James’ World

I found out about AOPA Expo 2008 at the last minute on avweb.com, and spent half a day there Saturday.

First of all, sorry to out-of-town attendees for the showery weather today. San Jose is normally sunny, but not in winter.

The Expo was 3 days (Thursday, Friday and Saturday) for $55/day including seminars and exhibits.

Exhibits Hall

The Exhibits Hall was twice as big as I expected and a lot of fun. I’m used to sparse IT conference exhibits, but aviation exhibits are a welcome relief with lots of hardware: aircraft, wrap-around simulators, parts, interior fabrics - you name it.

I only had time to spend an hour looking at the exhibits, but could easily spend a day going booth-to-booth and trying everything out.

The Cessna 162 Skycatcher in purple was on display, as well as the DJet (and a Williams engine static display) and Epic.

Frasca had a wrap-around simulator, and there was a very nice glass cockpit Cessna 172 simulator with 3 almost 180 degrees of displays. It’s available for rent in Hayward for $65/hour.

Rolls-Royce had 2 engines on display, the A300 used in the Robinson R66 helicopter and a prototype for the A400.

Noticeably absent … Eclipse did not have a booth.

I listened to 2 seminars from trainers that I haven’t seen live before, and really wanted to: John and Martha King and Mike Busch.

Pilot Risk Management, John and Martha King

John and Martha King talked about managing flying risks in a systematic fashion.

It took John a minute to warm up, then he sounded just like his pilot training tapes.

They calculate that small-time GA flying is about as risky as motorcycle operation in the US. Half the audience personally knew a pilot killed in GA.

John then went into 3 war stories: IFR letdown in a Cessna 210 with no electricity due to ignoring maintenance near St. Paul in icing, poor takeoff decision at max. weight at a high DA airport (Lone Pine, 3680′), and an unlighted flight from Big Island to Oahu over the ocean at nite (forgot to pre-flight lights for a nite flight.)

They recommend using checklist nmenonics like PAVE CARE for reducing risks.

• Pilot
• Aircraft
• enVironment
• External Pressures

• Consequences
• Alternatives
• Reality
• External Pressures

Airplane Maintenance Management, Mike Busch

Mike Busch gave an awesome talk on airplane maintenance management.

Mike is an aviation maintenance author, trainer and businessman who is famous in the GA aviation community.

His latest venture is savvymx.com, which provides professional maintenance management for owners. They represent dozens of aircraft already.

(I’ve attempted to paraphrase what Mike said below, but any errors or omissions are my fault.)

40 years ago in GA’s hayday, there was an authorized Cessna, Piper or Beech service center on every field with specialist mechanics and a building full of parts on the shelf. Now GA maintenance facilities are merely a shadow of that, unless you’re talking jets.

He recommends 5 rules/secrets for affordable maintenance:

1. Interview your mechanic/shop like you’re hiring an employee
2. Inspection, Discrepancies, Approval in writing
3. Don’t fix what’s not broken
4. Pilot needs to troubleshoot before mechanic can fix anything
5. one other …

The aircraft owner is the manager, the mechanic takes orders, and there must be a business-like relationship. Otherwise, find another shop.

However, while giving his SavvyAviation talks, he’s noticed that some people either don’t want to make the time, effort or be assertive enough to actually do the mgmt. needed.

95% of aircraft components can and should be maintained on-condition, meaning periodically inspected and replaced as needed. Examples are tires, some actuators, etc.

The remaining 5% are things maintained on a time-based schedule, like magnetos and hoses which are difficult to inspect.

When approving aircraft repairs, terminology is very important. The terms repair, overhaul and rebuild mean very different things. Normally what one wants is a repair (fix just what’s broken directly and as cheaply as possible), and not an overhaul (blindly follow an overhaul checklist from beginning to end and change and test everything, broken or not.)

He says that TBO is a psychological limit, not a maintenance one. His P210 is currently 1100 hours past TBO, FWIW.

Mike recommends using the most direct method for monitoring and troubleshooting aircraft: engine monitors, oil and filter analysis, borescope. He calls this “21st century analysis”, while old techniques like magneto RPM-drop and cylinder compression tests are “Orville and Wilbur Wright analysis.”

He uses Blackstone Laboratories for oil analysis. Unfortunately, many shops don’t have borescopes, and even when they do, nobody with training to interpret the image, since studying borescopes is not required for A&P.

In newer airplanes, there is no separation between airframe and electronics, so you need a shop that can handle integrated maintenance, like Woodgreen in SoCal.

He used a black Asus EEE PC to show his slides.

Robinson R66: a preview by Philip Greenspun, Feb. 2008
flyingmag.com: Learning to Use an IFR Rating

10 years ago, the Caltrain connected to SFO at Millbrae with a free shuttle bus that stopped at teach terminal. The friendly bus driver offered directions and assistance. No problems, unless it was raining.

5 years ago, the shuttle bus was scrapped, and the Caltrain connected to SFO at Millbrae with a $1.50 5-minute BART train that stopped at Terminal 3. The 2 ticket vending machines were often mobbed for 20 minutes. Good luck finding a live person for assistance. A hassle, but doable.

Today, the Caltrain connects to SFO at Millbrae with a $1.50 10-minute pointless BART train north to San Bruno BART station, followed by a 10-minute ride back south to SFO Terminal 3. The 3 ticket vending machines are often mobbed for 20 minutes. If you find a BART employee, they’ll say, “I didn’t design this system.” A nightmare in good weather, worse when it’s cold or windy.

I (and other passengers on the same Caltrain) missed an international flight recently because it took over 3 hours to get from San Jose Diridon station to SFO.

Although a taxi from central San Jose to SFO is $120, I have to consider that now if I don’t have half a day to waste on the trains. Cheaper than paying for trains that are misrouted and late and rebooking fees.

examiner.com: BART to halt Millbrae-SFO direct service

I attended the O’Reilly Open Source Conference, once again in Portland, Oregon.

Overall my impression was that the talks and vibe were oriented towards Web 2.0 primarily.

I would say that the talks were not as strong as previous years, but it’s easy to compensate for that with the “hallway track” and access to the original Open Source authors.

Several attendees used the EEE sub-notebook computer, and were happy with it as a email/browser tool.

Wednesday

PHP Taint Tool: It Ain’t a Parser

- CS’y effort at PHP parser for code analysis, reminds me of early days of Perl’s B tools
- not suitable for end-users

Write Beautiful Code (in PHP), Laura Thomson, Mozilla

- good general background on good programming practises
- not a lot of specifics about PHP, but available for questions

Hypertable, Doug Judd, Zevents

- HyperTable is a clone of Google’s BigTable, from public paper
- room was packed, some turned away
- still alpha, maybe beta in August
- preferred distributed filesystem is HDFS, works with others
- I recommend reading web site and then looking at the curt slides
- plans to do benchmarks with same hardware as Google has published.

Open Source Virtualization for People Who Feel Guilty About Using VMware So Much, andy michelle, EDA

- cute talk about VirtualBox, Xen and VMware
- Xen has weird nomenclature compared to other tools
- VMware wins on tools and polish
- showed screenshots of unreleased and alpha mgmt. tools.

Barely Legal XXX Perl, Jos Boumans, RIPE

- stunning and twisted example of overloading, short-circuiting, import-faking, whatever it takes to make a loaded module do something other than intended
- illustrates great flexibility of perl, for good or ill
- could be useful for things like testing harnesses, etc.
- motivated to win bet of $100 or 1 vertical meter of beer
- said it took 3 or 4 hours to complete.

I walked around the exhibits area.

Got a demo of Atlassian’s continuous integration (CI) tool, Bamboo. They’re also the vendors of JIRA issue tracker and Confluence wiki, which I’ve used before.

One company had a public Wii game happening.

Thursday

Scaling Databases with DBIx::Router, Perrin Harkins

Ultimate Perl Code Profiling, Tim Bunce (Shopzilla)

- talk and screenshots about NYT perl profiler

The New York Times Perl Profiler

Top 10 Scalability Mistakes, John Coggeshall (Automotive Computer Services)

- good overview of writing high-performance, maintainable Internet systems
- interesting opinion that scalability is not just about increasing performance. scalability can be about scaling up or down, performance or maintainability, etc.
- recommended php.ini settings list

Perl Lightning Talks

- popular with audience, attendees seemed to like all the talks
- Mail::ESMTP looks very interesting for testing and production

Code is Easy, People are Hard: Developing Meebo’s Interview Process, Elaine Wherry (meebo)

- struggled to find time, right approach to interview new candidates in 1996, likely at behest of VCs
- external recruiters hit-and-miss, conferences and jobs email link useless
- phase where non-founder employees doing interviews wanted a founder involved in interview process
- trying to preserve culture (finger rockets, social networking, 2 female founders, etc.)
- came up with process involving reading resumes, phone screens, and office “sim” that adds a new candidate within 3-6 weeks
- “sim” has 3 versions: office manager (plan to erect a meebo office sign), front-end engineer (write a JavaScript app), and back-end engineer (write a server) in 4 hours
- current goal is to keep interview time down to 8 hours per candidate over 10 days
- now up to about 40 employees
- my feeling was that their hiring process started off clueless due to inexperienced mgmt. and is still oriented towards junior engineers. Silicon Valley is full of expert engineers and it doesn’t take 8 hours to interview them.

BOF

mysql-sandbox

Giuseppe Maxia discussed and demoed his very useful mysql-sandbox utility for managing several versions and instances of MySQL on the same machine.

He wrote it for his testing work at MySQL AB. Very well received by attendees. This is a great example of what I call “anti-virtualization” - using ports instead of resource-intensive VMs.

MySQL Conference 2008 Presentation

State of the Onion Address, Larry Wall

- talk about Perl6, random anecdotes, etc.

Friday

Open Voices, Jim Zemlin (The Linux Foundation), Keith Bergelt (Open Invention Network), Karen Sandler (Software Freedom Law Center), Phil Robb (Hewlett Packard)

- panel discussion of various free software efforts, some little-known

An Illustrated History of Failure, Paul Fenwick (Perl Training Australia)

Paul gave an interesting talk on notable Software Failures and estimated a price tag for each. I had heard news reports of many of them, but it was interesting to hear an updated analysis of what really happened behind the scenes.

Thanks to Google for sponsoring the fairly good almost-gourmet lunches. Sure beats the O’Reilly lunchbags from the dot bomb days. (Everybody I know bailed and found a subway shop back then.)

Notes

- Burgerville popular with attendees, can upgrade combos to a shake.
- Red Lion hotel has a small cardio gym with 1 universal machine, no free weights, open til 11 pm
- WiFi password changed weekly, in middle of remodel, lobby just finished.
- There is a 24-Hour Fitness that is actually open 24 hours near downtown Portland. Has basketball court and 2-lane pool. $15 for non-member visitors.

OSCON 2008 Presentations

Once again I attended the Yet Another Perl Conference (YAPC), and again it was at IIT in Chicago (same as in 2006.) Josh McAdams and his wife did a great job organizing the conference.

YAPC is an affordable ($100 conference fee) organized by volunteers for The Perl Foundation (TPF).

I’m already an experienced perl programmer, but perl is a vast programming environment and one can always learn more about techniques or available modules.

After the 3-day YAPC, I went to the 2-day Perl Catalyst framework class.

Overall, I would say that the talks were not as technical as previous years, but with 3 tracks there was always something interesting.

Many people make up their own “hallway track” anyway, since most of the perl heavyweights come each year and are very accessible.

The IIT dorm was only $60/night, but even that was over-priced. Some investment is needed in maintenance, and the attendants need to actually hand out linens and control the AC next time.

Although there was supposed to be an online form to add cash to the access card, one has to go to 201 Hermann Hall while they get organized.

Here’s my notes on some of the events that were memorable:

Monday

Tiny Modules, Adam Kennedy

- no dependencies on other modules
- fast to load
- fast to run (near real-time)

Config::Tiny (popular module)
XML::Tiny
Object::Tiny
Date::Tiny

Moving to mod_perl2, Jim Brandt

- Apache2::Compat can be used for backward compatibility
- some methods have different arguments now though
- loads everything, so uses a lot of memory
- slower because some code is now Perl instead of C
- content_language, write_client, send_http_header, get_remote_addr, etc.

Porting Tools

- Apache2::Reload
- Apache2::porting

Also read your error log and the Migration manual.

Apache::Registry is now Mod_perl::Registry

Photo Processing for the Web, Kent Cowgill

kentcowgill.net

- bunch of stuff for managing cell phone photos
- speaker talked about various image processing and mgmt. problems with his old nokia cameraphone
- embed iso in a pdf
- bought a real camera, problems went away

PAR+FUSE+PDF, Chris Dolan

Tuesday

HTML::App Framework, Jim Krajewski

Catalyst, Matt Trout

- a profane overview of handlers
- 490 CPAN Catalyst modules

Catalyst Downsides

- need packager for catalyst apps
- attribute syntax
- unaccelerated CGI not great (lack of persistence, slow to start)?

Dinner and Auction

- quite a variety of food: mediterranean, italian, indian, american
- dozens of books and t-shirts to bid on
- Wii games

Wednesday

Perl Lightning Talks

swish-e

- command line search tool
- now has perl interface, solid

cons

- no utf8
- not pi
- no index updates
- swish3 should fix that

joshr.com/src/docs
linux journal

where2getit.com
- AJAX maps with mod_perl
- openlayers, prototype, scriptaculous
- rewrote 100kloc old perl app into 22klog perl plus JS

Chemchains Sandbox

- boolean logic to understand and visualize myriad possible chemical reaction pathways

Math::Combinatorics

- works at bookfinder.com
- generate test data on authors using perl, then test clustering techniques

Devel::Cover::TT

Ingy strip show

Do You Believe in the Users?, Brian Fitzpatrick and Ben Collins-Sussman

- slide deck suggesting that developers focus on end user experience
- interesting graphical line added to most graphs accounting for programmer pain/cost

The Perl Foundation (TPF) Keynote, Richard Dice

Nokia 810

I talked to a fellow field-testing a Nokia 810 and keyboard as a notebook replacement before his next trip. He seemed pretty happy overall. He said he had to do a couple days of setup to get it working to his liking.

Thursday and Friday

Catalyst Class by Jonathan Rockway in association with Stonehenge

- Jon wrote a book on Catalyst and is a core catalyst programmer, less active at committing now.
- class actually a busy 2-day lab, not a lecture
- install Catalyst from CPAN (65 minutes!)
- also went over DBIx and sqlite
- modify various sample programs, like a small wiki and address book.

Thanks to the many corporate sponsors.

I went to Medan, Sumatra and Jakarta for the holidays on JAL, transiting in Tokyo.

Since I had an overnite transit stay in Tokyo, the new Japanese foreigner immigration rules that started in November applied to me and I had to be photographed and fingerprinted to enter the country. Not very welcoming. Just before the immigration counter your can stop at the Section “A” airlines help desk and get a free coupon for the JAL shuttle bus (33) and airline information.

Medan

The flight from Jakarta to Medan is only 2:15 hours, but my connecting flight was about 2 hours late.

Sun Plaza is one of my favorite malls in that area. Unfortunately, recently a distraught young woman had a phone argument with her boyfriend and jumped over a rail to her death in the marble courtyard. Now there are signs saying, “Jangan larangan.” - don’t lean. The rails are solid and chest-height on the average woman, so it wasn’t an accident that she fell.

In Carrefoure Mall there is a good photo store, Buana. It has all the latest Nikon and Canon prosumer bodies, and lenses up to 300mm/f4.

In Indonesia, it’s common for insane people to walk the streets naked. Until now I had never seen that, but this time I saw a naked man walking along a major road near YSR mall. Even Indonesian people along the street paused for the spectacle. (What’s funny is that Indonesian people think Westerners are crazy for walking around in the daytime due to the heat, pollution and often rain.)

A Chinese businessman leased the basement of YSR mall and built a 20-lane bowling alley, fitness gym and billiards complex. Quite nice really, though seldom busy.

I rented a Kijang for 350,000 Rp and went to Pantai Cermin (Mirror Beach) for an afternoon and took some photos. It’s 90 minutes from Medan and popular with locals. A small zoo and swimming pool are also adjacent to the beach.

My trip from Medan’s Polonia airport back to Jakarta was one of my toughest. I had a Sriwijaya airline ticket, and since they’re a new low-cost carrier they don’t have a real check-in counter. So I had to fight mobs of people for an hour to check-in without air-conditioning, then more of the same to check my bag. I ended up throwing out the clothes I was wearing that day. And of course they were late a couple hours.

Jakarta

I was fortunate to have quite good weather during my trip as many parts of the country had flooding. It rained only once, while I was sleeping.

A good taxi rate from the airport to much of Jakarta is 120,000 Rp including tolls. (Tolls are almost 20,000 Rp.)

I went to Plaza Semanggi for an evening. There’s a pretty serious RC helicopter shop there. In the cinema I watched the dreadful “Golden Compass.”

I had a 10-hour transit layover in Narita. After sleeping a little, I looked around some of the way over-priced duty-free stores (Akihabara Electronics uses retail prices) and did some web surfing in the Yahoo! lounge.

My seatmate back was a wonderful young Japanese woman who had previously studied at Cal State. For some reason they upgraded me to Executive Class, with 2 seats across, making life comfortable.

Today I called a San Jose Yellow Cab taxi, and ended up with a new, yellow, shiny Toyota Prius.

The driver said it was the first one in the fleet, and he loved it because he was only spending one-third on gas: idling is free now.

Watching the large LCD Energy Monitor reminded me of Quest’s Spotlight for MySQL product: nearly the same graphics.

I just got back from my first trip to the Philippines. I’d say it is more modern than I expected, but the spoken English is more like pidgin English than American or European - I felt like I needed a translator half the time. For example, “ma’am” is pronounced “mom”.

Also caveat emptor - when evaluating a package trip or hotel, ask bluntly the price of each little feature or transfer that is mentioned. Often what’s listed is merely available at extra cost.

I spent about one week in Baguio City (BC), the summer capital, and a week in Manila, learning about the country, sight-seeing, taking photos, and learning about the call center industry there.

Week One - Baguio City

BC is located about 250 km north of Manila in the mountains, so has cool, rainy weather and lush foliage - its nickname is “The City of Pines.”

Currently TI has a large plant here, and there are several call centers: Sitel (formerly ClientLogic), People Support and E-commerce support (only opens at 4 am.)

Now there’s an invasion of Korean students in BC to learn English cheaply for TOEFL or International English Language Testing System (IELTS) exam preparation for later studies in the USA or Australia/New Zealand. Some of the Internet cafes have their computers set to the Korean language.

Asian Spirit airlines is the only scheduled airline to BC from Manila. They fly an ancient de Havilland Dash-7 regional jet almost daily from Manila at 9:30 am in good weather, returning at 10:40 am from BC. The scenery is spectacular upon landing in BC - a spiral descent from the clouds into a mountain-top airfield with cliffs at either end. After landing there are nice views of a mountain-top radar facility and a building mural painted near the runway. There were only a dozen passengers on my flights in a plane that can seat 50.

BC has a noticeable police presence, but money couriers still use what appear to be amphibious armoured personnel carriers, and newer malls frisk everybody at the entrance (there are separate lines for males and females.) Most people use chrome-plated diesel mini buses called Jeepneys for transportation. They can hold about 15 people.

BC has 4 large shopping centers, the old Porta Vaga Mall below the Baguio Cathedral, and the 4-year old SuperMalls (SM) City Mall Baguio. There are also Abanao Square and Center Mall, near the market area.

Porta Vaga Mall has a traditional atmosphere with small, local shops, restaurants and a very small gym (spinlock dumbbells) with a dance floor. Not many chain stores yet.

SM Mall is huge - a block long and 3 storeys high with fantastic views from the balconies which ring the mall. It also has a small but better gym (Fitness Edge), with dumbbells to 150 pounds, plenty of staff, and hourly aerobics and martial arts lessons. SM is not well adapted to the daily monsoon and typhoon rains, but they are gradually adapting to it with glass partitions. The best Internet cafes in SM are Station 168, with about 100 terminals on 6 Mbps download, and “got hub? Internet”, which has a nice wiring closet. The Fedex office seems to have quite slow computers and Internet connection. SM frisks each customer upon entrance with separate male and female lines and guards. Hahn Sporting Goods sells hunting knives and Bushnell optics.

I did a little dental tourism in SM Mall. Dr. Wilma from Lapid Dentistry (a mall chain there) did a cleaning, checkup and one filling for $28 with no appointment and no waiting. That would certainly be $500 back home. ($900 crowns are 3750 pesos, about $75.)

Restaurants are inexpensive in BC, usually under $5/person. I had acceptable meals (good chicken teriyaki on yellow rice, ok spaghetti bolagnese, fettuccine lacking spices) at Zola Resto Cafe on Session Road (free WiFi) and at Pizaata next to the Baguio City Cathedral and Porta Vaga Mall. Also Pinoy Hotpot/Barrio Fiesta for beef and seafood stews.

Camp John Hay Hotel has a good gym according to some TI employees.

The Baguio Country Club is a 4-star members-only facility, with an 18-hole golf course.

Rainy season is from beginning of July to mid-September, with monsoon rains. Also rains during Christmas season.

Some places to see are:

• Mines View lookout
• Burnham Park, man-made lake downtown BC
• Philippine Military Academy
• Radar Lookout
• “The Mansion” summer palace

In February there is a month-long Flower Festival. On 2 consecutive Saturdays there is a parade.

Week Two - Manila, Coco Beach and Tagaytay City

After BC I flew back to Manila for 2 days, walked around in the Spanish fort and on the Manila Bay waterfront, then got a package tour to Coco Beach Resort on Mindanao Island. The van trip there went from Manila to Lipa (air force base), to Mabini City Port in Batangas Province, then by boat to Coco Beach on Puerto Galera Island, Mindoro Province.

Coco Beach is a beach resort. Not much to do, but there is an ok beach, diving, cute outdoors fitness center (spinlock dumbbells and barbells, universal machine and heavy bag) and great food. The included complimentary breakfast is comprehensive, with fruit, toast, rolls, omelettes, cereals and porridges. The lunches and dinners are expertly cooked. I ate some Philippines chicken tinola stew and tinolang tahong with ginger seafood stew, which are like a soup with large pieces of vegetables. The tilapia fish and beef steak filipino style were also good.

Any other activities, such as the waterfall, require off-island boat and van transportation, which can get expensive quickly - over $50. Some chalets include AC, hot water, and some have cable channels. My chalet could sleep about 10 people! Internet access is 200 PHP/hour from 2 working terminals up 3 flights of stairs.

The main boat safety was good, although the skiff used in the return trip transfer had no life jackets or flotation gear and a plank was used to transfer to the main boat in moderate waves. One wave swamped my side of the main boat and soaked many people and some of my baggage before a plastic drape was unrolled.

At Mabini City Port is a traditional bamboo house. It costs about $2,000 to build and can last 20 years if kept dry and varnished, though the roof may need replacing every 5 years.

On the way back to Manila I stopped in Tagaytay City to see the view of the Taal and other volcanos. There is a great roadside view, and also awesome views from The People’s Park, about 30 minutes from downtown. The Taal caldera is often active so off-limits. The People’s Park would be a scenic, varied backdrop for modelling shoots.

Hotels on the view-side of the road start at $100+/nite (ie. Taal Vista and Day’s Inn), while the other side of the street is $30/nite at places like Tirona Hotel Apt. Carlo’s Pizza serves a very good deluxe pizza. There are no taxis, just tricycles and jeepneys until around 9 pm. Raja Internet Cafe allows wired notebook computer access for 60 PHP/hour.

Philippinos buy local traditional food in TC before returning home. Popular items include buko pie, made with coconut and custard filling in a flour crust for 125 pesos, and traditional condiments sold in bottles of vinegar, chili, garlic and onion for 50 pesos. Collette’s Delicacies is one of the most popular name brand bakers of buko pie.

On Sunday the highway traffic was light: only 90 minutes back to Manila. After unpacking, I went to the SM Mall of Asia, supposedly the largest in Asia. The road-side half has AC (including a very busy Starbucks and an ice rink), the other half open-air (including the well-stocked D-1 Canon imaging boutique), and the far side has 2 ocean viewing platforms, popular with young couples. The city-side of the mall has the huge Dell call center office.

For the last 2 days I stayed in the Bay View Hotel near the US Embassy on Roxas Blvd. It has ok rooms, a swimming pool, and a basic hotel gym with several machines and dumbbells to 25 pounds. In the lobby is a Starbucks with WiFi access at 100 PHP/hour. Across the street in front is the harbour, and to the side is a Yellow Cab pizza parlour and Chinese Superbowl IV chinese food restaurant.

Driving from downtown Manila to Quezon City along the Edsa highway revealed how polluted and grid-locked traffic can get. The diesel fumes were overwhelming. Lining the highway are 50 foot high billboards for restaurants, malls and fashion stores.

Departing Manila from Nino Aquino Internation Airport (NAIA), aka Centennial Airport, is … annoying. Visitors must fill out a separate “embarkation card”, buy a 750 PHP (USD $16) airport fee stamp, get X-rayed twice, stamp-inspected twice, interviewed by immigration, and one final “documents and stamp inspection.” The bureaucracy is surreal.

Photographic Tips

Philippines has a lot of scenic nature spots and interesting urban locations to shoot. In the rainy season from June to September, weather is quite unpredictable, so carry rain-gear.

You may want to go with image-stabilized lenses and avoid tripods now.

Keep in mind:

• DSLR equipment and accessories are rare here. Most malls and stores sell only point-and-shoots, so bring whatever gear you will need.
• There is a basic camera repair shop in Robinsons Place Ermita, Manila, 1st Floor.
• Canon D-Zone in The Mall of Asia is an authorized dealer and has a variety of pro lenses and semi-pro bodies. They sell Canon screw-in filters, which can be used on other mfg lenses.
• There are pro camera stores in Quiapo, Manila.

USD $1 = 46.5 PHP
Average monthly salary in Manila is USD $150. Call center operators start at USD $300/month, but must maintain their Average Hold Time (AHT) under 5:15 minutes per call.

Philippines Call Center Industry - Tour of EPLDT, Makati

I gave up on Defcon after Defcon 11 because of the venue overcrowding at the Alexis Hotel. But since I had no other plans this weekend and they moved to the larger Riviera hotel last year, I decided to give them another shot this year.

What an improvement! 7,000 attendees and 5 talk tracks, yet now fairly well-organized. I registered Thursday at 9:30 am for $100, but they had already run out of the awesome white animated SMT LED badges with a “HUMAN” cut-out conference badges, and programs.

They should have done a photocopy run of the schedules, but didn’t, which is bad since the schedules are not posted outside the lecture rooms.

Security staff in red shirts called “goons” vigilantly enforced access points and fire codes. I was told that lecture room exits had to be clear in case of sudden emergencies like a smoke bomb attack.

The hotel was big enough that the attendees didn’t swamp the hotel, and the rooms for Tracks 2, 3 and 4 were usually big enough. The Track 5 room and the closing ballroom were too small. Hotel security seemed happy and stayed in the background.

The hotel coffee shop was very busy but served ok food ($10 for a hamburger and fries.) The upstairs dinner buffet was a good deal at $16. Good variety of fresh food and desserts, including prime rib, mexican and asian food.

I didn’t bring a notebook computer this year because it would just get hacked if I turned it on, and I also left my Blackberry off. I understand that some people buy a computer at Fry’s and return it after the weekend to get re-imaged, or use it as a honeypot. Some people did use their work Blackberrys with bluetooth disabled. One guy had a Nokia 770 wifi PDA that he planned to re-image after going home. Nice screen with scalable fonts.

The talks that I attended on Thursday and Friday were very strong, usually presented by the original researchers or somebody deeply involved in the topic. Defcon talks are unusual in that most audience questions are held until after the talk in a separate Q&A room. Not my preference, since expert attendees often get more out of the questions that the talk.

Thursday

Thomas Holt: The Market for Malware

Insight into mainly Russian malware industry:

- pincher programs for intercepting username and password data
- joiner programs to bind pincher program payloads with images or downloads
- like to be paid with e-gold, don’t like Western Union
- like ICQ, irc
- tools cheaper for other Russians to purchase than foreigners
- forums for promoting and rating developers and programs
- good authors provide good customer support, upgrades ($10), manuals and customization ($30)
- admin UI programs very polished and professional looking - some are even skinnable.

Pilgrim: How to be a WiFi Ninja

Pilgrim is the real deal - he knows how wifi works, owns a wifi accessories shop in Florida and is a perennial show vendor.

He gave tips on improving wifi transmission and reception:

- thinner cable is lossier, so keep under 10′
- cable is optimized for Channel 6
- wifi signals transmit better in drier air
- most omni AP transmitters can be made more directional by using a tin-foil reflector behind them, preferably parabolic shape
- used Dish satellite receiver antenna could be very useful
- made a wok dish antenna and recommends it
- recommends USB receivers over PC Cards because of external antenna
- recommends USB cable run to smart antenna instead of long runs of cable
- transmit power isn’t everything. try to balance transmitter, receiver, cable and geometry
- re-orient AP antennae to get better vertical or horizontal reception, especially in 2-storey buildings. same when war-driving.

Broward Horne: Click Fraud Detection with Practical Memetics

Broward gave a great talk.

He has the website RealMeme.com and does experiments in web site promotion and Internet mindshare. He left some blog comments on Casey Serins’ IAmFacingForeclosure.com website but received no traffic to his site initially. He posted a comment inquiring about that, got a bunch of traffic, and upon log analysis realized that it was bot traffic, implying that Casey was involved with bots for AdSense click fraud.

He showed some graphs of discussion activity before and after the Pope’s death, which expanded the bandwidth of discussion, and the SARS outbreak, which barely registered.

D.J.Capelis: Virtualization: Enough holes to work Vegas

Awesome talk on how pathetic x86 virtualization is from a security perspective.

He talked mainly about VMware Server and Xen, but problems generally applicable are:

- vulnerable to physical attacks and DoS at PCI level for shared hardware like video, network and drive controllers
- vulnerable to IP and MAC address changes
- vulnerable to practically undetectable covert channels between VMs
- vulnerable to timing attacks similar to the Intel HT ones
- all the image migration tools use plaintext, possibly across ethernet
- any rogue partition can violate all other partitions, subverting your firewall and network security
- bad default configurations, as documented.

The expensive VMware ESX product fixes a few but not all of the above problems.

He’s hoping IBM can leverage their 30 year virtualization experience on LPARs to do a good job.

He released a script to somewhat improve the default security configuration of VMware Server.

Dave Josephsen: Homeless Vikings, (short-lived BGP prefix hijacking and the spamwars)

He presented a history of spam and countermeasures timeline with commentary (he likes content filtering and thinks anything else is just a pointless technical arms race that can’t be won by the good guys).

Then he talked about how BGP can be used by spammers to spoof address blocks or commandeer unassigned IP space, likely the same techniques used by intelligence agencies now.

Gadi Evron: Webserver Botnets

Peter Gutmann: The Commercial Malware Industry

Some repetition of the talk at 10 am, but with more detail.

Daniel Peck & Ben Feinstein: CaffeineMonkey: Automated Collection, Detection and Analysis of Malicious JavaScript

They demonstrated some utilities for de-obfuscating javascript malware and presented some graphs that illustrated how malware and legitimate javascript profile very differently.

Also, they talked about spidering and analyzing some web sites and being surprised at how clean myspace is for example - no JavaScript malware found, probably a credit to their staff.

atlas: Remedial Heap Overflows: dlmalloc style

atlas did a Linux Buffer Overflow 101 class.

He used python to inject the shell code.

All the hotels surrounding the Rivera were full, so I stayed in the Hilton Vacation Getaway Hotel, a moderate walk from the Riviera. My $169 room was a very nice and new suite with a 30″ HDMI plasma TV, jacuzzi, shower, bedroom TV and laundry. The downstairs deli tuck shop is very complete and you can order custom sandwiches there. There is also an outside grill with $5 hamburgers and $4 hotdogs that’s open for lunch. The basement business center is 24 hours and has computer rentals and printing for $1/page. The hallway vending machines have $1 sodas.

Friday

Brendan O’Connor: Greater than 1: Defeating “strong” Authentication in Web Applications

Excellent talk reviewing US online banking so-called strong authentication, then attacking it.

- in-person banking is 2-factor authentication (something you have (card) and something you know (PIN)
- online banking is not 2-factor (you know a PIN but normally you don’t provide card, token or biometrics)
- browser fingerprinting is pointless because everybody buys the same configurations from Dell or HP
- browser fingerprinting is pointless because the implementations are bungled (commented source, little effort)
- banks should display all recent logins, not just the last one
- bank should not star out account numbers, then display the full check thumbnail!
- bolt-on auth systems from 3rd-party vendors weaken overall security and increase the attack surface
- SiteKey is worthless, since they have a limited image catalog indexed by alt tag
- knowledge base questions based on public databases as implemented now are worthless, but could be improved by displaying the same question until correctly answered and not randomizing choices

He finished by demonstrating a MITM attack by writing a newbie-level Perl program to relay the browser fingerprint, setting up Defcon Bank and doing a MITM attack on his personal bank which uses Sitekey.

David Byrne: Intranet Invasion With Anti-DNS Pinning

He discussed DNS pinning issues with IE and Firefox, pinning in Java and also how LiveConnect in Firefox and Opera reduce pinning. Also he showed how to use an exploited browser as a web or socks proxy and talked about using the socket capabilities in Flash 7 and above.

In his demo, he owned somebody’s browser, ran Nessus 3, and started a shell.

Billy Rios & Nathan McFeters: Biting tha Hand that Feeds You - Storing and Serving Malicious Content From Well Known Web Servers

Billy and Nathan are the reason for the recent Firefox 2.0.0.5 and 2.0.0.6 updates.

They talked about:

- XSRF
- serving warez from webmail hosts, in particular Yahoo! and gmail, because they’re free anonymous accounts, have a large storage capacity, good network bandwidth, high-reputation domain names, and plausibly deniable.
- domain substitution
- what can you trust on the Internet? only the domain name in your location bar
- Flash settings XML config file
- browser scheme and %00%00 filetype handlers
- IE 7 and Firefox URI hand-off exploits
- possibly KDE registry might also be vulnerable to filetype handler issues.

The award ceremonies went on 2 hours. It was interesting to learn about the whole Defcon community: security, logistics, press, events, speaker coordination, etc.

40 hardware kits were handed out to people wanting to hack the badge, but only 7 submissions resulted. The 2 winners built a graphical, gray-scale multimeter and a pong game. DT suggested it would be hard to top the badge next year, unless it was converted to a fibrillator or laser beams were added.

A 17 year-old won one of the lock-picking categories. The overall winner mentioned preferring home-made tools.

Some of the award winners received a Black Badge - good for free life-time show admittance. Some got a used notebook or Dish receiver.

The trivia show winning team was booed for their poor result - sometimes needed a dozen clues and still getting the wrong answer - but still got black badges. Next year there will be a pre-qualifying test.

I took one of the airport shuttle buses back to the airport. Depending on how you look at it, either I got a free ground tour of Las Vegas, or they wasted a half hour of my time trying to find a passenger who booked 24 hours in advance but didn’t show up on time. Eventually they found him … back at the Riviera.

theinquirer.ne: How to break forensics software
GData: An Online MD5 Hash Database