Author: Charles Céleste Hutchins

Supercolliding since 2003

Security and .Net Programming

.NET is a Java competitor from M$. It is also cross-platform, compiles to virtual machine code. During run-time is Just In Time compilation. So the source code compiles most of the way and goes the rest of the way when you run the program.

Security

Security aspects: secret data must be kept secret. Data I want to protect is confidential. Some data can be readable by many, but not writable. I want to protect the integrity of that data. Sometimes I don’t want to leave a paper trail for the feds. That’s non-repudiation. Data must also be accessible to me when I need it.
so to ensure all of that, I have authentication and logging. The Authorization and authentication protects confidentiality and integrity. Hashing also helps protect integrity. Encryption. logging for non-repudiation (have i got ths term backwards?). And redundancy keeps stuff available.
Now we’re talking about why we should care. Firewalls are no substitute for proper design, etc. I can’t even believe that people would think they didn’t need to worry about this if they were writing network applications.
.Net has it’s own sandbox concept called CAS: code access security. It is really similar. Code gets permissions based on origin and you can say how much you trust it, etc.
How about security for the developer? You need to figure out which permissions that your code will need. Communicate your permission requirements. Make the documentation machine readable. (Is this built-on/for free?)
What about for the admin? What permissions should the code get? What’s the source of this code? How much do i trust the source? Check the hash and the signature (x 509 or strong name (I don’t know what that means, but ok))
there are some pre-defined permissions. They can let you at some resources.
This talk is really intense for this group. I wonder if anybody in this room is a .net programmer.
ok, so you might want to access the printer or to skip verifying stuff. Full trust allows everything. Be careful. Did she just say that Microsoft must have full trust at all times? Isn’t that a huge issue?
So one spot to attack is input validation: Cross-scripting (XXS), SQL Injection, buffer overflows, canonization attacks. Double check everything!
Validate input against XXS:Cross Site Scripting. Lookout for javascript in image tags and weird html tags. Look out for .. in urls. Blackhats might be trying to get into forbidden directories.
The speaker is now warning us not to try this on other people’s websites, lest we become blackhats.
She is further warning us to make sure things are escaped and sanitized. And now the whiteboard has suddenly collapsed on my dog. Who seems ok. Um, so make sure html doesn’t get executed. And check your SQL. Is this actually a string? Is this way too long? Ironically, she’s going on great length about buffer overflow. Great, great length.
Now it’s canonicalization attacks, which is the thing where you need to use a full path or else somebody might be evil.
Ok, in summary: check all your input. know what you expect. check fr it. check for weird input. She’s asking somebody to describe what a regular expression is. I don’t know how to define this. She’s giving us an example. I don’t know if the point is to look out for regular expressions lurking in input or telling us to be smart with our regex. Ok, it’s the latter. Be precise.
Um, yeah obviously do all of this on the server side.

Session management

http is stateless. so fake states with cokies (um, be careful with that), encrypt the authentication cookie with SSL. There must be timeout.
Um, I’m going to skip out before everybody else eats all the food.

Gig Report: ETC (Hangover editition)

I started yesterday by sleeping in a long time. Then I went to get a haircut. There’s a great haircutter here in Amsterdam. So I got a haircut. On the way out, my bike tipped over, alas, which is a common enough occurrence. I got to the venue early in the afternoon and proceeded to drink like 10 cups of coffee and eat a lot of sugar.
Then I went to set up and my synthesizer wouldn’t plug in. The power transformer plug got bent when my bike tipped over. Oh No! Oh no! So I used my pocket knife to bend it back, but, um, yeah, it would have probably been smarter to unplug it first.
My synth wouldn’t turn on. After some experimentation with a volt meter, we determined that the transformer is dead. And just try finding something that puts out +15V, -15V and ground. I’m not 100% certain that the problem is actually the transformer, but I really hope it is because trying to fix the synthesizer itself is beyond me. It’s an evenfall minimodular, so if I broke it, bah, they’re not being made anymore.
I wet and bought some Jenever, a type of Dutch gin. Then I tried to figure out what the hell to play. 40 minutes of live sampling was down the toilet with nothing to sample. I quickly assembled a program and put together a very alpha version of of my crotch-mounted joystick piece – with the wrong game controller, so the visual element was lost. I got it finished just in time for my sound check.
The right speaker connection was janky, so the person running the sound check, was all “we’ll have to tell the engineer to jiggle this if it drops out.” The next person trying to sound check just could not get her system working at all. So finally, about an hour late, I was on. Nobody from The Hague came, but I didn’t exactly give them advance notice and anyway, I wasn’t even playing my program so whatever.
I started playing the silly phone sounds piece that I wrote for brumcon. And I hit the button on my joystick. And nothing happened. I knew it had loaded the drivers correctly. Jesus, the batteries must have died. I wasn’t on a stage, I was back by the sound booth, which was lucky, but nobody had batteries. I ran up out of the performance area and found bag, overturned it, grabbed my spare batteries. The moral of the story is that spares must be kept with me. The cool thing was that as soon as I got the batteries in, I could start controlling the piece, even from outside, so I was able to make it kind of play ok while I was coming back.
That piece sounds great in a bedroom, playing out of genolec monitors. It sounds like crap on any other equipment with any other acoustics. Sine waves are unforgiving. And the acoustics at Plantage Dok are crap. Yeah, so great start.
Then I went to play my little movie about getting an injection. (I know, a few days ago, I’m all weird about shooting T and two days later, I’m performing a video of it. Whatever.) The right speaker dropped out completely. And then proceeded to allow bursts of sound in only on the really loud parts. all of the nice, sustained bass sounds are on the right. I turned to the sound engineer, “the right speaker is out!” She had no idea about the janky connection. Somebody sitting next to the speaker, said, “no, it’s fine! I hear sound!” It was not fine. It’s kind of suboptimal explaining a technical issue to a sound perform during a set while an audience member insists that it’s all working fine. This whole situation can’t have lasted more than a minute, but it seemed a bit longer. And then the sound was back. on the right.
I don’t even remember what else I played. Finally I did the piece with the joystick and the moaning porn women and it worked really really really well. Which was amazing because I had done less than a full run through of it ever. It was the maiden voyage. so to speak.
I decided to quit while I was ahead. I think everything must have been less than 20 minutes, but I actually have no idea at all. But to summarize: we have a dead synth, a dead joystick, a dead audio channel, a sudden exit, and playing pieces about male-embodied masculinity and sounds of porn to a feminist, women audience. It went over really, really well. This is one of the friendliest audiences ever.
I think also the performance aspect was working very well. I was projecting my screen contents so that I could show my video, but it also showed them the source code for my pieces, which was not cleaned up at all. My phone sound piece is still full of cuss words. The piece with the porn sounds has “naughty_piece” for it’s file name. They could see all the weirdness, which created a connection. And also, running out and upstairs and madly throwing cables everywhere, digging for batteries is dramatic. People like drama. I want everything to be really clean and professional and together, but folks seem to connect more when it’s more obvious how precarious things are. I mean, I always test my music a bunch of times before I play it. (well, almost always), but I never make it perfect. some of my pieces dance on the verge of completely crashing and print out tons of error messages. People like that.
So I didn’t do any live coding, but I think I see the mechanism that attracts people to it. They don’t just want to see somebody play violin, they want to see them do it on a highwire without a net.
Anyway, after I was off, I opened the bottle of jenever and proceeded to drink a lot of it. It’s really good! Tasty. Not harsh. Really fucking strong.
And today, I want to barf.
Just randomly, about a year ago, I went to a show at this same venue. Somebody was making sounds with a wireless joystick exactly like the one I have now. The show ran into major technical problems and wasn’t really going. They had thrown something together at the last moment, but it sounded cool at least.
Ugh, I fee like sick.

Ningun lugar

Ningun lugar works wioth gender, sexuality and technology.

Their project is called generatech. In barcelona.

We’ve been shown a video with women having sex and some text that may have mentioned debian, but i don’t know because there was sex.

They’re doing an event in july in barcelona about gender and foss.

Last year the only performance was ‘post porn’ and sm. Their events have workshops and performancces. They do debian stuff. Also there was sex. Now there are more videos. Maybe with sex.

I can’t post these notes, because it’s too about the sex.

Um.. So this video had a faux queen hrassed by guy who stabbed him in the gut and then fucked the  wound. Meat products were involved in the production.er. Wow.

I don’t understand the difference between porn and post porn. Also, apparenrly there was feminist text along with images of women fucking. Which might as well be a secret message, alas.

Etc: female icons

De Geuzen

A collaborative group since 1997. 1996, actually in Mastericht.  They started by having a space doing workshops, etc. The street was named for Geuzen, which is a derrogative term in Dutch.  Apparently, itś abad name for women.

They have an alphabetical dictionary of slang terms for women. And they put the words on t-shirts. Secondhand. Each t-shirt is unique. They were exhibited and then sold.

The group went on to collect further lists. So now theyŕe doing female icons. These are iconic images of famous women. So they started putting images of icons on plates.  Like Cher.

Then they started an impersonation thing where people hold pictures of famous women in front of their faces and a photo is taken. They have a flickr group. Tag your photo melikeher.

All the icons have tags. Thereś a tag cloud. Beauty¨is atag, for example.

This group is really, really into lists.

Www.geuzen.orgDe

I’m at the ETC

Gender

That’s the Eclectic Tech Carnival a fun mishmash of technology, feminism and social activism. I’m playing a show tomorrow night. And yesterday, I taught a workshop on Audacity and podcasting (some text from that will be available shortly).
The con is for “women and gender minorities.” Which means I’m the only guy in the room. Back in the old days, I was often the only woman in the room, which, at a tech event, really bothered me. Actually, when I go into a public meeting on tech or music, I always do a headcount of men vs. women and wonder what can be done if the ratios are not good. This is entirely different, of course and ok as long as I don’t think about it too hard.
I’m not the only transmasculine person here. I might not even be the only transsexual here. But I’m definitely the only male-identified person. “Women and gender minorities” gets shortened a lot to “women.” I wonder how I will feel about this in the future? On the one hand, I probably won’t ever be in this community again and that’s a loss. On the other hand, right now I’m not overly confident in regards to gender and so when I see things get shortened to “women” I feel anxiety. Everyone is really accepting and accommodating. Alas, I think it is my fate in life to always be asking for exceptions. I ask for fewer now, at least. Nobody asks for me to wear a dress or leave the appropriate loo. So on the one hand, it’s fine. But on the other hand, I can’t think about it too hard.
This avoidance comes out in weird ways. People keep asking if Xena, my dog is a male or female and I find myself getting irrationally defensive around the question. She’s a dog! She doesn’t have a gender identity as far as I know! Who are you to say if she’s a vrowje or a manje based on her genitalia!?! Ok, I know this is crazy, but better to be irrational about my dog than other things.
Until last night, I was staying with Vivian in Delft, which meant a lot of time in transit. I got back to Vivan’s flat last night at 2:30 am and had to feed the dog and give myself a shot of T.
Ok, so I don’t feel like my feminism is incompatible with being trans. The name of the sponsoring org for this thing is Gender Changers. It’s all ok. I still feel weird coming home from being surrounded by all these great women and then shooting up T. But if I were to put off the shot, it would make me feel sluggish and unhappy, and anyway. It’s ok to be trans or it isn’t. The timing of the shot shouldn’t have any bearing on that. And this is part of what I mean about not being confident.
So I was sitting on the floor of Vivian’s guest room, naked, right before sleep, trying to flick stubborn bubbles from the needle. I’m still not good at this. It’s messy. The way the British ampoules work is that first I draw all the T (in castor oil) up into the needle and then turn it around and try to get the bubbles out without spilling too much. Then, of course, I stab myself. Lately, I’ve been pushing the needle in slowly, which is a bad idea, but doesn’t cause physical harm, so whatever. Push needle, tense muscle, relax, push slightly further, tense again . . . ok, it does cause physical harm, but so does people biting their nails.
I pulled out the needle and there was blood. Not a little spot of blood, but a coin-sized pool of blood coming from my leg. Aieeee! Blood! Aiiieeee! 3:00 AM stark naked at my friend’s house and a pool of blood! I saw the antiseptic wipe I had used early and pressed it down to stop the bleeding. Oh my god! Oh my god! oh my god! I started to shake uncontrollably.
I saw this thing where you’re supposed to try pulling back on the plunger to see if you draw up blood. If you did, you hit a vein or something and need to re-try injecting. That didn’t happen. So where did the blood come from? Ok, weight lifters take more in a day than I just took, so it doesn’t matter if it went straight in my blood. Well, 0.8mL of castor oil in my veins in probably not good, but it’s not like I could do anything about it. If I can’t do anything about t and it won’t kill me, then there’s nothing to do but shake a lot and try to sleep.
(Castor oil is secreted by beavers, according to the dictionary on my mac. Um.)

Location

This is my first time back in the Netherlands since moving away. It’s even nicer than I remember. I love the bikes. I love the urban planning. I love the train system. I love Dutch people. Delft is south of Den Haag, so taking the train into Amsterdam, I could see the train station and the church tower next to where I lived. I felt such an unexpected wave of attachment for the Grote Kerk tower. That’s my home. That’s where I have friends. That’s where I walked my dog. That’s where I biked. I love Holland. I love California. I love France. I left my heart in San Francisco. I left my stomach in Paris. I left my mind in Amsterdam. So now I’m heartless and mindless.
Good Dutch food: the beer. The coffee. The little sweet things you eat with coffee. Vla. Pancakes. Appeltart.
I have to find a way to move back here.

Show Wednesday (Tomorrow)!

I will be playing tomorrow night at 21:00 at the Plantage Dok in Amsterdam. The show starts at 21:00. Admission is free and the beer is cheap! I’m be playing “electronic noise that you can almost dance to.”
The address is Plantage Doklaan 8 tot 12. See the venue’s website for more information.
I’ve been trying new methods to make fun music. I’ll be using a MiniModular synthesizer, but re-sampled to 8 bit and silly 8-bit nintendo-inspired drum sounds. Hopefully, It will be exciting and fun. I don’t know if you will be able to dance to it, but I hope you try.

Live Blogging ETC – makeITfair presentation

Donna is speaking about the history of rubbish collection. This has to do with how electronics get recycled or not. Good Electronics is an organization that looks into this. MakeITfair is linked to the Clean Clothes initiative.
The makeITfair guys are now talking about the story of stuff: where do things come from? This is an awareness raising campaign working with NGOs through the world. Raw materials, production, distribution: what’s the story?
They’re giving us a quiz, with a prize! (ooh) But first a movie. Maybe.

Extraction

Things start with “extraction.” Raw materials. Aka, exploiting the environment and killing the planet. People who live in the way of extraction are screwed.
Every phone has 65 different elements. 25% of a phone it metals. The IT industry uses a lot of metals. They come from mines, of course. Largely mines in the third world.
MakeITfair did research about three kind of metal: platinum group – used in hard disks, motherboards and screes, cobalts and tin. Oh, and is it bad. Forests cut down. Nasty pollution. Weirdly colored snow. Child labor in the Congo. 50k kids working in cobalt mines there. The workers are sub-contracted. Migrants. Untrained. Uninsured.
The Congo is not the happiest place on earth politically. Mine revenues end up in the hands of armed groups: rebels and military, both of whom use it for weapons. The local communities get screwed and shot at. “Social Disruption”
makeITfair asked electronic companies about this. They said, “oh, it’s untraceable. we can’t find out where things come from.” and “We hardly use any of this stuff. Nobody cares what we say about it.” MakeITfair countered that they could trace stuff and the companies do buy a lot of stuff. The companies changed their tune. “Oh, maybe we should do something. huh. But what? talk to us for a long long time in many many talks.”
NGOs care about these issues. Investors also care. The ones that are accountable to anybody. Investors are sometimes now setting criteria and conditions.

Production

Toxic chemicals! We use it in products, it ends up in the environment. It ends up in us. Breast milk has super high levels of toxins. Factory works get doused in it. New urban arrivals live in slum and get to work in toxic factories. Toxins also end up in waste, aside from products.
Donna won the quiz!
Phones and computers are not made by the brand, obviously. They’re made by huge western multinationals with factories in the developing world. Seagate. Up to 80% of factories workers are young women from rural areas but now in urban ones. Low wages! Factory workers get fined often which lowers their wage further. They have long hours and non-voluntary unpaid overtime. And they get to work with toxic materials with no protective gear. And they don’t get to unionize. Unions are illegal in many places, including China.
Brand companies say they can only they can only talk to their direct suppliers. makeITfair says, the whole chain is your problem. In China, it’s hard for NGOs. There’s one national union which is not very effective. NGOs that exist are based offshore and underground.

Distribution and Consumption

Selling as fast as possible. Low prices. Costs are externalized. Who pays for stuff then? Workers. By not getting benefits. Only 1% of stuff we buy in the US lasts longer than 6 months. (Including food?)
European consumers (age 16 – 30) say they’re willing to pay 10% more for fair trade electronics.
What can we do? Recycle. Longer functional part of life cycle. Complain to brand companies.

Live Blogging ETC – Cuisine Interne

Brussels Organization and feminism and creative commons. They have a patchwork approach weaving many themes together.
They do women and FOSS days every 6 weeks
Also a wiki about linux and audio, tinkering with trash hardware, wiki about publishing with foss tools (all in French), parties. Also working on a mapping project with Open Street Map and also hand-drawn maps by people as sort of subjective impressions. Open Source video, and a million art projects and parties. Artistically engaging public spaces.
Wrote some audio software for doing interviews. In python. Runs from command line. looks for a text file which holds questions. Starts with a test of the audio. The questions for the program are decided on by consensus of everyone involved in the project.
we are writing down questions now . . .. We all have post it notes. I can’t think of a question. Um . . . art and technology . . . um . . . .. Wow somebody else asks, “How do you connect art and activism?”
Ok, so we’re writing questions on postit notes and then putting them on butcher paper that’s been attached to the walls. We’re going to pick 16 of them.
The questions from previous versions are for working artists. (paraphrased) “How do you make a living?” “Who owns your work when you are finished?” “What is your price structure?” “How did you determine your prices?”
Now all of us are going to pick our three favorite questions.
(To be continued)

The last on BrumCon

My previous post is apparently coming off as much more whiny than I intended. I get very nervous on stage, in general. So I always think I’m crashing and burning, no matter what’s actually happening.
Why play on stage even if you get stage fright: it gets easier when you do it a lot. It impresses chicks. It’s even more annoying sitting in the audience watching somebody else play your music wrong (which gets you no chicks, they all go for the performer). Nobody wants to go to a show of tape music. It’s almost always worth it. Audience reaction is the best way to figure out what parts of pieces are working and what parts aren’t.
In the art music scene, we brag about playing in front of hostile audiences. One time, in Connecticut, I had a friend who ran a folk music open mic night. She invited me to come play a political piece I was working on, with the voice of a shrill, horrible far right political pundit. Just about everybody got up and left and the ones who remained tried to give me unfriendly, helpful advice including things like the definition of music, since I was obviously unclear on it. That was a hostile audience. BrumCon? That was mixed.
That was surprising for me: playing in front of a mixed audience, since it was a new experience. And then there were musical problems where I was kind of fighting my gear. That happens sometimes. I now know what changes I need to make before my next show. It’s somewhat stressful, but not like, say, having a tuba that you’re playing suddenly fall apart on stage.
I would totally be into playing in front of the same or a similar group again. And next time, I’ll have a better idea what to expect. I’m glad I added in the 8 bit FX, as that seemed to go over really well. I’m also glad I didn’t get my piece with samples from BNP politicians together. (The British National Party is allied with the French National Front (Le Pen’s party) and other National Socialist parties around Europe. They’re bad people.)
After I packed up, I wandered into the bar next door, where a bunch of the attendees, including the next speaker who was supposed to have started already, were having pints. One friendly guy bought me a Guinness. I chatted a bit with people and then went to the next talk which was on web security and how to hack social networking sites. And how to prevent those hacks. It was interesting and would have been way useful were I still a web developer. You can’t just check IDs against permissions. You need to have some logic in there also. There are permission sets that are impossible. Like a Admin should also have the Moderator bit set, for a hypothetical example, and if they don’t, they got to be an Admin through abnormal means.
Then, I chatted with more people, including one guy who books gigs for a series in London. 🙂 I looked at the clock and it was 17:30. I’d left Xena, my dog, locked in a crate since 10:00 so I decided to bike home with my gear, give her a walk and then bike back to catch the end of things. It was such a lovely day in the park! So bright and sunny and warm! We had a lovely walk and then I sat down for a moment on my bed . . . and woke several hours later. Ha! I can only drink half a pint, or I get totally non-functional. It’s so pathetic. I need to start going to the gym to put on some weight!