Ronald S. Bultje

I’m in the process of writing a pair of applications that allows two hosts to interact. The idea is that one application (the “server”) would run on any desktop computer, propagated by Bonjour/Zeroconf (?), and the other application would run on a cell phone (iPhone, Android).

How, then, do you authenticate the cell phone? A question as simple as this has kept me busy for three straight days and I can’t find a good answer to it. Ideally, the service would be installed as a package (on OSX) and there should be no user interaction at that stage, and the service would continually be available through launchd (like inetd). Authentication-driven authorization is needed because other users would be able to maliciously connect to the service while you don’t want them to. That, then, gives us two goals:

1. When the user itself is requesting authorization, it should be as easy as possible on both the desktop and server side
2. When a malicious users is requesting authorization, then the authentication mechanism should automatically reject the connection, without any interaction on the desktop. I might at this point be writing an important document and would not want to be disturbed with silly dialogs saying “would you like to authenticate this user”.

So how do you implement authentication over a network that meets both of these requirements?

• I am considering using the password of the currently logged-in user on the Mac as key for authentication. However, I have yet to find a way to actually check a password for validity in Mac OS X. Its security model (rightly so) places actual authentication in a process separate than the running application (securityd and Security Agent), which means that I can’t do my own version of that. Of course, the password would be sent encryptedly over the network.
• I could use a separate password, but then the desktop-service would require configuration, which sucks.
• Bluetooth pairing-style authentication/authorization involves actual interaction, violating condition (2) above.
• You could pop up a dialog on the desktop asking the currently logged in user if it’s OK for the iPhone to connect, but that again sucks for the reason given in condition (2).

Dear lazyweb, any ideas?

Are you proficient in C, interested in highly technical problems and do you want to learn more about multimedia and free software while earning $4500? Apply as a student for one of the FFmpeg projects in the Summer of Code program, sponsored by Google! Over the past years, this has resulted in highly popular and succesful projects such as the VC-1/Windows Media Video 9 decoder and the Realvideo-3/4 decoder, which are now used in multimedia applications all around the world.

Are you ready to be the free software world’s next multimedia-hero?

The rocking guys at FFmpeg have just released version 0.5, the first release in eons! Congratulations!

You don’t know what FFmpeg is? Go read about it on Wikipedia. For most people, FFmpeg is what provides the horsepowers to their media applications, in the form of codec and format implementations, and as such it acts as a critical cornerstone of better-PR’ed projects such as GStreamer, Mplayer, Xine or VLC.

Dear lazyweb,

I – being a developer – like to send patches (“.patch” files) using GMail to a mailinglist. My peers will want to read these patches, and thus I’d like to associate a content-type (or mime-type, or file-type) with these patches so that in email clients, it’ll be opened in a text editor, or GMail with show a “View” link. The normal content-type for this is text/plain, so in past versions of Firefox, I used the MacOSX MisFox preferences pane to add a content-type “text/plain” for files with the extension “.patch”. Worked great.

However, this stopped working after an upgrade of Firefox. I used to send emails with an attached “.patch” file, and GMail would show a “View” link. In my current Firefox, this “View” link is still there for old emails. However, when I send new emails with “.patch” files attached, the “View” link is not there. It seems that while sending emails, my Firefox misdetects “.patch” files for something else. My only available action is “Download”, which (when pressed) tells me it is not a “text/plain” file, but a “Patch file”.

This name “Patch file” occurs in the Firefox “Preferences -> Applications” window, for “text/x-diff” and “text/x-patch” files. Clients on the other side of my emails, including GMail and patch reviewers, do not know these content-types and can thus not auto-view my patches in their email client. How do I permanently get rid of this content-type association in Firefox?

[edit, 1 day later] I looked at mimeTypes.rdf, and I adapted what I could so that “.patch” is now recognized as “text/plain” on downloads, but uploads still fail to display a “View” link for “.patch” files, whereas “.txt” files display the “View” link just fine. Are uploads independent of mimeTypes.rdf? [/edit]

[edit:2] From similar tests in Safari, I see the same problem. All descriptions of this problem in previous versions of Firefox are browser-specific. In other words, this might not be a Firefox-problem, it appears like Google is changing the content-type of uploads server-side. Why? [/edit]

Dear NBC, ESPN & NFL,

please fix your website, it lacks a “watch live now” button, or if it’s there I couldn’t find it even though I looked for well over 15 minutes into the match. I would’ve happily paid $5 for the match or really whatever you would’ve wanted me to pay, but I was forced into illegal crapstreams captured from Russian analog TV (or whatever) and streamed back to my friend’s NY appartment. Why do you not want my $5? Are they not sufficiently American? Are they inflating? Are they fake? My bank account and credit card think they’re real, please check them if you wish.

Please take my $5 and provide me with high-quality internet-based solutions on your websites. For this particular case, I will even accept the occasional ad in between. And please make sure it’s the top hit on Google when searching for “live nfl” and related terms – not only in search terms, but also in the ads section. Instead of that crappy Russian thing that I ran into. Also make sure payment is easy, just “credit card number”, “name” etc., verify & deduct $5 just once, and presto. Unlike these other Russian crapsites that try to sell me 3-year subscriptions for satellite-tv. Don’t try to take the Russians down. Just offer something better. It is not very difficult.

Please fix this for next year’s finals. Thank you.

Dear Russian crapchannel,

thank you for not sucking as much as NBC, ESPN and NFL.

Today, I turned 27. To celebrate, we got 5 lobsters from Chelsea market, and a big soup-pan (+/- 20L). We boiled some soup, put shellfish, potatoes and sweetcorns in it. Then the big piece:

Yes, 5 big lobsters, alive in a delicious soup. Add 45 minutes of waiting, and you end up with the following masterpiece:

Clambake lobster with crabcakes. yummy! I love birthdays. Very delicious.

I’m in Kuala Lumpur, Malaysia to visit my girlfriend’s family.

Today, we went for a touristy ride to visit the Batu Caves (which contain an in-cave Buddhist Hindu temple and monkeys), Kuala Lumpur itself and a butterfly garden. Tomorrow, we go shopping in Kuala Lumpur before heading off to the Redang resort.

FFmpeg is the project that provides multimedia codecs to your favourite media player. Be it the MPEG-4 playback in AmaroK, the WMA-playback in Xine, the H.264 playback in Totem or the playback of WMV in mplayer, FFmpeg is the reason that it’s there. Clearly, many people try to take advantage of these features and acknowledge FFmpeg for that effort.

Some, however, fail to give credit where it is due. When you notice such projects, please add them to the newly added FFmpeg Hall of Shame. Projects on this list violate the GPL/LGPL and hurt the free software ecosystem and FFmpeg. Shame on them! Help by finding more such projects or – better – by helping the FFmpeg developers to fix the violation (see ffmpeg-devel for details).