I’ve been traveling this intersection (as either a driver or a passenger) nearly as long as I’ve been alive. Cramming a 90′ circle in this space is a terrible idea for any number of reasons.

Traffic actually moves through this intersection. There’s a church and elementary mere yards to the south, both of which will generate significant queuing of traffic if a circle is put in place. A mile north is Herndon High, which will cram traffic into the circle from the opposite direction.

At present, two out of three directions can continue to move at all times, and traffic approaching from the south (the approach with minimal sustained volume) must stop briefly. It works. With a circle in place, all three directions must slow to a yielding speed most of the time.

There have been relatively few accidents at this intersection, one of which was fatal. As the article points out, most of them were due to driver negligence, not the inability of motorists to navigate what is otherwise a textbook example of a forgiving intersection. The speed limit is twenty-five miles per hour.

The proposal is ugly and industrial. This is one of the nicer and more spacious areas in the Town of Herndon, and a circle is a near-nuclear approach to calming traffic. Speed humps, speed tables raised roadways and even simple signage may be equally effective calming measures and are much less invasive.

There’s also the option of revisiting the numbers. For instance, the total number of accidents, and the total as a percentage of average daily flow. The former statistic is in dispute–the numbers cited by some council members far exceed those reflected in the police records. For all of the infighting with respect to the solution, it might be the case that the scope of the problem doesn’t actually warrant any action at all.

This was my first go at photographing fireworks, and it was more difficult than I had expected. I had a particularly hard time getting clean, clutter-free captures at the venue–the viewing area was restricted for safety reasons and there were a number of utility poles and lines obstructing my view of the firing field. A wider lens would have caught a lot of ground and utility clutter. Shooting tighter made for good detail but also made it difficult to track the unpredictable/burst patterns.

On your beloved Mac:

1. Open iTunes.
2. From the menu bar, go to iTunes -> Preferences -> Devices.
3. Check the box next to “Prevent iPods, iPhones and iPads from syncing automatically.” Click OK.
4. Plug in the iPod.  If it doesn’t appear as a disk in the Finder, select the device within iTunes and on the Summary screen select “Enable Disk Use.”  Eject the iPod and plug it in again.
5. If you haven’t already, install MacPorts.
6. Open Terminal
7. Update MacPorts: sudo port -d selfupdate
8. Install the id3v2 utility: sudo port install id3v2
9. Move into the directory on the iPod that contains your music: cd /Volumes/Your Mom’s iPod/iPod_Control/Music
10. Read ID3 tags from all MP3 files on the device and output the data to a text file in your home directory: for i in `find . -type f | grep mp3`; do id3v2 -l $i >> ~/ipod_tags.txt; done
11. Open the ipod_tags.txt file using TextEdit and find the files that interest you and copy them off.  Example: cp ./F00/KIJN.mp3 ~/Recovered/ (assumes that you’ve created the Recovered directory in your home directory).
12. Import the files into iTunes as you would any other music file.

IMPORTANT: If you purchase your music from Apple/iTunes this won’t work. There may be a tool that extracts metadata from M4A files, but I don’t need one and therefore haven’t looked for one. Consider this a learning opportunity and start purchasing DRM-free music in an open format from the Amazon MP3 store.

The premise is that you create a “tumblelog,” which Jason Kottke describes as a “quick and dirty stream of consciousness.”  Tumblr allows the user to achieve this by posting long-form, quotations, links, and a variety of media.

This type of service is generally more fun/useful if one’s friends are involved.  Thus, the likely sequence of events for new users is:

1. Find Tumblr.com via link or Google.
2. Follow “Sign Up” or “Log In” links on Tumblr home page.
3. Submit/create an ID and password to access your dashboard.
4. Find and invite friends by allowing Tumblr to “Look up your contacts”–this imports contacts from your mail service of choice (Google, Yahoo!, Hotmail, etc.), which requires that you provide Tumblr with the username and password for said service[1].

There’s just one problem: At no point did it occur to the folks at Tumblr that they might want to encrypt form submissions.  Both the Sign Up and Log In links on the home page send the user to an unencrypted page, and post information in the clear [login.pcap][2].

Assuming that they notice and care, end-users can log in via an encrypted form, but this requires that they know to edit the URL by hand prior to entering data [video].  It is recommended that Tumblr subscribers bookmark the following URL if they wish to log in: https://www.tumblr.com/login.

And it gets better/worse . . .

Once the user logs in and visits the Goodies page, Tumblr offers to locate friends by importing contacts from a personal mail service.  Tumblr accepts the (arguably more sensitive) username and password for these services, and transmits these in the clear as well [import_contacts.pcap].

Oddly enough, an end-user attempting to submit this information via an encrypted form will be thwarted by a redirect, sending them back to the unencrypted page prior to data entry [video].

One would think that an observant end-user would catch one or both of these gaping security holes, but my guess is that the overwhelming majority of their six million or so users haven’t noticed or don’t care.  Then again, one would also think that that at least one person on the Tumblr engineering team would consider safeguarding user data in transit.  Alas, collective fail.

UPDATE01: It’s bad enough that they knowingly implemented the service in this manner, but Tumblr was made aware of this by an end-user Mar 2010.  Aug 2010: No change.

UPDATE02: Another concerned user reported this to Tumblr in Jan 2010.

UPDATE03: A brief survey of popular social sites indicates that Tumblr and Digg appear to be the only two that knowingly take your Google (Gmail) account credentials and pass them in the clear.

———————-

[1] Many web sites offer this type of temporary contact import, but do so safely.  Lesson: “Trust but verify.”

[2] Many HTML forms on unencrypted pages POST to encrypted URLs, protecting the data in transit.  That is not the case here, thus the packet captures for validation.

• Failed to import events: Unable to process your iCal/CSV file. (Google, Bing)
• HTTP/1.1 403 Google Calendar doesn’t support storing of “To Do” (VTODO) components (Google, Bing)

It appears as though Google Calendar is choking on both the VTODO and VALARM stanzas within the export file.

VTODO data is easy to remove, as it will appear near the end of the export file.  Find the first instance of “BEGIN:VTODO,” and remove all data beginning with that line and ending with the final “END:VTODO” instance (take care not to delete the “END:VCALENDAR” line, as it will invalidate the export).

VALARM data is problematic, as it is nested within each VEVENT stanza.  Depending on the size of the export file, it could easily contain hundreds or thousands of these.

The fast and dirty solution is to remove these elements from the iCal export file, and then import the “clean” version into Google Calendar.  Note that imported events in the target Google Calendar will no longer contain alarms–these events will need to be updated manually, if desired.

Following is a simple Python script that will remove these stanzas and produce a new file that should import properly.  After downloading, be sure to edit the INFILE variable at a minimum.

Head on over to Code for the latest version (iCal-to-GCal).

It’s worth noting that this script can be used to quickly remove data from any file that contains similarly-formatted information.  Just update the TAGS list accordingly.

UPDATE01: Wondering whether the integration of Tasks into Google Calendar will alleviate the VTODO handling issue?

The problem arises when I’m viewing content on my mobile phone, as the concept of a bookmarklet in any mobile browser that I’ve had the pleasure of using does not exist.  To make matters worse, I’m one of the five or six people on Earth who does not own an iPhone.  So, the surely-pleasant Instapaper apps are dead to me.

For some time, I’ve been using the “Send this Page” functionality built in to my mobile browser to e-mail pages to a mailbox for further processing.  Some simple mailbox rules and a short list of known source addresses make this a viable solution.  Unfortunately, viable is never good enough.

To scratch this itch, I’ve thrown together a small collection of scripts that will:

1. Retrieve messages from an IMAP mailbox (this needn’t be a dedicated inbox–a specific folder, Gmail label, etc. will suffice).
2. Validate senders using a whitelist.
3. Extract things that look and smell like URLs from message bodies (should handle crappy HTML messages, too).
4. Submit URLs to Instapaper.

Surprisingly, it works (for me).  Requires Python 2.5+ (haven’t tested with 3.X, but should work), and an IMAP-enabled mailbox of some sort.

Head on over to Code for the latest version (IPMailer).

I’ve shot a handful of indoor shows, with a variety of lenses.  In this case, I decided to shoot with a couple of faster primes (the Canon 50mm F/1.8 and 35mm F/1.4).  Shooting with these focal lengths at an indoor venue tends to work out very well, or very poorly, depending on the distance to the stage, available lighting, and the type of photo that one has in mind.  In this case, I was more interested in seeing how the primes would perform in terms of focus and color, and not so much concerned with getting any really tight shots.  

The venue itself was small but crowded, and getting up front was inconvenient.  So, I shot everything from the standing room behind the sound booth, stage left, or the balcony.  Given that I didn’t have a lot of focal length on my side, I had to be mindful of both framing and focus, so that shots would be metered appropriately and could be focused relatively quickly in the low light.  My specific concern with respect to metering was the drastic lighting imbalance at a distance–when I had a dark crowd in the bottom of the frame, and a bright stage above–causing my shutter speeds to decrease (when, in my mind, they should not have), resulting in blur where I didn’t want blur.

Overall, I was happy with the results.  And, here are a few of my favorites.  Enjoy . . . 

Here’s the actual warning page itself:

UPDATE1: This is definitely widespread.

UPDATE2: Fixed, after thirty minutes or so.  

UPDATE3: Naturally, on TechMeme via TechCrunch.

UPDATE4: Some donkey checked in a list of bad sites with a ‘/’ at the top.  Heh.