TSA Needs a Checkpoint Randomizer?

Saw a news article from yesterday discussing the TSA's interest in using an electronic randomizer to randomly assign passengers to checkpoint security lanes.

The idea that they need to get proposals on whole systems to do this. They're really overthinking the problem here. They don't want any sort of indication of positive negative, for example the colors red or green. I'm not sure why they want to assign a binary result, anyway. Do they think airports only have two security lanes?

All you need to do is assign each checkpoint a number, and write a really simple program to randomly choose a number and display it. Here's my web-based implementation. It shouldn't be terribly difficult to write an iOS version and send out iPod Touches to airports to run it.

Creating a Self-Signed SSL Certificate for Multiple Domains

This morning's adventure was trying to figure out how to generate a self-signed SSL certificate for multiple domains using OpenSSL. I found lots of discussions online, but they all didn't quite work. There were a few different ways to get a Certificate Signing Request with the SubjectAltName fields correct, but the signed certificate itself didn't have them. Finally, I got something that worked.

Credit where credit is due: The final steps that worked were based on this message from the openssl-users list and the command to generate the certificate from this page in the Linode Library.

First, save the following in a config file, for this example I'll call it example.conf and it will be for various similar domains:

[ ca ]
default_ca              = CA_default


[ CA_default ]
dir                     = .
serial                  = $dir/serial
database                = $dir/index.txt
new_certs_dir           = $dir/newcerts
certs                   = $dir/certs
certificate             = $certs/cacert.pem
private_key             = $dir/private/cakey.pem
default_days            = 365
default_md              = sha1
preserve                = no
email_in_dn             = no
nameopt                 = default_ca
certopt                 = default_ca
policy                  = policy_match
copy_extensions         = copy


[ policy_match ]
countryName             = match
stateOrProvinceName     = match
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional


[ req ]
default_bits            = 2048                  # Size of keys
default_keyfile         = example.key           # name of generated keys
default_md              = sha1                  # message digest algorithm
string_mask             = nombstr               # permitted characters
distinguished_name      = req_distinguished_name
req_extensions          = v3_req
x509_extensions         = v3_req


[ req_distinguished_name ]
# Variable name           Prompt string
#----------------------   ----------------------------------
0.organizationName      = Organization Name (company)
organizationalUnitName  = Organizational Unit Name (department, division)
emailAddress            = Email Address
emailAddress_max        = 40
localityName            = Locality Name (city, district)
stateOrProvinceName     = State or Province Name (full name)
countryName             = Country Name (2 letter code)
countryName_min         = 2
countryName_max         = 2
commonName              = Common Name (hostname, IP, or your name)
commonName_max          = 64


# Default values for the above, for consistency and less typing.
# Variable name                   Value
#------------------------------   ------------------------------
commonName_default              = www.example.com
0.organizationName_default      = Example Company
localityName_default            = Honolulu
stateOrProvinceName_default     = Hawaii
countryName_default             = US
emailAddress_default            = webmaster@example.com


[ v3_ca ]
basicConstraints        = CA:TRUE
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always,issuer:always


[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment


# Some CAs do not yet support subjectAltName in CSRs.
# Instead the additional names are form entries on web
# pages where one requests the certificate...
subjectAltName          = @alt_names


[alt_names]
DNS.1   = www.example.com
DNS.2   = www2.example.com
DNS.3   = www.example.net
DNS.4   = example.com


[ server ]
# Make a cert with nsCertType set to "server"
basicConstraints=CA:FALSE
nsCertType                      = server
nsComment                       = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always


[ client ]
# Make a cert with nsCertType set to "client"
basicConstraints=CA:FALSE
nsCertType                      = client
nsComment                       = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always

Before saving the file, some changes will need to be made to be specific to your site. The one critical change is to change the [alt_names] section to be relevant to your domain, since these needed to be specified in the configuration file rather than being requested later. If you need more or fewer DNS names you can add or remove lines. One thing to note is that the first time I tried this, Firefox didn't like the URL when I tried to connect using the domain name listed in the commonName field, so I went ahead and added it to the alt_names section as well.

You may also want to change the default keyfile names and other defaults to save yourself some typing later, especially if you're only going to be generating one certificate.

Once you have the configuration file the way you like it, you're ready to generate the key and certificate. We'll be doing it in just one step, without saving the intermediate certificate signing request:

$ openssl req -new -x509 -days 365 -nodes -out example.crt -keyout example.key -config example.conf

You'll be promoted for various certificate parameters; if you didn't change the defaults to what you want, you will need to enter them when prompted, otherwise you can just hit Enter at each prompt to accept the default specified in the configuration file. The certificate will be good for one year, if you want to change it, you can alter the number of days specified in the command line (or change the default in the config file).

Once this is done, you'll see two new files: example.key (which contains the private key) and example.crt (which contains the public certificate). Do whatever it is to need to do with them for your application.

Using a Scientific Linux/CentOS/RHEL 6 Server for Time Machine

I recently tried to setup a Scientific Linux 6 server as a backup volume for Time Machine. I based my steps on these instructions for Ubuntu, but I thought there was enough differences that I thought it was worth posting what worked for me. I used Scientific Linux 6, but it should work just as well for CentOS 6 and Red Hat Enterprise Linux 6.

A few assumptions made in these instructions, you will want to replace them as appropriate:

• The user's username is "user".
• The Linux server has a hostname of "linux.example.com". If you don't have a hostname in DNS, you can use the server's IP address instead.

First, we need to setup the server:

1. Install the EPEL repository. I already had it on the machine, but if it's not yet installed, read and follow the instructions at http://fedoraproject.org/wiki/EPEL.

2. Install netatalk from the EPEL repository:
# yum install netatalk

3. Add the following line to the end of /etc/netatalk/afpd.conf:

- -transall -uamlist uams_randnum.so,uams_dhx.so -nosavepassword -advertise_ssh

4. Create the TimeMachine directory in the user's home directory or wherever you want it:

$ mkdir /home/user/TimeMachine

5. Add the following two lines to the end of /etc/netatalk/AppleVolumes.default. Note that I commented out the ~ line that was already present since I didn't want to enable home directory access; I just want to use this for Time Machine:

#~

/home/user/TimeMachine TimeMachine allow:user cnidscheme:dbd options:userdots,upriv

6. Configure netatalk to be started when the system boots:

# chkconfig netatalk on

7. Start netatalk:

# service netatalk start

8. Open the AFP port in the firewall. Go to System, Administration, Firewall. Click Other Ports, Add, then scroll down until you find Port 548, Protocol tcp, Service afpovertcp. Select it and click OK. Repeat for Port 548, Protocol udp, Service aftpovertcp. Click Apply, then close the Firewall Configuration window.

Now, on your Mac:

1. Verify that you can connect to the server. From the Finder's Go menu, choose Connect to Server. Enter the server address afp://linux.example.com and click Connect. You should be prompted for a username and password.

2. Configure Time Machine to allow you to use network volumes for Time Machine. Enter the following command in Terminal.app:

$ defaults write com.apple.systempreferences TMShowUnsupportedNetworkVolumes 1

3. Go to System Preferences, select Time Machine. Enable Time Machine and select your mounted TimeMachine volume. You will be prompted for a username and password that Time Machine will use to connect when it's performing the backup.

Why AT&T Should Give Me a 93% Discount on U-Verse Internet

So, I recently moved. At my new house, I signed up for AT&T U-Verse TV and Internet. So, what happens this week, before I've even received my first bill? DSLReports and Engadget break the news that AT&T will begin imposing a 250 gigabyte per month cap on U-Verse Internet service. This already has me reconsidering my options.

Switching to DSL (I've heard a lot of good things about DSLExtreme) would be my likely choice, as I've had some pretty bad experiences with Time Warner Cable's Internet offerings. Plus, from what I understand, DSL and U-Verse run over the same copper pair, so I'd also have to change my TV provider. Time Warner Cable isn't all that attractive, and I had some bad experiences with the DirecTV customer service people before deciding on U-Verse. But that's really beside the point, and not why I'm breaking out the Blogger account for the first time in almost a year.

No, I want to lay out why AT&T should be giving me an 93% discount on my U-Verse service. It all boils down to simple math:

I have the U-Verse Max plan, which offers download speeds of 12 megabits per second. I even did the math in AT&T's favor, and used a non-leap year February as the definition of a month, being 28 days. Now we need to do one more division:

In other words, the bandwidth caps allow me to use just 7% of the theoretical maximum amount of Internet usage I could have in a month. And that doesn't account for the 1.5 megabits per second upload speed. So if I can only get 7% of what I signed up for, I should only pay 7% of what I was paying for before. In other words, a 93% discount.

Since the current charge for U-Verse Max is $45/month, that means I'll be paying just $3.15/month if I were to get the discount. Oh, and the folks with the $65/month Max Turbo plan, which offers 24 megabits per second? They'll barely get 4% of what they signed up for. It actually makes Max Turbo the an even better deal, at a mere $2.60/month.

Figuring out how long it would take at 12 megabits per second to consume the 250 gigabyte per month limit is left as an exercise to the reader. It's simple middle school algebra.

Spirit Airlines Hates Its Customers

Spirit Airlines likes to charge low fares. Really low fares. Absurdly low fares. So low, that they don't cover the cost of hauling the passenger from the gate to the end of the runway. How low? Try $9. But that's apparently not low enough. Yesterday, they announced new, even lower fares. But where do you go from $9?

Of course, if you think you're really going to get to fly somewhere on an airplane for one measly penny, you'd be quite mistaken. For if there's one thing Sprit likes more than really low fares, this is it:

Fees.

Here are a few of them:

• Want to check a bag? $19 if you pay online, $25 at the airport.
• How about another bag? $25. After August 1st, it will be $45.
• Get thirsty on board the plane? $2-3
• Want to pick your seat before you check in? $7. For the middle seat.
• Rather pre-reserve a window or aisle seat? $12. $20 for the emergency exit row.
• Oh, and you actually want that $9 fare? You'll have to join their $9 Fare Club, which costs $39.95 per year.

But all of that isn't new. And much of it is being copied by other airlines, some not exactly known for having low fares in the first place. That one-penny fare also doesn't include fuel. You pay for the seat, but there's an extra fee to actually move it anywhere.

But, buried in that press release about the one-penny fare (which I'm sure Spirit was hoping would get most of the attention), was yet another new fee.

• Want to carry-on your own luggage? Free. If it fits under the seat in front of you.
• $20. If you're a member of the $9 Fare Club and you pay in advance.
• Otherwise, it's $30.
• Or $45 if you wait to pay at the gate.

That's right. For the privilege of hauling your bag through the security checkpoint by yourself (ensuring that all liquids are in 100mL containers or less in a 1-quart zip top plastic bag outside your luggage), dragging it all through the airport terminals and down the jet bridge, and hoisting it in to the overhead bin all by yourself (ok, so you might get another passenger or a flight attendant to help you with that last bit), you have to pay Spirit Airlines a fee.

I want people to pay me to do things themselves. Imagine having to tip the bellman at a hotel for not bringing your luggage to your room, or tipping the valet to park your car yourself. That's what this is.

At the same time, they're lowering the fee for the first checked bag. $15 on domestic flights and $20 on international flights; $10 more if you're not a $9 Fare Club member. So it's actually cheaper to check a bag then not. The airline is charging you more if you do something yourself than if they do it for you.

Does that make any sense? It's like if, at the gas station, the prices at the full service pumps cost less than at the self service pumps.

Actually, yes it does make sense. Spirit's COO lays it out in the press release:

“In addition to lowering fares even further, this will reduce the number of carry-on bags, which will improve inflight safety and efficiency by speeding up the boarding and deplaning process, all of which ultimately improve the overall customer experience,” says Spirit’s Chief Operating Officer Ken McKenzie. “Bring less; pay less. It’s simple.”

So, they want to reduce the number of carry-on bags. So if you charge people to do it, they won't. Simple enough.

Or is it? We have to ask the question: Why are people bringing on so many carry-on bags?

I've already answered that question. Scroll back up. I'll wait.

Ok, I'll tell you again:

• Want to check a bag? $19 if you pay online, $25 at the airport.
• How about another bag? $25. After August 1st, it will be $45.

As I predicted when American Airlines started charging for that first checked bag almost two years ago, when asked to pay a fee to check their bags, many customers will choose instead to carry them on. How do we know this is happening? Ask the flight attendants, who will tell you that passengers have been carrying on more since the airlines started charging to check bags.

So, doesn't that mean that the problem of too-many carry-ons is really the airlines' fault in the first place?

Yes.

And does it also mean that they could solve the problem by simply not charging that fee?

Yes.

But instead of reversing the move that caused the problem in the first place, Sprit has decided to solve the problem by charging yet another fee. It may work too, but not in the way Spirit is hoping.

Fewer passengers on board mean fewer carry ons, regardless of whether or not they check the bags.

So why would the company choose the customer-unfriendly option in the first place, that has the possibility of hurting its business even more?

I can draw only one conclusion:

Spirit Airlines hates its customers.

Captain EO, a Quick Review

I was at Disneyland on Sunday and saw the return of Captain EO. This was the first day with full weekend crowds since it opened (as Saturday was rainy, the park was likely not as busy as it would normally be on a Saturday). I was there around 10:30 in the morning and the wait was about the same as I'd read about during the week on MiceChat's forums: I had to wait a few minutes in the queue, pretty much right under the new sign. We were then let in to the main queue area, and I was able to find a spot to stand at the bottom of the steps near the theater door.

There was a several minute wait for the pre-show video to start. Some of it seemed familiar. It was nice, and the Kodak ad wasn't nearly as drawn out as it was for Honey, I Shrunk the Audience!

When we were let into the theater, several announcements were made reminding people to move all the way to the end of the row as the auditorium was going to be full. I was seated a few rows back, near the exit side of the row.

The show itself was great. I did see some ghosting in the 3D picture, but it might have just been me as I was noticing the picture didn't seem quite right for MuppetVision 3D and It's Tough to be a Bug that afternoon as well. I was too young to remember the starfield effect, but having had it pointed out in advance, I did miss the lasers when EO's ship is under attack in space, since there's no visual effect to go with the sound. It seems like of the three missing original effects (the third being smoke), the lasers would have been the easiest to reinstall in the theater. This might be heretical to say, but if they're not going to reinstall the lasers, I wonder if the visual effect should be added to the film itself.

The motion floor was interesting. I don't know if it can move at an angle or just uniform up and down; if so it would have been nice to angle the floor to synchronize with the movements of the ship before it lands, to give the audience the feeling of turning as well. The movement of the floor during the musical numbers sometimes worked and seem to fit but sometimes felt unnecessary, like it was added just because they could.

Got a cheer from the audience when EO first comes on screen -- before we even saw his face.

At the end of the show, the cast member referred to our 3D glasses as "safety goggles", which is what they were referred to as for HISTA. The signs at the receptacle bins also referred to them that way. The glasses are HISTA yellow; the original EO glasses were purple. MuppetVision glasses are purple, it seems like it would be simple enough to swap the EO and MuppetVision glasses for the extra bit of authenticity at EO, but the color of the glasses is a pretty minor thing.

Here's hoping that, at least in Anaheim, Wayne Szalinski has shrunk his last audience.

TRENDnet modems with AT&T DSL

I recently got a new DSL modem, a TRENDnet TEW-435BRM. I had trouble getting it to work; the automatic configuration wasn't working. I searched around and saw lots of people having problems getting TRENDnet routers to work on AT&T DSL as well. After playing around with settings for a while, I did get it to work, so I thought I'd post here in case it might help others in the future.

The following settings work for me:

• VPI: 0
• VCI: 35
• DSL Modulation: ADSL2
• Connection method: Login, PPPoE
• DSL Duplexing Method: LLC-BASED
• Login name and password are my AT&T/Yahoo credentials
• Connect Behavior: Keep Alive (Reconnect immediately)
• IP Address: Automatic
• DNS: Automatic

The GIGO Buffer

I've contemplated doing this for a while, and after a conversation at work this past week, I've decided to actually implement it.

Presenting, a GIGO (Garbage In, Garbage Out) Buffer. Implemented in Python, and won't work on Windows (because really, that whole OS is basically a giant GIGO buffer).

#!/usr/bin/env python

class GIGO_Buffer:
 """
 Implementation of a Garbage In, Garbage Out buffer.
 """

 def push(self, element):
   """
   Push data into the buffer.
  
   @param element: Data to add to the buffer.
   """
   return

 def pop(self, len):
   """
   Pop data from the buffer.
  
   @param len: Number of bytes of data to pop from the buffer.
   @returns len bytes of data from the buffer.
   """
   data = open('/dev/urandom', 'r')
   rval = data.read(len)
   data.close()
   return rval

More Bad Ideas from the Airline Industry

Here's why this is a bad idea:

First, for at least the short term, checking in will take longer as people argue with the agents about the fee. Plus, there will be confusion about who pays the fee and who doesn't. Sure, they lay it out pretty clearly on their web site, but do we really expect all their front line agents to know all the details? And we know customers don't read.

Second, it will make security lines longer as more people who might have otherwise checked a bag now try to bring it through as a carry on to avoid paying the fee. People like me who would check through their liquid stuff will now have to have it as one more thing to pull out of the back and place in a separate bin along with my shoes, laptop, and sweater/coat.

Third, boarding will take longer while people try to find room for all that stuff they didn't check. People trying to stuff it in the overhead bin, figure out how to get it under their seat, and finally having to check it through anyway.

The ultra-low-cost carriers like Ryanair, Allegiant, and the late, unmissed Skybus can get away with this because their fares are so low that I actually buy the argument that they're simply operating on an a la carte model where you pay for the services you want. I have a harder time buying that argument from American, where we won't be seeing the fares going down (and most people won't notice if they keep the fares lower by doing this in lieu of simply raising fares) and their fares aren't and won't be substantially different from their competitors.

We'll Miss You

1946-2008