Bugs General Scripting

Apple MapKit JS JWT Woes

I’m just making a quick note of these two things here, as I wasted time over them this afternoon and I can come back to remind myself next time:

  • When specifying the “origin” value in a JSON Web Token (JWT), omit the trailing slash: use http://localhost:8000 not http://localhost:8000/ or you’ll get the warning “[MapKit] Authorization token origin restriction (‘http://localhost:8000/’) may not match the page origin (‘http://localhost:8000’)” and become very confused if you don’t spot that / at the end;
  • Check the warnings console, as that’s where MapKit JS sends these useful bits of advice. If you just look at errors and logs, you’ll miss them.

That’s all, folks.


Fox Escort Duties

Around 1995, I was walking home late at night. I mean late: it would have been about four in the morning. The road I was walking up was lined on the side I was on by decaying post-industrial wasteland.

As I passed a gap in a fence, a fox nipped out and started walking alongside me. I don’t know much about foxes, but I reckon it was fairly young. It walked to heel, like a well-trained dog.

I was somewhat taken aback by having this companion join me on my journey, but it wasn’t doing me any harm. So I carried on, and it carried on walking with me. I kept glancing down at it, and it seemed to be ignoring me. But it kept pace with me.

A few hundred yards up the road, there was another gap in the fence. As we came to it, the fox paused, looked up at me, and turned off, vanishing into the darkness.

I could swear it nodded as if thanking me and bidding me adieu, but maybe I imagined that.

On reflection, I think what probably happened was that this young fox had made its way over to the territory of an older fox, that being where the foxy lady foxes were. And maybe it had stayed a bit too long, and now had to get back, but knew that the older fox was lurking, intending to punish the interloper in whatever manner cuckolded foxes do: probably with lots of biting and scratching, maybe to the death.

So it waited until a human came along, knowing that the older fox would steer clear of them; and the human that came along was me, and I gave the philanderer safe passage back to its own little patch of derelict land where a factory once had been.

And maybe it did nod at me, as it glanced up at me before diving through that hole in the fence, to thank me for seeing it safely home.

Or maybe I imagined that.


Facebook Wasn’t Hacked

Much kerfuffle because some Facebook employees’ laptops picked up a virus. Facebook have posted about it and it’s a pretty straightforward tale of some laptops picking up a virus, and the company’s IT infrastructure detecting it, and making sure it didn’t do any harm. The only real news here is that, with the in-house expertise Facebook has, they could do a much more thorough analysis of the problem than most people’s employers could ever manage, and share that knowledge with the world.

But of course this is Facebook, and Facebook-the-company exists to operate Facebook-the-website, so suddenly journalists’ eyes light up with the thought of the headline: “Facebook Hacked!”

As this rather boring incident happened last month, the journalists also see the opportunity to suggest that Facebook is somehow deceiving its users by this delay in disclosure, and that all the Important Private Data of those users (which they posted on Facebook, but whatever) is somehow at risk.

This story is about as interesting as a bank employee’s laptop getting a virus, which doesn’t cause any risk to the bank’s customers’ money; or a journalist’s computer getting a virus, which doesn’t cause any risk to the people who read his stories on the newspaper’s website.

Facebook wasn’t hacked. Any reports you read saying “Facebook Hacked!” are bullshit. Somebody’s laptop got a virus. A few other people’s laptops in the same company got the virus. That’s what viruses do, and it happens every day at thousands of companies.

The fact that the company happened to be called “Facebook” doesn’t mean “Facebook got hacked”; it means you get to hear about it. You don’t get to hear about it when it happens at your bank, or the Wall Street Journal, or the Guardian, or the New York Times. It happens at those places more often than it does at Facebook, but you’re never told about that. You’re told about it when it happens at Facebook because the journalists know that putting the words “Facebook” and “Hacked” in the same headline has a Pavlovian effect on the public which sells newspapers, or at least page views, and makes their employers money.

I say again: Facebook wasn’t hacked. Some people who work there got a virus on their laptops. That’s all. It’s not news.

If it is news, we should be told every time it happens to somebody who works for a news organisation. After all, we rely on these people for accurate information much more than we do on Facebook. (Well, I do. YMMV.)

Apple General iPad

Weird iPad Bug: Audio from Certain Apps Only Played Via Headphones

This rather obscure iPad issue has been occasionally annoying me for ages, and I finally worked it out tonight.

The problem I had was that some, but not all, apps would only play audio through the headphones, not through the internal speaker. For example, BBC iPlayer would play through either the speaker or the headphones, as would Safari and the YouTube app; but some media player apps could only be heard via the headphone socket.

Perhaps the strangest was the 4oD app, which is the TV on demand app from the British station Channel 4 (C4). This usually plays a short C4 ident, then a sponsor message, then the programme. Bizarrely, with this app, the ident could only be heard via headphones, the sponsor message could be heard via either headphones or speaker, and the programme only via headphones.

This was rather annoying, as I often prefer to watch and listen to media without putting headphones on: my hearing is already sufficiently damaged from too many years of live pub bands that I only pipe sound directly onto my eardrums when I really want to.

It turns out the problem relates to the side switch on the iPad, which can be used as either an external speaker mute button or a rotation lock.

A couple of months ago I accidentally changed the settings to make this be the mute button; I normally use it for rotation lock. It turns out that, when I changed the settings back to make it act as rotation lock, I had the physical switch itself in the mute position. It seems that, when the setting was changed back, some part of the system remembered the mute setting and was using it – but only for certain apps or even, as in the case of 4oD, for parts of certain apps.

The solution? Go to Settings, General, and in the “Use side switch to:” section, change to “Mute”. Then ensure the switch itself isn’t in the mute position: you don’t have to put it there then switch it back or anything silly like that, just be sure it’s in the right place, with the protruding part towards the top of your iPad and with no orange dot visible. Then leave the settings app and switch to one of the misbehaving media players, and you should find it now plays through the internal speaker again. Finally, return to Settings, General and switch back to Rotation Lock, assuming that’s what you want.

It may be that you can just change to Mute then back to Rotation Lock without leaving the Settings app and get the same effect, but I haven’t checked. I’m just happy to have my internal speaker working again for all apps.

And now I’ve written that up, I’m going to watch a programme about a man whose home is even more messy than mine. I may even use the headphones for this one…


Steve Jobs’ Other Computer

After he was so rudely ejected from Apple in 1985, Steve Jobs created a new company called NeXT. They made a microcomputer that was way ahead of anything else. Unfortunately, so was its price tag: over $6000.

The NeXT cube was a machine for geeks to salivate over. It had a Digital Signal Processing chip onboard! Even if you weren’t quite sure what you might actually do with a DSP chip, having one surely had to be better than not having one. It had a magneto-optical drive, capable of storing 256MB of data on a $50 cartridge. It had Display PostScript, which gave you device-independent rendering, which sounded pretty good in a world where you tended to have to figure out how bits and bytes mapped to pixels if you wanted to get something on the screen with any degree of rapidity. And it had a load of other stuff that sounded really cool, even if you weren’t quite sure what to do with it (TCP/IP? Has a slash in its name, must be a Good Thing).

I first found out about the NeXT cube in the November 1988 issue of Byte magazine (of blessed memory). I have a vivid recollection of reading the review: I consumed all eleven text-heavy pages, plus photos and diagrams, between four and five o’clock of a Sunday morning in a bitterly cold waiting room at Birmingham New Street station, where my girlfriend and I had accidentally ended up after falling asleep on the last train from Nottingham to Leicester. (Yes, we’d been in the pub. Almost all day, actually.)

At that time I was making a modest living coding game conversions, and could only dream of being able to afford several thousands of pounds for a computer (some things never change). Yet now, I am typing this on a descendant of that machine, while occasionally checking Twitter on another descendant, and hoping that a third descendant doesn’t ring: for my MacBook, my iPad and my iPhone all run an operating system descended from that on the NeXT cube.

In fact, writing this post is a way of procrastinating when I should really be working on an iPhone app, using Apple’s developer tools – descended from, yes, the very development environment that I found so exciting when I read about it twenty-three years ago in that freezing railway station.

Only yesterday it occurred to me that I should dig out that old copy of Byte magazine and re-read their review of the NeXT cube; the constant use of classes whose names begin with “NS” tends to make me think back to that chilly autumn night. Then, in the early hours of this morning, I discovered (via my iPad) that Steve Jobs had died.

This sad news has inspired me to scan the review and put it up on this site (links are at the bottom of this post), so others can read it and maybe get some idea of the excitement a twenty-something software developer felt all those years ago. If you have difficulty imagining that feeling, well, you shouldn’t, as it was just like the excitement we’ve felt at so many new Apple products over the last decade. For the NeXT cube isn’t just a dusty relic of a long-since-vanished company: it was the precursor of the modern Mac, and of the iPhone and iPod Touch and iPad. A fundamental part of all these wonderful machines descends, not directly from the machine that was advertised by Apple Computer in 1984, but from the machine I couldn’t afford in 1988.

P.S. Although I never got to play with a NeXT, other people did. They included Sir Tim Berners-Lee, who used one to implement a bright idea of his called the World Wide Web. So it’s not just the computer on which I write this that came from Steve Jobs’ NeXT, but also the medium in which I publish it. It really was a pretty cool machine 🙂

Thumbnail links to individual scans

All scans, compressed (~60MB)


A minor point concerning the Norwegian tragedy

Words are too small to express one’s feelings about the hideous slaughter in Norway. Rather than trying to address tragedy on such a scale, I shall focus on a minor point.

Anders Behring Breivik has, as I understand things at the time of writing, freely admitted responsibility for this appalling event. His lawyer has, I further understand, confirmed that he is the author of the work 2083 – A European Declaration of Independence, published online under the Anglicised name of Andrew Berwick. It seems that he has perpetrated this dreadful crime for the purpose of promoting this work.

There are certain obfuscations about the presentation of the work, which was initially circulated by email to his Facebook friends, and friends-of-friends. The most obvious are the Anglicised name and the assertion that the book was published in London, when it is actually the work of a Norwegian publishing from Oslo. I assume that these obfuscations were inserted as a way of ensuring that his identity remained secret until he chose to reveal it in the way he did.

But there is one little detail revealed by its absence. It is said that somebody who wishes to avoid drawing attention to something may reveal that wish by failing to mention that something when it would be perfectly natural to do so. Breivik seems to have succumbed to this simple psychological trap in his attempt to conceal the place of origin of his work behind the veil of England.

In his introduction he signs off (as Andrew Berwick) with the words:

With the assistance from brothers and sisters in England, France, Germany, Sweden, Austria, Italy, Spain, Finland, Belgium, the Netherlands, Denmark, the US etc.

Do you notice anything about that list of countries? With the exception of “the US” they are all European. In fact, they cover Europe from the Atlantic to the Baltic. Yet one in particular is missing; one that might be expected to appear, given that Sweden, Denmark, and Finland are all mentioned.

The only Scandinavian country not mentioned is Norway. Exactly the one you’d miss out if you were lying about where you were, and where you were was Norway.

I’m not trying to suggest anything about this other than the fact that, with hindsight, we can see a classic signal of somebody trying to conceal a truth. Breivik claims to have spent three years, at a personal cost of €317 000, in writing his work; yet for all his obvious intelligence, dedication, and cunning he was unable to avoid one of the most basic traps our own psychology lays for us: compulsively avoiding saying something that could get him into trouble, even though he would be more likely to deflect attention if he said it openly.

This is one of the ways our mothers can tell that we are lying when we are four years old, and juries can tell that we are lying when we are forty years old.

Of course, even if one of the few early recipients of Breivik’s work had noticed this anomaly, they could not have predicted the enormity of his intentions. It might have provided a momentary intellectual frisson similar to solving a crossword clue: “Ah, he’s probably Norwegian really!” But it’s not as if this knowledge would have made it possible to prevent the tragedy; we can never conceive of such enormity until after it has been perpetrated.

I only mention this as a psychological curiosity: a man so fanatically dedicated to his cause that he will plot to murder, not just by the indiscriminate method of bombing but by personally shooting children by the dozen, and can intellectually justify this to himself as necessary for promoting said cause, is nonetheless unable to lie in a document to which he has devoted three years of effort without betraying the truth by omitting the one name he knows others must not know.

Apple Macintosh Malware

In which I play with fire, aka Mac Protector

There is much brouhaha and kerfuffle at the moment about the fact that malware for the Mac has finally arrived in strength. I’m not sure why anybody is surprised; we knew this day would come and, more importantly, we knew it probably wouldn’t be as bad as things were for Windows users in the days before XP SP2.

(tl;dr: here’s what you can do to avoid or cure the problem.)

Out of a sense of duty to the Mac user community – well, more accurately, because I was looking for a way to avoid working on anything useful – I took it upon myself to locate one of these pieces of malware and have a look at what was going on. It didn’t take long to find a link to a site hosting Mac malware posted in the Apple support forums (which, in turn, I found via the ClamXav forums), and I was able to get procrastinating.

The page I went to (which I will not link to, obviously) presented me with a screen that made a rather pathetic attempt to look like a Finder window, and displayed an animation that looked like it was performing a virus scan; this is what it looked like once the not-actually-a-scan was finished (n.b. these screenshots are links to the full-size version):

Web page resembling a Finder window showing a fake virus scan

There was one thing very obviously wrong about this: it used the font Arial, rather than Lucida Grande which is the default Mac system font. Given Arial’s total lack of resemblance to Lucida Grande, this meant it looked like pants.

In addition, the left column did not reflect reality: the name of the hard drive was the default “Macintosh HD”, and the list of folders below that was not the list I have. (I see however that Dropbox is now so popular that it found its way in there… or maybe this reflects the machine of the person who created this thing.)

And, of course, there’s the lousy grammar in the pretend dialog box.

In fact, this page was nothing but HTML, CSS and JavaScript. However, in addition to showing off this fancy animation, it also downloaded a file called “”. In fact, it downloaded this as soon as the page loaded; the animated “scan” merely served as a distraction from this activity, although in my case the payload had completed downloading before the “scan” was even 32% complete. A bit sloppy IMHO – it should have made a song and dance about performing the download after the scan was complete.

However, one important point is that I have disabled automatic running of downloads in Safari. In a default configuration, this file would have been unzipped and its contents executed automatically. (See below for details of how to disable this.)

One further point to note was that the payload was apparently delivered from the future:

Finder file listing showing a creation date of 'Tomorrow 00:33:58'

Subsequent visits to the site have resulted in files dating between around one hour and five hours in the future; this could reflect the file being hosted in a number of different places around the world and having the date it was uploaded to the server from which it happens to be downloaded, but could also imply that the file is being modified in an attempt to avoid detection by Mac anti-malware applications such as ClamXav.

Upon unzipping this file, a Mac installer package was revealed:

Finder file listing showing MacProtector.mpkg

Odd points to note: the creation/modification/last opened dates of 11 May 2011 are eight days before I downloaded this, which might mean that was in fact the last time the file was modified. This would suggest that the varying creation dates of my multiple copies of the payload reflect redistribution to different servers rather than modification of the software.

Anyway, an installer is no fun unless you run it, so here goes:

Screenshot: standard Mac installer titled 'Welcome to the Mac Protector Installer Program installer'

It turns out that the variant I’ve snared here is Mac Protector, which is interesting, as the forum link I originally followed said it was to Mac Defender, the other piece of malware that has been going around. The fact that a site that was serving one of them has switched to serving the other might be construed as implying that they are both under the control of the same entity, although it does not actually prove that.

What we have is a standard Mac installer; so standard that they haven’t even bothered to create their own artwork to go in the background. The heading “Welcome to the Mac Protector Installer Program installer” is also sloppily constructed – it should just read “Welcome to the Mac Protector installer”.

I’ll click “Continue” so you don’t have to:

Screenshot: standard Mac installer claiming to need 2.9 MB of space

The installer has skipped the installation disk selection screen (although this is available via the “Change Install Location…” button), and gone straight to wanting to install on the main hard disk in my MacBook; it will require 2.9 MB of space.

Let’s click “Install” – but only after bringing up Activity Monitor and carefully positioning it next to that window, with the installer app selected so that I can hit “Force Quit” quickly if my gamble doesn’t pay off:

Screenshot: standard Mac installer overlaid by standard password prompt

Phew, it was the red wire 🙂

I was quite relieved, and reassured, to see the password prompt: clearly this thing cannot do any harm unless explicitly allowed to. The real problem is that Mac users have not yet been educated to beware of this kind of thing.

I stopped here, for obvious reasons 😉

tl;dr. So what do I do about it?

The first thing Mac users can do to protect themselves is to disable automatic execution of downloads by Safari. (People have been telling Apple this for years, but do they listen?) Go to the Safari menu (up there, by the Apple icon) and select “Preferences…” then select the “General” tab. Now, look at the bottom:

Screenshot: Safari preferences, 'Open safe files after downloading' checkbox highlighted

That checkbox labelled “Open safe files after downloading” should be unchecked, off, not enabled. Do that now.

The second thing? Learn to be cautious. If something starts screaming at you to panic, don’t; calm down and check. If in doubt, don’t install anything. If anything prompts you for your password, make sure you know exactly what it is before typing it in. Your password should only be needed for things you have actively chosen to do.

If you’ve found yourself stuck with one of these pieces of malware, don’t worry: it’s quite easy to remove. Here are instructions for removing several variants of Mac Defender and Mac Protector on the Apple Support Communities forums.

Finally: it may be time to stop sneering at Windows users and accept that anti-malware software could be a good idea. Mark Allan’s ClamXav is free, and can deal with both Mac Defender and Mac Protector. If it saves your bacon, you may want to give Mark a donation via the PayPal link on his site.

Let’s be careful out there, everybody. Oh, and lose the attitude: Windows security is actually pretty good these days. From now on, Macs are only safer if their users are smarter.


What the Web is For: “Why I Am Not Worried About Japan’s Nuclear Reactors”

This is the best explanation I’ve seen so far of the circumstances surrounding the problems Japan has been experiencing at its nuclear power plants: Why I Am Not Worried About Japan’s Nuclear Reactors.

Not linking to it would be a crime in a world ruled by PageRank. If you see this and you are able to post links on the Web (hint: you are, even if it’s just via Twitter), then do so. Ignorance may be bliss, but knowledge is better.


New From Microsoft Bing: Conditional Charity

Microsoft Bing’s twitter account today posted the following bizarre message:

How you can #SupportJapan – For every retweet, @bing will give $1 to Japan quake victims, up to $100K.

So, basically, they’re saying that they can afford to give away $100,000 to help the people of Japan in the face of the appalling tragedy that has struck them – but it’s conditional upon people retweeting Bing’s message.

Presumably, if not enough people retweet, they’ll just put the rest of the money back in the office party fund.

I assume they’re paying some “Social Media Marketing Guru” to come up with stuff like this. The mind boggles.

UPDATE, 22:50: Bing have sort-of-apologised (although it sounds a bit like “We’re sorry some of you were too dumb to grasp what we meant”) and made the donation in full.

Common sense NHS

Well, That Didn’t Hurt As Much As I Expected

Three weeks ago I was lying in a bed in the Coronary Care Unit of Glenfield Hospital, having had a heart attack (anterior myocardial infarction with severe stenosis of the Left Anterior Descending coronary artery, to be precise). I dialled 999 (the UK emergency service number) at 17:52; the paramedics arrived outside my home at 17:58. After thirty minutes or so of taking cardiograms and assessing my condition, they took me to the Glenfield CCU.

Less than forty minutes later I had received an angioplasty. That’s where they put a stent in the blocked artery and stick a little balloon in there and blow it up to unblock it. I also got to watch it in X-Ray on the monitors and listen to the cardiologist’s running commentary to his students, which was awesome: you can’t beat geeking out on somebody describing exactly how they’re saving your life in real time.

With that done I was feeling right as rain again. (Slightly righter actually, but I think that was the morphine.)

The only reason I’m mentioning this here is to let you know that if you ever have a heart attack in Leicester, you’ll be taken to the best possible place in the UK to get it fixed. The department at Glenfield is awesome, and so are our paramedics. In fact, if you suspect you might be going to have a heart attack in the near future, I would recommend taking short-term accommodation in Leicester and putting 999 on speed dial. It might just save your life.

Oh, one more reason. Those American politicians who opposed plans to reform health care in the USA were a bunch of lying shills when they denigrated the United Kingdom’s National Health Service. Less than ninety minutes after phoning for an ambulance, I had undergone an angioplasty without anybody asking me to prove that I had so much as a penny in my pocket, and was being taken to a ward where I would be cared for and my status would be monitored and I would receive whatever treatment I required and be fed and watered until I was in a fit state to leave (which was two days later). If any of those politicians wants to come over here and run down the NHS to my face, I will gladly punch them so hard in theirs that they can find out just how wrong they are at the local A&E department.

The NHS is for life, not just for politics.