3D in my browser, rendered by my browser? I gotta get this.

The Librarian Pro software I use to catalogue books

Along with this, I use a USB barcode scanner to import items by their EAN/UPC barcodes. Librarian Pro connects to Amazon’s APIs and loads book metadata based on that barcode.

The operative end of a laser barcode scanner

After importing a book, I make sure to tag it with a code of my own, specific to my collection. For that, I have these stickers:

Barcode stickers as book tags

And voila, an electronically-catalogued library of books awaits. It’s pretty easy to add location information to the metadata to help look for books, as well as generate HTML pages to show off or sell used books.

I haven’t seen anything published about this yet, but I noticed today that Windows Live Hotmail seems to be authenticating incoming e-mail using DKIM in addition to Sender ID.

Background

In the past, Hotmail has verified the authenticity of incoming e-mail through Microsoft’s proprietary version of Sender Policy Framework called Sender ID. Both of these projects were designed to verify that the computer sending the message, as identified by the originating IP address, is authorized to send e-mail on behalf of the named sender.

A typical SPF policy, specified through a TXT record in DNS, might say

v=spf1 ip4:208.97.132.0/24 -all

This means that only IP addresses in the 208.97.132.1–208.97.132.254 range are allowed to send e-mail on behalf of this domain. (The Sender ID policy would look similar, but starting with spf2.0/pra.)

Hotmail’s policy has been to verify all incoming e-mail using the Sender ID framework. This theoretically reassures users that authenticated e-mail definitely comes from the named sender, reducing the likelihood of header forgery. If an e-mail does not pass Sender ID verification (softfail) and has other signs of being forged, it will likely be classified as junk.

A valid e-mail is marked with these headers:

X-SID-Result: Pass
X-AUTH-Result: PASS

If the organization’s policy uses the strictest policy (-all), and the message does not pass Sender ID validation, and the organization has submitted its Sender ID records to Microsoft, invalid e-mail sent to @live.ca and @live.com domains are rejected. As far as I am aware, this protection is not applied to @hotmail.com accounts.

From SPF to DKIM

The problem with SPF is that it doesn’t verify much. All it tells us is that an e-mail comes from the right computer—not that an intermediate server hasn’t tampered with it. In addition, SPF only really validates the From: or Sender: headers.

Besides, many large service providers cannot implement a strict SPF/Sender ID policy because users may be sending e-mail through other servers. (For example, I might use my ISP’s SMTP servers to send e-mail from my Windows Live Hotmail address; a strict SPF/Sender ID policy would mark those e-mails as junk.)

DKIM, however, encompasses the contents of the message body, in addition to the headers. It does not necessarily require the e-mail to come from a certain IP address. Using public key cryptography, it allows organizations to take responsibility for sent e-mails by verifying that the e-mail came from an authorized source, similar to the way secure servers connect over TLS/SSL.

Implementing DKIM means that all outgoing e-mails are signed using a private key; the signatures are then checked by compatible software against the public keys published in DNS. Each domain can have multiple DKIM keys, allowing multiple sending systems to sign outgoing e-mails independently.

A sample DKIM signature looks like this:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=frederickding.com; s=google;
        h=domainkey-signature:mime-version:from:date:message-id:subject:to
         :content-type;
        bh=b3wR4p4G21l92tc0ahioopi7atMwDp2wkaQb/uOL65E=;
        b=YJ6nD3Nx5hgwRhYppb/n2g5lQxA5jzFvYEJ0dR4dtkRFv14GVJWStQXwwZryGuujC/
         v4ve5ZE3ZAEAtv5hCj99ZLAfR52rskpbitso+106M8uQvryLyuLSnX1mrk6JaDFLMr8V
         qHmCEZUF5+cnWEYSwlLo1T8hntgN28hj8OyJY=

DKIM actually requires a lot more work for organizations to implement, as it requires additional DNS lookups and (perhaps) expensive cryptographic calculations. A decade ago, it would have been unfeasible to implement this on an organization as large as Windows Live Hotmail.

Hotmail today

Today, the inexpensive cost of processing power makes it possible for Hotmail to validate DKIM. Yahoo! has been doing this since the beginning, as it was the source of this technology. Gmail, too, has been validating DKIM for some time. (Both Yahoo! and Gmail sign outgoing e-mail with DKIM signatures, and Google has made this possible through its Google Apps service for companies as well.)

While Windows Live Hotmail has always validated Sender ID, today I noticed the addition of a new e-mail header:

X-DKIM-Result: Pass

This is good news.

Conclusion

To summarize a post’s worth of babbling, this means that Windows Live Hotmail is taking additional steps to combat e-mail forgery, phishing and spam. A step forward for everybody.

Microsoft Mathematics is pretty cool. With the equation solving functionality (step-by-step solutions available for most things), calculus and parametric features (it graphs in 3D too!), this tool closely matches the functionality of Apple’s Grapher and, to an extent, Wolfram Alpha.

Download it on your own Windows computer.

Via Frederick’s Timelog (Tumblr Edition)

Primus’s site says:

As you may have heard, the Canadian Radio-television and Telecommunications Commission (CRTC) has recently approved Bell Canada’s request to introduce Usage Based Billing on wholesale Internet services.

The CRTC’s decision directly affects the High-Speed Internet services that Primus provides using Bell Canada’s wholesale Internet services. The newly associated costs to Primus make the unlimited Internet service you are now enjoying no longer financially viable. To unify its products and services, Primus will be implementing usage-based billing on all of its Internet service offerings.

As a result, the following changes will apply commencing with your February invoice:

• Your existing High Speed Internet plan will now have 25GB (gigabytes) of monthly usage included
• For the minority of customers who exceed this amount, additional usage up to 300GB will be charged at $2.00/GB to a maximum of $60.00/month. Usage in excess of 300GB per month will be charged an additional $1.10/GB.
• Additional Usage Plans can be purchased starting at $5/month for an additional 40GB

Via Frederick’s Timelog (Tumblr Edition)

Although I don’t own a smartphone, I am definitely considering an Android phone in the next 6 months as a replacement for my current LG Neon cell phone from Fido. I like the flexibility and power of smartphones on which I can install apps, connect to wi-fi and browse the Internet, and most importantly, do productive tasks like scheduling and e-mail. I also despise the carrier locks that exist on my LG Neon to prevent me from installing apps and games.

I never knew LG offered an Android device, until I found out about the LG Optimus smartphone. Running on Google Android 2.2 (Froyo), this is a powerful device with a 600 MHz processor and a 1500 mAh battery that can last up to 700 hours on standby with the 3G radio off, and 550 hours with 3G. This Android device also offers many more compatible multimedia formats than any iOS device, including the iPhone 4. As is standard nowadays on high-end phones, the LG Optimus also has a 3 megapixel camera with autofocus.

I do have reservations about this device. Its 3.2″ screen has, unfortunately, a very limited resolution of 320×480 pixels, albeit it has great colour (from the pictures and videos I have seen). I trust, though, that future generations of LG Android-based phones will have improved screens with greater pixel densities.

Fun fact: a million of the LG Optimus handsets were sold in just 40 days. It’s probably a smartphone worth considering.

The company has provided me with a 40% off coupon code valid until October 31, 2010 for one use only. Only one person can take advantage of this code!

Use the coupon code “c6zsdfdjd” at checkout to get the discount on up to three items.

Also, join in ZAGG’s Christmas season giveaway contest, with Wiis, iPads and other gadgetry.

My initial solution wasn't at all perfect, although it was still better than developing an algorithm from scratch to decipher timestamps into hour/minute/second objects and coding math.

Solution 1: MySQL's TIMESTAMPDIFF()

My first solution was to use a function native to MySQL, TIMESTAMPDIFF(). This function takes in three parameters: the unit of time in which the return value will be, and two datetime expressions.

To query whether a given timestamp was within 15 minutes (either +/-) of the current UTC timestamp, I used this statement:

SELECT ABS(TIMESTAMPDIFF(MINUTE, *********, UTC_TIMESTAMP())) < 15

It worked, but I wasn't satisfied with having an extra query just to verify a timestamp. Besides, I was concerned about speed; that one query takes about 0.004 seconds to execute, which was too much for me.

Then I discovered the native Date/Time extension, built-in on PHP 5.2 and above.

Solution 2: PHP's Date/Time classes

Note: although Date/Time has been in PHP since 5.2, I use a few methods added only in 5.3.0.

I found out that there are native PHP classes to represent dates and times, and intervals of time. This solution to checking differences is intuitive and object-oriented (although there are aliases of the OOP methods to do so procedurally). I'll talk about performance after the code.

First, I need to assert that both are in the same timezone. Since I'm using the current UTC timestamp as a reference (and have no idea whether the PHP application will run on a server where the default timezone is UTC), I need to set the timezone explicitly.

$utc = new DateTimeZone('UTC');

This object will be provided in the construction of the DateTime objects:

$now = new DateTime(null, $utc);
$given = new DateTime($yourTimestampHere, $utc);

If your timestamp uses a format that is non-standard, you may want to use DateTime::createFromFormat() instead.

Once we have two DateTime objects, the diff() method added in PHP 5.3.0 allows us to compare them:

$interval = $now->diff($given, true); // the second param means absolute difference

The return value of diff() is a DateInterval object and I use its properties to check that the difference is within 15 minutes: (this is the return statement of my difference-checking function)

// interval is 0 days, 0 hours and up to 15 minutes
return ($interval->days == 0 && $interval->h == 0 && $interval->i < 15);

Comparing Performance

I've found that the PHP code, despite its heavy use of objects, is about 4x as fast as the MySQL statement when called once during the execution of a script. When benchmarked, PHP is up to 9x faster than the MySQL query over 10000 iterations.

You can try the benchmark for yourself by loading the script at http://gist.github.com/556777 onto a PHP 5.3 server (note: you must also have a valid MySQL server configured in the script). Alternatively, the same code should run from the command line with the PHP interpreter.

Actual Deployment

Since adoption of PHP 5.3 has been slow, the Date/Time features used may not be available on the majority of production environments. The best way to deal with this is to check the PHP version at runtime and fall back to using MySQL when the version is older than 5.3.0.

if (version_compare(PHP_VERSION, '5.3.0') >= 0) {
	// PHP 5.3 code here
} else {
	// MySQL query here
	// The additional milliseconds of using the MySQL query is
	// an incentive to upgrade to PHP 5.3, especially in production!
}

(Since PHP is an interpreted language, older versions of PHP will not throw errors upon encountering unknown classes or methods inside the if block because it is never executed. To my knowledge, this behaviour is similar to using something like #if defined COMPILER_GCC in C—that block won't be executed on other compilers.)

Was this useful?

If you have other solutions, please comment and let me know! Feel free to comment if this helped you.

If you found this useful and want to receive blog posts via e-mail, subscribe! We promise not to send any unsolicited junk.

]]> http://www.frederickding.com/posts/2010/08/php-mysql-time-differences-29927/feed/ 0 http://www.frederickding.com/posts/2010/08/beware-phishing-e-mails-06910/ http://www.frederickding.com/posts/2010/08/beware-phishing-e-mails-06910/#comments Fri, 06 Aug 2010 18:53:02 +0000 Frederick http://www.frederickding.com/?p=910 Continue reading →]]>

© Allan Reyes. CC BY-NC-ND.

I’m sure seeing our Spam folder (or Junk, or Junk E-mail, and so on) fill up with useless e-mails is a common occurrence. I’ve learned to ignore it, and I almost never go into it to see if any important e-mails have been mistakenly identified as spam. Fortunately, most of my e-mail accounts don’t get much spam (< 5 a month), perhaps because I switched my main account last year.

Phishing

Today, I checked my Junk E-mail folder in Outlook to find a phishing e-mail, which, like many others before it, obviously tried to steal login information by posing as the service provider.

Unlike most spam mail about pills, millions of $$$ waiting to be transferred in overseas bank accounts, or pleas for donations for some dying patient, phishing e-mails are often well-crafted and even flawless in grammar and spelling.

World of Warcraft

In this case, I got an e-mail, purportedly from Blizzard Entertainment, regarding an account lockout. Tech-savvy users immediately look at it with suspicion, but I’m not so sure about the millions of people who have fallen for phishing scams and paid towards a million-dollar industry.

Notice the links to a fraudulent domain

Of course I wouldn’t fall for something like this. First, I don’t play World of Warcraft, nor any video games, really. This makes no sense to me because I don’t have, and never had, a Battle.net account.

Giveaway headers

Additionally, the headers were revealing:

X-AUTH-Result: NONE
...
X-Originating-Email: [xxcipherxx@hotmail.com]
Return-Path: xxcipherxx@hotmail.com
...
Received: from ri ([222.69.163.30]) by BLU0-SMTP81.blu0.hotmail.com over
TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
...
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512

This would explain why Outlook, or Hotmail’s SmartScreen junk filtering feature, placed it in the Junk E-mail folder; it originated from a Hotmail user, using Outlook Express, posing as a user @blizzard.com. Most likely it comes from a botnet or otherwise malware-infected PC.

Bad link

On top of all that, the links don’t point to Battle.net; they link to a domain (restoreaccount.us — visit at your own risk) that is not, at the moment of publishing, recognized by Firefox or Chrome as a phishing site. (I’ve submitted the link to Google’s Safe Browsing system.) This means that most users won’t be automatically protected against losing their accounts to this phishing attack.

I dug deeper to look at the domain registration information for this domain. What if restoreaccount.us was some generic service used by large companies to facilitate user management? (Yeah, right.)

The registrant claims to be the Government of India. ???

Since phishing is considered fraud, I wasn’t expecting the domain registrant to post his real contact information. To misrepresent oneself, however, on WHOIS contact information is cause for revocation of the domain. While it may be difficult to track down and prosecute fraudsters for phishing (or for impersonating the Government of India), it may be far easier to shut down such operations by disabling their domains through ICANN.

.us domain registration rules

The .us TLD has specific rules restricting registration to permanent residents of the United States, corporations in the United States, and foreign entities pursuing lawful activities in the United States. Supposing the above registrant information to be true (which I doubt very highly), it would not meet the requirements of the .us TLD rules, and could be terminated quickly. If it’s not true, then false registrant information is still a cause for termination.

Why am I even bothering to post about this?

First, you’re still reading this, so it doesn’t really matter why I decided to write it. Secondly, I wanted to dig deeper and reveal the (poorly) hidden workings of a phishing scam. Thirdly, there are, unfortunately, a lot of people out there who simply don’t understand these attacks and are defenceless against them.

I posted last year about another scam: the Domain Registry of Canada. That has proven to be one of the few posts that attracted a lot of hits from search engines alone, because people are searching about scams (or things they suspect to be scams). (Just to justify that post, I proudly point at the Better Business Bureau’s rating of F for the Domain Registry of Canada.)

In the same sense, I despise phishing and spam. Unsolicited commercial e-mails make up a huge portion of all e-mail traffic — 78%, as a matter of fact. It’d be great if the Internet could be cleaned up, yet at the same time I recognize the difficulties with doing so.

Since government regulation is unlikely to prevent citizens from falling prey to phishing attacks, it’s better to get these things on record and make it possible for people to find out whether they’re being scammed with a quick Google search. (I used such searches recently to avoid: 1) a telemarketing scam, and 2) a career recruitment scam.) There are sites out there dedicated to user-submitted fraud-testimonials.

It doesn’t help that most of the money lost to fraud comes from people who would probably never think to Google the e-mails they receive, or the letters they get. There will always be victims of fraud. We require awareness and education to protect everyone against fraud. I’m simply contributing, like hundreds of thousands of other tech-savvy users, to this struggle.

Synopsis

While the initial controversy about the Thesis-not-being-under-GPL issue was focused on themes and derivative works, an unclear area that probably needs to be resolved in court, it seems there is a far sounder reason why Thesis has to be released under the GPL: it blatantly copies WordPress code.

It all started with this tweet by Andy Peatling (@apeatling):

Not a clear GPL violation, because it’s extending WordPress classes, which, in effect, copies WordPress functionality into Thesis.

Code analyses

Andrew Nacin (@nacin) started going through the code of Thesis and started to make some encouraging/discouraging tweets:

I just found a line of code I wrote for #WordPress, but in #thesiswp. Funny, when I wrote it, it was under the GPL. #

And then, an initially uncorroborated claim:

This is really pissing me off. I’m up to a few hundred lines directly lifted from WP. A part of me is crushed. #thesiswp #

And then Drew Blas (@drewblas) did an automated analysis (like I suggested ) and found clear evidence of copied WordPress code:

Clear evidence of GPL code in Thesis

Impact

At this point, it seems clear: Thesis isn’t merely building on top of WordPress, it literally incorporates WordPress code through copy-paste.

That makes Chris Pearson liable to fulfill his obligations under the GPL and distribute GPL derivatives under the GPL.

Most damning

Andrew Nacin eventually found this in Thesis:

* This function is mostly copy pasta from WP (wp-includes/media.php),
* but with minor alteration to play more nicely with our styling.

GPL test case? YES.

Chris Pearson indicated during his interview that he is fundamentally opposed to the GPL and will absolutely refuse to license Thesis under the GPL. By the end of the dialogue, he was practically saying “sue me”.

Matt Mullenweg responded:

Matt: Are you saying you want to be a test case for the GPL? You want us to sue you? I mean, that would break my heart. I’d rather you be part of the family.

While the themes = derivatives basis might have been shaky for a legal trial, I think the fact that there’s copied code clearly indicates one outcome in the end, in favour of the GPL.

Temporarily back to the case for themes = derivatives

WordPress isn’t the first community to issue the directive that extensions (themes, plugins) are derivatives. Joomla! did so a few years ago (I recall because I used Joomla! before finding WordPress) and Drupal makes it extremely clear.

If this matter can’t be determined by the GPL’s applicability to themes/plugins, maybe WordPress should just re-license, starting with a future version, with GPLv3 and add a specific requirement that themes/plugins are licensed under GPL.

Background

To provide some background, WordPress is a blogging platform licensed under the GPLv2, which specifically forces all copies of a work licensed under GPL, as well as derivative works, to be licensed under the GPL:

2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:

b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License.

The Free Software Foundation explicitly addresses plugins in its FAQ, making it clear that plugins that share data structures with the main program and make function calls to each other are derivative works to which the GPL also applies.

Themes were an uncertain matter prior to last year’s legal opinion from the Software Freedom Law Center, because these works from third parties certainly build on top of the WordPress platform, but often extend it with original artwork and programming. The analysis states clearly that:

… it is our opinion that the themes … contain elements that are derivative works of the WordPress software as well as elements that are potentially separate works. Specifically, the CSS files and material contained in the images directory of the “default” theme are works separate from the WordPress code. On the other hand, the PHP and HTML code that is intermingled with and operated on by PHP the code derives from the WordPress code.

Though almost all of the other theme foundries have adopted the GPL license for their PHP code, Chris Pearson stands nearly alone in asserting the GPL’s viral clause is inapplicable to him.

Initial controversy

On a live webcast with both Chris Pearson, the developer of Thesis, and Matt Mullenweg, the founder of Automattic and the WordPress project, Chris expressed his personal belief that the viral nature of the GPL goes against his personal freedoms and rights as a developer:

Chris: One, it would require me to make a concession about something that I don’t think that I need to concede to. Why should I change? I’m protected right now. My work is protected, which it should naturally be. I want to retain that right. If I go GPL then I am ceding that right. The number one issue for me is the personal concession that I would be making. Not of any real impact to my business. I don’t want to make that personal concession, because I don’t have to. Okay?

Note: it is possible, in terms of the GPL’s legality, that Chris never had the right to prevent users from redistributing his code; if the GPL applies, a developer cannot restrict redistribution.

Matt, on the other hand, debates to defend the applicability of the GPL to themes and plugins:

Matt: … If you build a module for Drupal or a module for WordPress or a theme for WordPress or anything like that, the license says that you do have to follow the GPL. I think that it’s just a matter of choosing the platform. If you disagree with the GPL, just use a platform that doesn’t have the GPL.

I listened to all of the long back-and-forth encounter, which was interesting until Chris began to assert his importance in the community:

Chris: I’ve done great things with WordPress since 2006. I have been arguably one of the top three most important figures in the history of WordPress. You, Mark Jaquith, and myself, are the three people that I am talking about.

Wait, what? A developer whose theme accounts for such a small fraction of WordPress’s usage puts himself in the top three figures in WordPress history? Jane Wells had a similar encounter with his ego.

» See the top 10 figures in WordPress history.

Analysis of this part of the controversy

The crux of the controversy is summarized by Chris’s sentences here:

Chris: I think the license, the GPL, is at odds with how I want to distribute my software and what I want it to be. I don’t think that it necessarily should inherit WordPress’ license when over 99% of the code within Thesis is Thesis code based on the actual process of building a website.

As someone who also contributes to open source software, I can certainly understand his sentiments on the ‘infectious’ nature of the GPL, which forces derivatives to inherit the GPL. It’s pretty hard to release projects under even more permissive licenses (for example, the Apache License), or in Chris’s case, extremely restrictive proprietary licenses, when so many open source projects enforce the GPL.

That really is, though, the purpose of the GPL: to keep open source open by prohibiting its inclusion in fully closed-source or proprietary (and restrictively-distributed) projects.

Are themes derivative works?

A lot of the open source advocates and lawyers seem to think so. After all, themes do things like:

<?php if ( get_comment_pages_count() > 1 && get_option( 'page_comments' ) ) : // Are there comments to navigate through? ?>

and

<?php if ( $wp_query->max_num_pages > 1 ) : ?>

which show clear integration with WordPress core functionality, much like a program in C would use the MySQL library with

mysql_real_connect()

Granted, the MySQL developers explicitly allow derivatives to use non-GPL licenses even though MySQL is GPL, through an additional license exception. The reason such an exception is necessary is that they understood that works which link to library code are derivatives.

The biggest problem is that the GPL was written with compiled code in mind, where derivatives would have to bundle the libraries (e.g. DLLs or SOs) in their releases. It’s sort of unclear for interpreted languages like PHP; is it an indication of derivation if one piece of code makes a function call to another?

It’s a bit unfortunate WordPress wasn’t licensed under GPLv3, because version 3 is much clearer about what it means to make a “modified version” or a work “based on” another work. It would also make for a better court case.

Caleb Jenkins (@CalebJenkins) iterates an interesting point: dependent != derivative. While I can see this being an interesting legal argument, it would have a lot of implications for open source in general, completely contrary to the way things have been operating.

If using a dependency is not being a derivative of that work, then it is conceivable that one can produce a C application which links to a GPL library (for example, the FOSS-licensed version of the MySQL client library) without bundling it and is released commercially under a closed-source, restrictive license. It is conceivable that a PHP program might require() WordPress to use its functionality, but simply not bundle WordPress, and would then avoid classification as a derivative.

I’m afraid I can’t entirely lend my support to that argument.

People have argued that making function calls to WordPress is akin to making system calls to the underlying operating system. Unfortunately, only GPLv3 is clear about distinguishing the system and compiler libraries from other general code; of course it doesn’t make sense that every application on the GPL Linux kernel must be open source. It’s a valid argument.

However, I agree more completely with Matt’s contention that a dependency = derivation when it gets to the point that a WordPress theme without WordPress will not work (just try loading any theme’s index.php in a browser) while WordPress without any themes will still function — it won’t show anything, but its backend is still fully functional.

Chris Pearson is wrong when he says “I think that what I’ve done stands alone outside of WordPress completely.” Interestingly, read the context of this quote:

Chris: How is that? I think that what I’ve done stands alone outside of WordPress completely. Why should I respect that? It’s not that I don’t respect WordPress. I do. I only build on WordPress and push people in its direction…

» Now here: Part 2 of Tracking the #thesiswp matter.

» Also read: Why WordPress Themes are Derivative of WordPress by Mark Jaquith (@markjaquith), a lead developer.

I’ve been using a subset of the new Essentials suite (beta) for the past few days. There are good things, and there are bad things. In this post, I’m only going to focus on the new Windows Live Messenger, about which I have numerous complaints.

Overall UI

Messenger has been cleaned up a lot since the previous version. The look is brighter and simpler — I dare say, cleaner. Microsoft went with a simple, bright white look instead of the faint blue gradient that was featured in Wave 3.

Full (social) view

The default look in Messenger is a large window showing contacts on the right and a wall of updates on the left relating to status messages and social networks. Windows Live profiles can now aggregate content from Facebook, Twitter, Digg, other networks, and even RSS feeds, and this full view seems to support Facebook and Myspace.

The full view takes up a lot of space with things I could care less about

I dislike this view a lot, because in my mentality, Windows Live Messenger is an instant messaging application; I could care less about status updates. Certainly, I do not want status updates to take up more of my screen real estate than my contact list. Of course, if you link WLM to Facebook, you get a slightly more useful updates as follows:

When Facebook updates are shown, the space is used more effectively

As a result, I use the compact view. There is a button in the main window to switch between the two views.

Use this button to switch between views

Compact view

This look is more akin to the old-fashioned contact list we’re familiar with. The view here, of course, is customized to my liking. While I appreciate the no-nonsense look here, the ads at the bottom are just slightly distracting and annoying.

Compact view is essentially the traditional contact list

One of my minor complaints about the new look is the coloured ring around the display pictures of contacts. In previous versions of Messenger, they were bright and distinguishable. Now, it’s rather difficult to distinguish the green of ‘online’ from the blue of ‘offline’ and the orange of ‘away/idle’ from the red of ‘busy’.

The faint colour of these rings is difficult to scan quickly

Tabbed chats

This is one of the best innovations in this version of Messenger, and it conveniently eliminates the need for unofficial hacks like Messenger Plus (although Messenger Plus is still useful for encrypted chat logs, which Messenger does not support to this day).

Chats with new messages flash in a highlight colour

Unfortunately, I don’t seem to be able to drag a tab and detach it from the window. Ars Technica reports that it is possible to do so only by right-clicking a chat and choosing to undock it, but it is not possible to then combine undocked chats to create separate windows for separate categories of instant messaging dialogues.

Windows 7 integration

It was extremely annoying in Wave 3 that Messenger was identified as 2 windows by the taskbar (and by the Flip 3D window switcher). Wave 4 has fixed this issue and added better taskbar integration, with coloured icons to change one’s status.

Windows Live Messenger has better support for Windows 7's taskbar

The right-click menu on the taskbar icon in Windows 7 also has quick options to start chats with favourite contacts, sign out or exit the application. This is really useful when the main window isn’t open, and is also a quick way to terminate Messenger (there’s no Exit option in the File menu of individual chats).

Windows Live Messenger Wave 4 has a capable and useful right-click menu on the taskbar

Critical changes that may make me stop using Windows Live Messenger

Handwriting

In previous versions of Messenger, there was always a Handwriting tab in instant messaging chats so that one could quickly and conveniently send ink messages. I don’t think anybody uses it nowadays for handwritten messages (considering the small number of Windows-based tablets in the market) but it has come in quite handy for mouse-drawn sketches.

I’ve used it extensively for illustrating simple graphs, diagrams, or even flowcharts. Example: curves in economics:

Windows Live Messenger used to support handwriting / ink messages

Not having this in Windows Live Messenger Wave 4 means: not only I can’t send them, no one can send any to me — even if they really are just sent as images.

Update (June 27): there’s a thread on one of Microsoft’s sites where this is discussed; a Microsoft representative explained why it was removed.

This is inconvenient to the point that I need to draw things in Paint and send them over photo sharing or look for 3rd-party online whiteboard tools.

Link redirection

This is the biggest issue I have with Wave 4. It seems that clicking on links in Messenger chats sends me through a transparent* redirect through a Microsoft-owned domain called rdir.us. Generally, it turns a hyperlink like http://www.google.ca/ into something more like http://rdir.us/?l=http%3a%2f%2fwww.google.ca&h=P7EAwkjXoRug38Nw8P6JID7b86dBALSnm4DSbAQcGQs%3d&p=1.

* transparent only in certain instances. On other occasions, harmless URLs (like this one) have an intermediate page: (all of the following screenshots are from Mozilla Firefox)

This is an annoying instance of unwanted interference

I can understand why this redirect may be necessary. For example, when I click on a malicious link, the redirect prevents me from going through and instead shows a warning screen:

rdir.us blocks me from visiting an unsafe URL

However, this is worrying for a few reasons. First, I have no idea what that hash in the URL is; does it identify me or the person who sent the link? Secondly, is Microsoft logging all the click-throughs, and knowing what sites users visit? (I suppose they could do this already by keeping records of all instant messaging chats, but this takes it even further.) Thirdly, why is this redirect necessary, if most modern browsers (Firefox, Chrome and even Internet Explorer) already have this filter?

I don’t want Microsoft to intercept my visits, nor show me a Bing search bar whenever something breaks.

Shameless promotion of Bing.

Conclusion

While I readily admit that Windows Live Essentials Wave 4 has made strides forward in certain areas, like integrating social networks, I also think Microsoft has made some pretty notable blunders in their conscious decisions to add link redirects and remove handwriting support. If you want to avoid these things, it looks like you need to stay on older versions of Windows Live Messenger.

For more reviews, read Ars Technica on Messenger Wave 4 or Paul Thurrott’s Supersite for Windows.

There are so many computer features that we’ve become accustomed to. Who hasn’t used Ctrl+F to search for text on a Web page or a document? Who hasn’t used Ctrl+C & Ctrl+V to copy and paste something? (…obviously, I’m not targeting people who have never used a computer before, or who manage to use them without a keyboard)

If you could have any of these keyboard shortcuts as a real-life (super)power, which one would you want? Vote below.

So far, the results have been interesting. Looks like most people don’t want to deal with real life.

Technology

Windows has entered a new era

The decade—indeed, the century—began with Windows 2000, which I consider the first great version of the operating system. XP was the version that brought widespread success, and people just seem to refuse to upgrade; even today, almost three quarters of the computers on the net are on XP.

Despite the dismal failure of Windows Vista, it too brought change, which was followed by the enhancements of Windows 7. Compare my desktop today to the ugly screens of a decade ago:

Apple deserves an honourable mention for the ground-breaking work they’ve done on the Mac, elevating it to a newly trendy status.

Portable media players have completely changed

A decade ago, CD players and tape-based Walkmans were still the norm for ‘portable’ audio players. The iPod, launched in 2001, entirely changed the game. (I suppose this and the iPhone were the “comeback of the decade”.) It was no longer a device that played removable media. That was followed by thousands of other portable media players, to which the public generally refers inaccurately as “MP3 players”, reflecting the popularity of the 15-year-old MP3 format that has also been notorious for illegal file sharing (see below).

Cell phones and mobile devices have become ubiquitous

These devices used to be ugly, huge and heavy objects. As we move into 2010, cell phones have become more compact (usually this means thinner and lighter) and more powerful.

In China, about 739 million people have cell phones; that’s more than there are Internet users in China (which is about 360 million).

Mobile devices have become truly powerful. The iPhone, purportedly the most popular cell phone of 2009, is one of the biggest platforms for software development. And it has a touch screen. RIM’s BlackBerry, initially launched in 1999, is the most popular smartphone among business users.

Ordinary people begin to embrace ultra-portable netbooks for lightweight computing. The move to mobile is probably the most noticeable trend in end-user gadgetry in this decade.

Illegal file sharing has emerged

I don’t personally think of torrenting itself as a major problem, and it’s difficult to sympathize with big companies when the RIAA is being stupid. At the same time, it’s pretty easy to see how having hundreds of movies, TV shows and music albums distributed through torrents can take away from earnings for content producers. (Some dispute this and argue that those who pirate movies and TV shows are those who will purchase related memorabilia or boxed sets.)

In any case, it is virtually undisputed that new technologies have made distribution of such content much easier. In the previous decade, pretty much everyone was on dial-up Internet and only the students at universities with blazing connections were able to do it (think about the controversial Napster).

YouTube happened

YouTube and hundreds of other video sites have revolutionized the way we watch video. What used to be distributed on tapes and discs has moved onto the Internet in a way that allows ordinary folks—not videophiles or geeks—to share their multimedia with the world.

YouTube is also the icon of the so-called Web 2.0, which is oriented on user-generated content. (Flickr deserves an honourable mention for high quality pictures, just like Vimeo for high class videos.) It has made it possible for teens with crazy personalities and high-pitched edited voices, artists who post music videos, and crazy dancers who travel the world to reach out to a vast audience. Above all, it’s a legitimate new form of entertainment.

Following the success of online video, major content producers began to license music for online distribution (think Pandora or Last.fm, not to mention Internet radio) as well as movies and TV shows (think Hulu).

http://www.youtube.com/watch?v=dcLMH8pwusw

Open source projects have become worthy challengers

More than a decade ago, in 1996, the Apache HTTP server became the most popular web server in use; today it has surpassed 100 million web sites served.

Mozilla Firefox, having risen out of the ashes of the Netscape browser, although not the most widely used browser in the world (it’s 2nd), is apparently used by 32% of the market analyzed by StatCounter.

While I still use Microsoft Office, OpenOffice.org is also a notable alternative to the proprietary and dominant office suite, especially on non-Windows operating systems.

And then there are the programs used by geeks, like the Eclipse IDE or Aptana Studio, that are depended upon. (For all of you multimedia geeks, there are open source programs that do the job much better than their closed source counterparts; think about Handbrake, VLC…)

Businesses can now also depend on open source projects like Sugar CRM that build their revenue model around support and premium features.

News has moved onto the Web

My primary news source  now is the Web. Google News is one of my frequently visited sites, as it is a fantastic aggregator of headlines. I subscribe to e-mail summaries from the Toronto Star and breaking news alerts from the New York Times. ArsTechnica and TechCrunch are my sources for technology-related news, and occasionally Mashable and Neowin. Those pesky short links in the tweets of people I follow also make for engaging news articles.

Wikipedia happened

At the beginning of this decade, I was researching in books and print encyclopedias. The conventional wisdom today of “just Google it” didn’t work so well then. And certainly there wasn’t a Wikipedia for the wealth of human knowledge that it now contains.

Today, I can near-instantly read up on the history of Wal-Mart or read up on the Beslan school hostage crisis and its media coverage. If I truly need it, Wikipedia connects with Wikisource, the free library and Wikibooks where I can read Anna Karenina online (and I wouldn’t, because Constance Garnett’s translations are really lacking).

It’s truly amazing that the sum of all human knowledge can be collaboratively archived and updated through the likes of Wikipedia. Perhaps they need your support this holiday season!

What do you think? Did I miss out on something big that happened in this decade in the world of tech? Write a comment!

(I did, however, intentionally exclude social networking—i.e. Facebook—because I don’t think it’s been revolutionary in any major way. Sure, it has connected people in new ways, but it’s still relatively fresh and more time is needed to see where it goes. Similarly, I omitted touch because it hasn’t entirely caught on yet; tablet PCs were a dismal failure a few years ago and I haven’t yet seen their widespread success. Furthermore, I omitted cloud computing because it doesn’t directly affect a large number of people. Feel free to disagree with me in the comments.)

Worldly Matters

I think September 11, 2001 marked the start of a new era of warfare and international affairs. The terrorist attacks, inasmuch as they have been abused to justify ill-advised battles, did shock the world.

I recommend you head over to the Big Picture where you’ll be dazzled by splendid photos of this decade, including commentaries on the World Trade Center attacks and war. And dozens of other things like natural disasters (remember Katrina, or the Sichuan earthquake?), the Beijing Olympics, and terrorist attacks in London.

2009 has been a fantastic year. I look forward to the future.

Happy holidays and all the best in 2010!

Free 2GB cloud storage

As a free user, you get 2 GB of space to start, and files in those 2 GB will be synced not only to your other computers, but also to the cloud. You can access those files anywhere you can open up a browser to the Dropbox Web site, and you can even share links to files in your Public folder to help collaboration with others.

PCs, Macs, Linux and the iPhone

The desktop software works on PCs, Macs and Linux machines; updates with great improvements come out often. For example, some of the recent versions of the software added LAN syncing, which speeds up the sharing of files between computers on the same network by connecting directly to one another instead of uploading and downloading from their servers in the cloud. Moreover, there’s now a Dropbox app for the iPhone that syncs your files on the go.

Free extra 250 MB

Try it out for free; there’s no cost to getting started. You can get a free account (2 GB) with 250 MB as a gift from me for signing up. Reliable sync and backup has never been easier.