the government pays on debt is the base of all other interest rates in the country.
    • Mortgage rates rising won’t help the housing market “recovery”. Less people will buy houses with the cost of borrowing becoming more expensive.
    • With asset prices falling a few more banks will fail. Their debt to asset ratio will not meet the minimum requirements and the FDIC will show up on Friday afternoon and seize them.
    • Expect to hear about the FDIC fund running short on cash and there to be a vocal debate about how to replenish it. Technically it’s an insurance policy that the banks fund and in normal times the government might just top it up. But what will probably happen as the fund gets depleted is that they will need to raise the rates they charge banks, which may make banking in this country more expensive for consumers and businesses.
    • The latest budget debate made it very clear there will be no more trillion dollar bailouts. The good news is that at least this kills moral hazard (when bankers and execs are irresponsible because they know they’ll get bailed out.
    • It gives us a reasonable facsimile of a free market. Even if you’re going to have to dodge the falling bodies on Wall St….
    • The dollar will fall as foreign investors move to countries like the UK, Germany, France and Canada who all still have their AAA rating intact.
    • Companies that rely on cheap foreign labor or resources will have to radically restructure their supply chains to survive and some might not be able to pull it off.
    So where are the opportunities? Well I’ve said it before and I’ll say it again: “Gold prices will hit $1800 in September/October and $2200 or more by year end.“
    • Companies that export US goods or services will earn more as the dollar falls.
    • Technology companies who are nimble, efficient and export services will do well.
    • New innovators will replace incumbents who can’t readjust.
    • We might get a new political party in the next half decade.
    And for a laugh.. the Federal Reserve just announced that risk weightings for US government securities (how risky the government thinks it is) will remain unchanged:
    For risk-based capital purposes, the risk weights for Treasury securities and other securities issued or guaranteed by the U.S. government, government agencies, and government-sponsored entities will not change. The treatment of Treasury securities and other securities issued or guaranteed by the U.S. government, government agencies, and government-sponsored entities under other federal banking agency regulations, including, for example, the Federal Reserve Board’s Regulation W, will also be unaffected.

    And finally, lets hope that 500 point drop in the DOW this week was a leak that has now been fully priced into the market, or we’re in for an even bigger drop on Monday.

  • WordThumb is now TimThumb 2.0

    News [April 24th, 2012]: I’ve launched Wordfence to permanently fix your WordPress site’s security issues. Click here to learn more.

    On the suggestion of Matt Mullenweg (wordpress founder) Ben Gillbanks (timthumb author) and I have been working for the last day to merge my work on WordThumb into TimThumb 2.0.

    That work is now complete and TimThumb 2.0 is now available for download from the TimThumb site.

    I’m going to be working with Ben going forward to continue to have TimThumb be the easiest to use, fastest, most popular and most secure thumbnail script on the Web.

    Here are a few enhancements in TimThumb 2.0:

    • Includes the ability to take website screenshots if you have Xvfb and CutyCapt installed. (Instructions included how to do this)
    • All filters and resizing can be applied to website screenshots.
    • The cache directory is now secure and is still public for flexibility across platforms.
    • TimThumb creates index files in your cache to prevent directory listings.
    • Filenames are more randomized using data that a hacker doesn’t have access to, making it very hard to guess filenames in cache and access them.
    • Cache files have a .txt extension which means the web server won’t execute them.
    • All cached files have a fixed length record at the beginning which, if a web server tries to execute them, will be interpreted as PHP code and will cause an immediate exit.
    • It includes file locking when files are created in cache to avoid conflicts.
    • The entire code base has been rewritten and refactored for better code scaleability.
    • Lots of other improvements.
    So give it a whirl and if you have any suggestions or find any bugs, please file them on the TimThumb issues page. Thanks.

  • WordThumb now uses a secure public cache for compatibility

    UPDATE: WordThumb has now been merged into TimThumb and has become TimThumb 2.0. Please head over to the TimThumb site now for updates and to get the code.

    The latest version of wordthumb (just uploaded) uses a public cache again (same place timthumb does) because many system temporary folders are not writeable.

    This public cache is part of what caused the timthumb vulnerability, so I’ve made it more secure as follows:

    • Using a .txt extension for all files so servers won’t execute the files when accessed.
    • Using an md5 salt to prevent hackers knowing what filenames are to make things a little harder. On a badly configured server they could still get a directory index and access files that way.
    • Added a <?php die(); ?> to the start of ever file cached. That way if a hacker manages to guess a filename and for some reason the server decides to execute a .txt file, as a last resort it will simply die.

     

  • WordThumb can now take screenshots of websites for you

    UPDATE: WordThumb has now been merged into TimThumb and has become TimThumb 2.0. Please head over to the TimThumb site now for updates and to get the code.

    Just for fun I added the ability to take screenshots of any website to WordThumb. You can even apply all the image manipulation and filters that it supports for regular images to a website screenshot.

    The latest update also lets you block “hotlinking” where other websites display an image loaded from your server. That is mainly to prevent other sites using your WordThumb to generate thumbnails of websites.

    Be warned, to use this you’re going to need root access to your own server. You’re also going to have to install a few basic tools, but I’ve included detailed installation instructions in the source where the configuration options are. I’ve also only tested this on Ubuntu Linux.

    If you don’t have root on your machine or don’t want the feature, WordThumb is still fully backwards compatible with timthumb.php and the webshots feature is off by default. But if you like to experiment give it a whirl and let me know what you think.

    The first screenshot takes a few seconds to load and then it’s cached for 24 hours (the default cache setting).

    I have it running on this server, so here are a few screenshots of my favorite sites created and updated using WordThumb. You can click on one of these images and play with the URL and image width/height in the location bar to load different sites. My server is at about 80% load right now, so it will probably run faster on a less busy machine.

  • A secure rewrite of timthumb.php as WordThumb

    Big News [April 24th, 2012]: I’ve launched Wordfence to permanently fix your WordPress site’s security issues. Read this now.

    Update 3 (Final): WordThumb has now been merged into TimThumb and has become TimThumb 2.0. Please head over to the TimThumb site now for updates and to get the code.

    Update 2: WordThumb can now take screenshots of websites for you and turn them into thumbnails.

    Update 1: Two minor bugs fixed and new minor version released. Thanks guys! You can post bugs directly on this page if you find any more.

    I’ve done a full top to bottom rewrite of timthumb and forked the project as WordThumb. You can find it on Google Code with basic instructions on how to use it. Please report any bugs to me at mmaunder at gmail as soon as you can. The code is tested on Ubuntu Linux under Apache and works great.

    The only code that is still original timthumb code is the image processing routines. Everything else has been rewritten from scratch. Here are the changes:

    • Code is now object oriented PHP and is much more manageable and readable. It will still run just about anywhere.
    • Fully backwards compatible with all timthumb’s options.
    • Uses a non-web accessible directory as cache for security. By default it uses the system temporary directory. There is a config option to override this.
    • All cached files have a .txt extension as an extra precaution.
    • Cache cleaning has been rewritten to be faster and only run once a day (user configurable) with no contention between processes.
    • ALLOW_EXTERNAL now works as expected. If disabled, you can’t load external files.
    • mime type checking is improved. Previously files would be written to a web accessible cache before the mime check step. Now the furthest a non-image will get is a temporary file which fails a mime check and is deleted.
    • Previously, the check_cache function created a directory with 777 permissions. That’s removed and we simply use the system temporary directory for everything cache related now.
    • Writing images uses file locking now to avoid two processes writing to the same image file and corrupting it.
    • We now use temporary files when fetching remote images rather than using the same filename we’re turning into a thumbnail. This avoids another process on a busy server thinking a file is a cached thumbnail and serving an unprocessed image accidentally.
    • Fixed browser headers like accept-ranges.
    • Improved error reporting.
    • Added debug mode with tons of debug messages.
    • Debug messages include benchmarking to see where slowdowns occur if any. (It’s very fast!)
    • Cleaned up conflicting curl options like CURLOPT_FILE
    • Added ability to disable browser caching for debugging
    • Added clarity on curl timeout (many sites use php’s default fetching which doesn’t have a timeout)

  • Which al-Assad Would you Like?

    President Bashar al-Assad of Syria has unleashed the rest of his tanks on Syrian protesters. Russia is warning that the country is veering towards all out civil war.

    Besides being politically two faced, al-Assad has an unusually asymmetric face. So I thought I’d break out both faces and rejoin them into these:


    Bashar al-Assad
    Bashar al-Assad Left
    Bashar al-Assad Right
    Bashar al-Assad Right