Soapbox

To consumer electronics makers

When you design remote controls, make them rubberized. The extra revenue you make from selling replacements (when the hard brittle plastic kind inevitably break) does not come close to compensating for the loss of goodwill and the sheer inventory management costs of keeping all those back models in stock.

Whither IP-based home automation?

Home automation units based on X10/Insteon or proprietary systems like Control4 or Savant start at $100-200. At a time when you can buy a fully functional WiFi router with a 200+MHz processor, a minimum 8M of RAM, 16MB of flash for under $50, why is there not a home automation system that costs $50 and uses standard TCP/IP and WiFi for connectivity?

The Wall Street Journal, unrepentant

As I was browsing through Google News, I saw some particularly acrid editorials in the WSJ. Their Op-Ed pages have been the preserve of lunatics long before Rupert Murdoch acquired them, but you would think the markets’ fiasco and the general opprobrium of discredit raining upon Wall Street would lead them to some well deserved humility.

Superlatives

The press recycles worn clichés when it reports on volatility in the markets. Last week’s 700-point drop was a “collapse” and today’s 5% drop is a “meltdown”.

I’m sorry, but 30% is a meltdown and 50% is a collapse. 5% or 7% do not rate such excessive terms.

Another reason why I build software from source myself

Some yahoo at Debian found what he thought was a bug in OpenSSL, and decided to comment out some code without having any clue what purpose it served. That purpose was to seed a pseudo-random number generator with entropy from memory, specifically /dev/random. This only broke the cryptographic security of OpenSSL on Debian (and thus Ubuntu) while being mostly undetectable. It’s quite likely attacks of the same ilk were deliberately planted by various spy agencies.

This is just an extreme example of why I prefer to build open-source software from source code myself rather than trust blindly in some packager whose choice of compile-time settings almost certainly doesn’t match mine. I have a framework of makefiles that specify how each package is built from source (meta-makefiles, really). This includes checking for new versions of the package, setting configure options and make environment variables. For instance, to fetch the most recent version of OpenSSL, all I do is make sync-openssl; make openssl then as root run make install-openssl. The maintenance burden is low as I have been assembling these metamakefiles over the last 12 years, targeting Solaris and OS X. The end-result is a deterministic build according to my specifications.

My process would not ward against a malicious attack like Brian Kernighan’s notorious trusting trust attack, but it has served me well over the years.