As for Iraq, no real changes.

Despite what I said last month, I’ll probably continue to plot the Iraq data for the “residual” forces. 50,000 is a lot of advisors.

But instead of writing the post, I got hooked on watching YouTube videos, and pretty soon the evening was gone. That turned out to be a lucky break, because when I opened iTunes today, I found that Second Gear had just done a small update to Elements. So now I can compare the latest and greatest of both apps.

If you’re the impatient type, here’s the bottom line: although I haven’t deleted Simplenote from my iPhone, I’ve stopped using it. All my notes are done in Elements now.

Simplnote

The primary new features in Simplenote 3 are:

• The tagging of notes. A little flag/button appears at the top of each note, allowing you to add tags to that note for later searching. I have really no interest in this. To me a good title beats a set of tags any day.

  

• A fullscreen viewing option. This is pretty cool; it gets rid of the top and bottom toolbars (or whatever they’re called) and lets you see a few more lines of the file.

  

  That light floating button in the lower right takes you back to normal view.

• Note statistics. Elements already had this, and it’s an easy to implement, so it seemed inevitable that it would come to Simplenote. Oddly, it only gives the character and word counts—no line count.

  

These additions don’t address the downsides of Simplenote I mentioned in my earlier comparison:

1. Its own syncing solution, which forces you to use either a web browser or a restricted set of applications when you want to access your notes from a computer.
2. No option for a monospaced font. Some text files are just better suited for display in a monospaced font.

Elements

The big change in Elements is that you can now use any font on the iPhone, not just the “Roman” versions. I immediately switched from Courier to Courier Bold. The font looked ridiculously thick at first because I’d gotten used to the spindly look of plain Courier, but now it seems OK, especially when combined with the Silver background.

There’s no question I’d prefer a nice sans serif monospace font, but unless there’s a way for Second Gear to package a font with the app, we won’t see a really good looking monospaced font in Elements until Apple gives us one.

Elements is not without its problems.

• The color choices for the text and background are, for the most part, ugly and don’t match either of the toolbars.
• It doesn’t recognize phone numbers in the notes and turn them into links to the Phone app.
• The enormously long list of fonts for displaying the notes could be organized better, allowing you to start by choosing a font family and then choosing a style—like every other program you’ve ever used.

These problems, though, don’t come close to outweighing the great simplicity that comes from Elements’ Dropbox syncing. I can use any text editor on my computer to create a file, save to the special Elements folder within my Dropbox folder, and it’ll be available in Elements on my phone in a minute or two. And for files edited in Elements, the syncing is just as automatic in the other direction.

Wrapup

As I said in my initial comparison, the two things that set Elements apart from Simplenote are:

1. The text editor freedom provided by Elements’ Dropbox syncing.
2. The ability to use a monospaced font to align columns in certain files.

That Elements can now display its notes in a font that actually looks black instead of light gray is just one more step ahead of Simplenote.

It’s true that Elements is $5, whereas Simplenote is free, but if that’s your overriding consideration, you might want to reconsider your priorities.

The fix was fairly simple, but as I was editing checkcards.py, the Python script that does all the heavy lifting, I got a little too aggressive in tearing out the old code and had to reconstruct some of it from memory. It was then that I realized that I’d never put the checkcards scripts under version control. Now I have.

In addition to the README, the GitHub repository has three files:

• checkcards.py, which communicates with the library’s website and prepares the email with the list of items checked out and on hold.
• checkcards, which runs checkcards.py and pipes the result to sendmail for emailing.
• com.leancrew.checkcards.plist, which tells launchd to run checkcards every morning.

My login information has been redacted, and the README tells you how to customize it for yourself. Frankly, I doubt that this will be useful to anyone who doesn’t use the Naperville Public Library, but who knows? I think it makes pretty good use of the mechanize library to interact with web pages.

Sometimes goofing off pays dividends.

Here’s the first:

Only the fat cats change — not their methods and not their pet bugaboos (taxes, corporate regulation, organized labor, and government “handouts” to the poor, unemployed, ill and elderly). Even the sources of their fortunes remain fairly constant. Koch Industries began with oil in the 1930s and now also spews an array of industrial products, from Dixie cups to Lycra, not unlike DuPont’s portfolio of paint and plastics.

Spews? Why use a derisive verb to describe a company that actually makes things? That’s something of a rarity in the US today, when everyone seems to want to be in the business of buying and selling money. Sure, if the company violates pollution laws, spews is a great word for what it puts into our air and water. Or if the products it makes are junk, then spews would fit the bill. But there’s nothing wrong with Dixie Cups and Lycra, or paint and plastics.

Make no mistake: the Kochs are evil bastards. But they’re not evil because they make Dixie Cups.

The problem here isn’t just that Rich is being stupid; it’s that he’s being stupid in a way that plays into conservative stereotypes about liberals. Frank Rich is a liberal elitist who thinks he’s too good for Dixie Cups, so he bashes the Real Americans who make them.

In the next paragraph, Rich mentions the Mayer article and pushes the stereotype again:

Her article caused a stir among those in Manhattan’s liberal elite who didn’t know that David Koch, widely celebrated for his cultural philanthropy, is not merely another rich conservative Republican but the founder of the Americans for Prosperity Foundation, which, as Mayer writes with some understatement, “has worked closely with the Tea Party since the movement’s inception.”

So first he slams the “fat cats” and in the very next paragraph he reports on a “stir” among the Manhattan charity ball crowd. Darling, did you hear our David associates with those dreadful Tea Party people? Worse yet, I hear he makes Dixie Cups.

Frank Rich knows the culture wars well enough to avoid crap like this. He’s presenting liberalism as a conservative cartoon.

The table came from this LifeHacker article by John Pozadzides and purports to show how long it would take to generate all possible passwords of various lengths. Implicit in the table’s construction is the assumption that each password takes one one-millionth of a second to produce. Pozadzides says this represents what “an average computer” can do.

I thought that was a little slow, so I wrote this program to check it out.

 1:  #include <stdio.h>
 2:  char pw[] = "12345";
 3:  int i, j, k, l, m;
 4:  
 5:  int main(){
 6:    for (i=97; i<123; i++) {
 7:      pw[0] = i;
 8:      for (j=97; j<123; j++) {
 9:        pw[1] = j;
10:        for (k=97; k<123; k++) {
11:          pw[2] = k;
12:          for (l=97; l<123; l++) {
13:            pw[3] = l;
14:            for (m=97; m<123; m++) {
15:              pw[4] = m;
16:              printf("%s\n", pw);
17:            }
18:          }
19:        }
20:      }
21:    }
22:  }

A few things to note about this program:

1. It’s written in C, a language I’ve actually taken a class in but haven’t programmed in in years. The logic of the program was a snap, and I’d even remembered the format for the for loop (probably because of my years of Perl programming), but I’d forgotten a lot of the basics. Like how to declare a string and that a program needs a main function. Fortunately, this kind of information is just a short Google away.

   So why did I use a language I’m unused to? Because I didn’t want the overhead of an interpreted or semi-compiled language. A real password cracker would certainly be compiled.

2. It’s written specifically to generate lowercase passwords five characters long. A more general program would probably use a recursive function, but I didn’t want to spend the time or effort to do that.
3. It does print the generated passwords to standard output in Line 16. Omitting that line would make the program run faster, but I didn’t think that was a fair test, as the purpose of a password generator is create a list of passwords for later testing.

I compiled the program with gcc and then timed its run with the time utility. Here’s the session on my old 1.2 GHz PowerPC G4 iBook (the dollar sign is my Terminal prompt):

$ gcc -o lower5 lower5.c
$ time ./lower5 > pw5-c.txt

real    0m8.451s
user    0m3.206s
sys     0m0.998s

Now you see why I said Pozadzides’ numbers looked slow. Even a creaking, ancient, six year old machine can whip up a list of passwords in less time than his table says.

After writing the post, I compiled and ran the same program on my 2.16 GHz Intel Core 2 Duo iMac and got these timings:

real    0m1.666s
user    0m0.835s
sys     0m0.282s

This computer—which I consider to be my “new, fast” machine, even though it’s nearly four years old—generated passwords nearly an order of magnitude faster than the “average computer” of Pozadzides’ table.

None of this is meant to dispute Pozadzides’ main point, that longer and more complicated passwords are much harder to crack. Nor is it meant to suggest that passwords have become easy to crack with modern computers. Just don’t believe everything you read, and when you can easily check something out, you should.

Don’t get me wrong; I have no problem with the main points of the articles, which are

1. Many people choose stupid, easily hacked passwords.
2. Adding a little length or extending the character set can make a password much more difficult to hack.
3. Password managers like 1Password (which I use) are a good idea.

It’s the explanation of Point 2 that I have trouble with. Here’s a table from the article (sorry about it being an image instead of an actual table; it’s an image in the original article, too).

Pozadzides says this is “an estimate of the amount of time it would take to generate every possible combination of passwords for a given number of characters” for an computer of average speed with a “reasonable fast” internet connection. The table is his proof of Point 2, but all it does is confuse me.

I’m not confused by the math; in fact, it’s the simplicity of the math that bothers me. Look at the times in the third column. Note first that the .046 in the second row is a typo—it’s supposed to be 0.46. With that amendment, the durations increase by a factor of 26 with each additional character added to the password length. This is because the number of possible n-character lowercase strings is 26ⁿ.

Similarly, the durations in the second column increase by a factor of 95 with each additional character. By “all characters,” Pozadzides means all the printable characters from the ASCII character set, which is everything from character 32 (space) through character 126 (tilde). So the number of possible n-character passwords from this set is 95ⁿ.

The change in base means that for a given password length, the duration in column 2 will be

times the value in column 3, where 0.563 = \log(95/26) and n is the password length. This is not an immediately obvious result, but it’s easy to get if you start by taking the log of the duration ratio

and then “de-logging” by raising 10 to that power.

So all the duration ratios in the table make sense.¹ But this doesn’t explain how password cracking programs actually work.

A cracking program trying to hack my GMail account has no idea how long the password is, nor does it know the character set I’m using. Does it start with a dictionary attack? If so, does it try multiple words before moving on to random strings? Does it try lowercase passwords before moving on to the full character set? If so, at what length does it stop trying lowercase passwords? Pozadzides’ simple table doesn’t get into any of these questions, which are a hell of a lot more interesting than raising 26 to a variety of powers.

Suppose, for example, that my GMail password is 5 characters long and that it’s a mix of letters, numbers, and punctuation. According to the table, it would take just over a couple of hours to generate that password. But if the cracking program starts out by generating lists of 3-, 4-, 5-, 6-, 7-, and 8-character lowercase passwords, it’ll be working for over 2½ days on those lists before it even starts making the list that will contain mine. Does that mean a 5-character password with numbers and punctuation is stronger than an 8-character password with only lowercase letters? That isn’t what the table says.

On the other hand, suppose the cracking program generates all the 3-character passwords—lowercase first, then with all characters—then all the 4-character passwords, and so on. In that case, a 6-character lowercase password would be better than a 5-character mixed password. Which isn’t what the table says, either.

Maybe there are no answers to my questions because each password cracker works differently. But I’d like to see an article—pitched to a non-expert audience like me—that at least addresses these issues.

Heltweetica is both free and open source. If you want to tweak it, you can get the source code from its GitHub repository, change it around and compile it for yourself.

I mentioned in that earlier post that I didn’t like HelTweetica’s small display font and that there was no apparent way to change it. There’s still no preference or menu option for changing the font or font size, but after nosing around in the repository, I learned that the timeline styling is controlled by a CSS file. You don’t even need to recompile to get HelTweetica to look different.

Just right click on the application and choose Show Package Contents from the menu. Open the Contents and then the Resources folders; there you’ll find the style.css file, which governs HelTweetica’s main window display. I haven’t explored all the options, but right up at the top is the body style:

body { 
    margin: 0px; 
    padding: 0px; 
    font-size: 15px; 
    font-family: Helvetica, Arial, sans-serif; 
    line-height: 1.15em; 
    background-color: #888; 
    color: #333; 
    width: auto;
}

Fifteen-point Helvetica is a little small for me, but 15-point Lucida Grande is quite readable, so I changed the font-family. Lucida Grande is what you see in the screenshot above.

Yes, there’s something inherently wrong with changing the default font of an application called HelTweetica to Lucida Grande, but I don’t care as long as I can read the tweets easily.

Unfortunately, the current version of Heltweetica requires Snow Leopard, which means I can’t run in on my iBook G4. More incentive to update Dr. Twoot.

Then today I read Merlin Mann’s post about Bill Nelson of Be Bop Deluxe and how he managed, through sheer virtuosity, to work his way through a song on a TV show after losing the tuning on his guitar through some aggressive whammy-barring. A good example of how true expertise can get you through a rough spot.

I have a similar but better example, which is the Buddy Guy story from the post I never wrote.

While in college in the early 80s, I went to a free show in the Illini Union sponsored by some student group. It was Buddy Guy and Junior Wells, who had by that time been playing together for at least 15 years.

Buddy broke a string on the first or second song, but finished the song by playing around it, instantly working out other hand positions that he could use to get the sounds he wanted. No big deal to play with just five strings? It is when those strings suddenly go out of tune, which they did when the one string broke. So he’s lost one string and he has to bend/slide/mute/whatever the other five.

When the song finished, Junior covered for him while Buddy restrung. Junior didn’t tell stories or slow down the show in any way; he just started up a song that he could carry on his own for a while. As soon as the new string was on, Buddy joined in, tuning the guitar as he played. That continued for a song or two as the new string settled in and the others readjusted as the tension changed.

Now, everyone’s seen a guitarist tweak his tuning in the middle of a song: a quarter-turn of the peg here or there. That’s not what Buddy was doing. He was cranking on those pegs to get his instrument back in shape. While playing.

There was no Tufnelesque phalanx of guitars near the back of the stage for Buddy to choose from, nor was there a roadie to hand him a replacement. Just a man who knew his business so well he could deal with it without—literally—skipping a beat. Like seeing a hole in a sidewalk and stepping around it.

In some ways, the best thing about this story isn’t Buddy’s reaction to the broken string, it’s Junior’s—the complete confidence he had that his partner could handle whatever came up. No need to stop the show, Buddy’ll figure out what to do.

I’m on my second set of Continental Contact tires. The first set, which is what I put on right after that post in June of 2008, lasted 4000 miles—about 1500 during the remainder of 2008 and all 2500 miles of last year. I thought that was pretty good, so I bought a new set at REI at the beginning of this season. I went with REI because I could order the tires online and pick them up at a local store.

A few weeks ago I had a flat on the ride into work, and decided—since I was going to be removing a tire anyway to change out the tube—to rotate the tires. Friends who don’t ride much laugh when they hear that I rotate my bike tires, but I definitely get more wear on my rear tires than front, so it only makes since to switch the tires to even that out.

After about 1500 miles, here’s the tread on my rear tire,

and the tread on the front tire,

It’s pretty easy to see the difference in tread depth. There’s still decent tread left on the rear (which had already been switched to the front by the time I thought to take the photo), but it’s definitely more worn than the front. It looks like I’ll get the same life from this set of Continental Contacts as from the last.

I’m sure the life you get out of your tires depends to a large extent on the type of riding you do and the surfaces you ride on. I’m mostly a commuter rider, so I probably do more braking and cornering than a long-distance road racer does. I also ride on a variety of surfaces. My commute is about half on asphalt, a third on crushed limestone, and the remainder¹ on concrete (not cement) sidewalks. Weekend pleasure rides aren’t too much different.

I don’t know this for sure, but I’ve always assumed that it’s the crushed limestone that does the most damage. I’m glad I found a brand of tire that holds up to it.

Originally, whosup was a one-line shell script that ran nmap with certain parameters,

nmap -sP 192.168.1.*

which told nmap to do a “ping scan” of my local network and report the hosts that respond. The reason I made a script out of such a simple command is that I didn’t use nmap very often and couldn’t remember the options from one use to the next.

Two things have changed since the last time I used whosup:

1. We now have a few Vista machines at work, and they don’t respond to the ping scan unless I run it as the superuser.
2. Nmap has been upgraded, and the current version is more verbose in its output and is in the process of changing its ping scan option.

To account for these changes and to do a little future-proofing, I changed whosup from a shell script to Perl:

1:  #!/usr/bin/perl
2:  
3:  @nmap = `sudo nmap -sn 192.168.1.0/24 2>&1`;
4:  for (@nmap) {
5:    print "$1\n" if /^Nmap scan.+?(\d+\.\d+\.\d+\.\d+).*/;
6:  }

Line 3 runs nmap as the superuser (prompting me for my administrative password) and puts the output lines into the @nmap list.

• The -sn option is the “no port scan” option used for host discovery. The older -sP option, which -sn replaces, still works in Version 5.21 but is being phased out.
• The 192.168.1.0/24 tells nmap to look at all the IPs whose first three bytes are 192, 168, and 1. Three bytes is 24 bits, which is where the /24 comes from.
• Finally, the 2>&1 is the standard bash redirection operator which merges standard error into standard output. I did this because nmap often writes messages to standard error, and I wanted the rest of the program to filter them out.

Lines 4-6 then filter the nmap output lines. The nmap output from Line 3 looks something like this,

Starting Nmap 5.21 ( http://nmap.org ) at 2010-08-19 22:16 CDT
Nmap scan report for 192.168.1.1
Host is up (0.0053s latency).
MAC Address: 00:11:22:33:44:55 (Cisco-Linksys)
Nmap scan report for 192.168.1.10
Host is up (0.0038s latency).
MAC Address: 00:11:22:33:44:55 (Brother Industries)
Nmap scan report for 192.168.1.100
Host is up (0.034s latency).
MAC Address: 00:11:22:33:44:55 (Apple Computer)
Nmap scan report for 192.168.1.101
Host is up (0.035s latency).
MAC Address: 00:11:22:33:44:55 (Billionton Systems)
Nmap scan report for 192.168.1.103
Host is up (0.27s latency).
MAC Address: 00:11:22:33:44:55 (Unknown)
Nmap scan report for 192.168.1.107
Host is up (0.27s latency).
MAC Address: 00:11:22:33:44:55 (Apple)
Nmap scan report for 192.168.1.109
Host is up.
Nmap scan report for 192.168.1.110
Host is up (0.16s latency).
MAC Address: 00:11:22:33:44:55 (Sony Computer Entertainment)
Nmap done: 256 IP addresses (8 hosts up) scanned in 10.23 seconds

which has way too much information.¹ I just want the IP numbers of the hosts that respond. Line 5 plucks out the IP numbers and prints them, one per line. The final whosup output looks like this:

192.168.1.1
192.168.1.10
192.168.1.100
192.168.1.101
192.168.1.105
192.168.1.109
192.168.1.110

A simple list of the hosts connected to the network. When I ran it at work today, I found a host I didn’t know about. Turns out one of my other partners has an old router in his office acting as hub.

nmap = commands.getoutput('sudo nmap -sn 192.168.1.0/24')

nmap = subprocess.Popen(["sudo", "nmap", "-sn", "192.168.1.0/24"], stdout=subprocess.PIPE).communicate()[0]

The main features of Elements are:

• Syncing with your computer(s) via Dropbox.
• TextExpander support.
• Character/word/line counts.
• Choice of font, font size, colors in the display.
• A “scratchpad” for easy access to disparate bits of text.

As a Simplenote user, my interest in Elements was piqued by the Dropbox support and the font choice.

When it first came out, Simplenote’s big selling point was its automatic syncing to the cloud. You could create, edit, and view notes on either your iPhone or your computer. Changes made on one device were instantly synced to the other (assuming your iPhone had an internet connection). This was a big step up from the built-in Notes app, which synced to your Mail application (!?) on the Mac (and God knows what on Windows) when you connected to your computer via USB.

But as nice as Simplenote’s cloud syncing is, it isn’t especially flexible. Initially, you had to go to Simplenote’s website to access your notes on a computer. Later, when the Simplenote API came out, certain applications—most prominently Notational Velocity—began to sync with Simplenote’s cloud services. Which was fine if you were a fan of those applications, but not so fine if you weren’t. While I appreciate Notational Velocity’s design¹, I already have a text editor running all the time and don’t need another one.

Dropbox support gives you the flexibility that Simplenote syncing doesn’t. When working at your computer, you can use whatever text editor you like: TextMate, BBEdit, TextEdit, Coda, Emacs, Vim, Ed—anything. This is why Jesse Grosjean is moving the Hog Bay fleet of apps to Dropbox from his SimpleText system. I wouldn’t be surprised to see the Simplenote folks add Dropbox support in a future version—it’s just so much easier for the user.

Elements does its Dropbox syncing very well. When you first launch the app, it asks you for your Dropbox login credentials² and then puts an “Elements” folder in your Dropbox folder. All your Elements files—and they are proper named files, not just runs of text that get their name from the first line—are synced to that folder. Save a file to that folder on your computer and it will soon appear in Elements on your iPhone.

Elements’ second selling point for me was the ability to choose the font. Don’t get me wrong; I love Helvetica, but there are times when a monospaced font is the proper choice. Tabular information, for example, is much easier to deal with in a plain text document when all the characters are the same width. This is especially true if that document is also going to be edited on my computer, where I always use a monospaced font in TextMate.

This is my one disappointment with Elements. Yes, it allows me to use Courier, but it doesn’t allow me to use Courier Bold, a font whose strokes are actually thick enough to read easily. Here’s an example of a tabular document in Elements using Courier:

OK, sure, you can read it, but the font is really frail looking. If I could only use the bold version of Courier, the display would be much improved, but there’s no Elements setting for font style.³

Also, if you look closely at that Courier document again, you’ll see that the columns don’t line up exactly; the lines with colons are a bit shorter, suggesting that the colon character isn’t as wide as the others. I don’t understand how this can be, but it’s something I’ve pointed out before, although in that case I was looking at hyphens and question marks being wider than other characters.

I’ve noticed that Courier’s column alignment changes with font size. The screen shot above is with the font size at 16 points. At 14 points, the alignment of the lines with colons is better, but the lines for the 50-meter breast stroke are a bit longer than the others

This is not, I believe, a problem with Elements. It’s a problem with iOS itself, either in its font display routines or in its font definitions. A further problem with iOS fonts is that its only monospaced choices are Courier and Courier New. I’ve complained about this before, but it bears repeating: Why isn’t Menlo on the iPhone? Apple seems to think monospaced fonts are only for programming, so why bother with them on a device you don’t program on? It should know better.

I seem to have gone a bit astray here. What was I talking about? Oh yes. Elements and Simplenote. Overall, I think Elements wins because of Dropbox and font choice. There are, however, two aspects of Simplenote that are superior and which the Elements people should consider adopting:

1. Simplenote allows you to sort your notes by creation date, modification date, or name. Elements sorts by modification date only.
2. Simplenote can recognize URLs, phone numbers, and dates and turn them into links to Safari, Phone, and Calendar, respectively. Elements can’t.

Simplenote did just announce that big changes are coming soon in a new version. Maybe that will flip the advantage back to it. Until that happens, Elements will be replacing Simplenote on my iPhone’s first screen.