cheaphack

On Proving your Identity

2008-07-30T14:24:00.011-04:00

I purchased a new Dell Latitude D630 laptop today. I'm excited, but I was also quite cautious, since this is more than I'd ever spent on a laptop before. Nonetheless, my old laptop is effectively dead, and I need one that can last me through the next five years of grad school.

About an hour after I placed the order, I received a call from some 800 number. I had sort of a goofy conversation with them. Here's a summary of my conversation with him, and a later conversation I had with my bank:

Them: Hi this is Mr. Foo calling from Bar, Inc. We contract with your bank or credit union to provide fraud monitoring and prevention. We noticed some questionable transactions, and wanted to verify them with you.

Me: (unimpressed by the phrase "bank or credit union") Umm... Thanks.

Them: Could you please tell me your name and the last four of your social security number?

Me: I'd love to, but first, can you prove to me that you really are affiliated with my bank?

Them: Unfortunately, we cannot do that until you verify with us first. Besides, it's just the last four digits of your social security number---what harm is there in that?

Me: (trying not to laugh) Well, I use those last four digits to prove my identity to my bank-or-credit-union, my cell phone company, my health insurance company, and even this morning to prove my identity to my University. Those last four digits have become quite an important secret, and I don't give them out readily (any more).

Furthermore, because of the structure of social security numbers, the first five digits aren't very random. The first three digits, for instance, can be looked up as a function of the year and state of your birth, so I must assume they are public knowledge. If I tell you my last four, then you know everything except the middle two; you would be able to narrow my social down to 1 in 100.

No disrespect intended, Sir, but even if I assume that you are who you say you are, and that you have a legitimate relationship with my bank-or-credit-union, I have no assurance that your company has any decent standards for data protection, or that everyone who works at your company has good intentions.

Instead, I'll have to call my bank-or-credit-union directly. At least then, I'll know who I am speaking with.

I wasn't really trying to give this guy a hard time, but we have to protect ourselves. Given the time-coincidence between the purchase and the call, I was pretty sure that Mr. Foo was indeed who he claimed to be. Nonetheless, I opted to call my bank-or-credit-union to be sure, and had the whole situation cleared up.

My main point here is to call attention to the failings of our everyday methods of proving our identities. In nearly every context, an applicant claims and identity, and then provides a piece of knowledge that is known only to the applicant and the service provider. This could be your username/password on a website, your name/last-4 to your phone company, or your name/credit card/expiration date/billing address to a vendor. Variations of this scheme go on forever, and none of them is secure.

And the failing of all of these methods is: to prove your identity, you give away your identity. If the service provider on the other end (or even one bad employee at that service provider) decides to, he may impersonate you. If someone set up a website y0urbank.com that looked exactly like yourbank.com,
you may accidentally give them your identity. It's even possible that your service provider acts in good faith, but all of your identifying information is stolen from their databases by some malicious agent.

There are alternatives; I'll present two cryptographic solutions below. Neither of these is my invention. In this modern day and age---and considering that credit card companies are liable for fraud---I don't know why they aren't in common use.

While I'm on the topic, I should also announce that I am creating an open-source RF keyfob that performs the first authenication scheme below. That's why I developed SHA-1 for the PIC16 late last month). The device is still in the works, and has been delayed by the death of my laptop, but will hit the scene before I start grad school.

The first solution is relatively simple. Presume for a second that both the applicant (me) and the service provider (my bank-or-credit-union) share some secret S_me. You can think of this as a password, or more generally as a really long number. Instead of giving S_me away (and as a result, giving away my identity), I can prove that I know S_me. In order to authenticate:

I tell my bank-or-credit-union my purported identity "Nick Johnson."
My bank creates a nonce N_bank or in other words a long random number that is different each time.
I compare N_bank to all of the nonces I have seen in the past. If I have seen it before, I reject it and start from the beginning.
I create a second nonce N_me.
I can now calculate a magic number by concatenating the digits of N_bank, S_me, and N_me. Please note that only the bank-or-credit-union and I could have produced this magic number, since only we know S_me.
I compute the cryptographic hash H of the magic number.
I send N_me and H to my bank-or-credit-union.
My bank-or-credit-union compares N_me to all of the nonces I have sent in the past. If my bank-or-credit-union has ever seen this before, he rejects the whole transaction, and tells me to start from the beginning.
My bank-or-credit-union, knowing N_bank, S_me, and N_me can now also compute H.
My bank-or-credit-union compares Hs, and if they match, can be confident that I know the secret.

This way, even if someone overhears the entire conversation, they neither learn any information about my secret (because of properties of the hash function), nor do they have a dialog that they can replay (because the nonces must change each time). By performing this protocol again in reverse, my bank-or-credit-union can also prove it's identity to me.

The problem with the first scheme is the shared secret. The two parties must agree upon some secret, and communicate one to the other, hoping that no one overhears. Also, although best practice is to store passwords as hash values, this scheme requires both parties to store the passwords as cleartext, making data-theft a possible issue.

There is another algorithm to perform this sort of exchange---the classic zero-knowledge proof. It is more complicated conceptually, as well as in computation-time and -space, but doesn't require the service provider to store any secrets, and is very sexy. I would love to employ it in my RF keyfob project, but I don't think I can make it fit into a small, embedded microcontroller. Let me explain it using an analogy.
There's one slice of Pizza left, and we both want it. Neither of us trust the other to divide it evenly. So, instead, we agree that one of us will cut the slice in two, and the other has first pick from the halves. The pareto-optimal strategy for each player yields an equal half-slice; the first doesn't know what the second will choose, and so he must be prepared for either choice.

So, what if instead of knowing a secret, suppose instead that I knew the solution to a complicated problem---so complicated that it would take years to solve it. This knowledge can be used represent my identity, and I can prove that I know it without giving away the solution:

Both my bank-or-credit-union and I agree upon a complicated problem to which only I know the solution.
We repeat these steps until the bank is satisfied of my identity:

I create a derived problem which is equally complicated to solve, but which I can solve easily since I know the solution to the original. It is important that knowing the solution to the derived problem gives no hint to the solution of the original.
I tell my bank-or-credit-union about this derived problem. I have committed to this problem, and in doing so have claimed that I can demonstrate both that it is equivalent to the original problem and that I know an answer to it.
I ask my bank-or-credit-union: Which would you like to see---the equivalence, or the solution? (Which half would you like to eat?)
My bank-or-credit-union selects one, and I provide the requested information.
My bank-or-credit-union verifies my response. If it's wrong, it rejects me. If it's right, it only knows that I wasn't wrong. In the worst case I predicted its choice in [4], and my bank-or-credit-union is now twice as confident that I know the solution to the original problem.

This aforementioned protocol, of course, requires a satisfactory problem to perform. The classic example is the problem of finding the Hamiltonian Cycle on an undirected graph. Since this problem is NP-Complete, we can make the problem arbitrarily hard by using a large enough graph. However, it is very easy to compute the Hamiltonian Cycle while you build such a graph (or perhaps, more accurately, it is easy to add a Hamiltonian Cycle to a totally random graph).

With the example above, I would generate a large graph and cycle when I open an new account with the bank, and I would tell the bank the graph, but I would keep the cycle as my secret. The secret doesn't need to travel, and so we can keep closer tabs on it.

Additionally, to perform the above protocol, I need some method by which I can create a derived problem. With the Hamiltonian Cycle problem, this is also easy: I choose a new random name for each vertex in the graph, thus producing a new problem, and I perform the same substitution on the cycle, thus producing the solution to the new problem. I have created a new problem, equally as large (and presumably, equally as difficult to solve), which I can prove equivalent to the original (by disclosing the random substitution), or which I can solve on demand (by applying the random substitution to the solution to the original). Even if I disclose the derived problem and its solution, my bank-or-credit-union gains no knowledge of the solution to the original. To do so, it would need to solve the graph isomorphism problem to find the relationship between the two problems. Graph isomorphism is in NP.

The major problem with both of these authentication protocols is that they require a lot of computation---more than any human would be able to do in his head. As a result, the human needs a piece of trusted hardware---analogous to a key---which can serve as his proxy in this exchange. Such hardware exists, often in the form of smart cards. Each implementation is a black box; no one is allowed to audit them to see if they really work the way they claim. Again, sit tight and you can play with my RF keyfob project soon.

However, like a key, anything you have can be stolen. To use this device effectively, it should be combined with something that can't be stolen, for instance something you know. This project is not the ultimate solution, just a step in the right direction.

This is New York:: NYPD Untouchable

2008-07-28T10:41:00.006-04:00

I witnessed something scary at Critical Mass last Friday. I was riding in the crowd for a few hours---a totally peaceful night, no police harassment. It seemed to me like the quite before a storm.

But when we made it to Times Square, things changed. Two young police officers jumped into the road among the cyclists, and knocked one to the ground. I was immediately behind him; I didn't see him do anything illegal or even interact with the police officers.

They simply assaulted him. He tried to flee from the unlawful arrest (which is legal, since unlawful arrest is assault), and was then arrested.

I admit that, for all I know, this guy was a wanted criminal. I think this is doubtful; even if he were, I find it hard to believe that an officer could have identified him among the hundreds of cyclists and thousands of tourists in Times Square.

Either way, be very scared. Riding a bike is a crime.

UPDATE: Here's a video of it on YouTube:

Also seen on Gothamist

UPDATE: Streetsblog reports,

Mark Taylor, an attorney with the firm representing the cyclist, says he is hopeful the charges will be dropped in light of the video evidence. Asked whether the NYPD plans to go ahead with the charges, a department spokesman said the matter is being investigated. Since the video surfaced, the officer has been put on desk duty.

I hope justice might be served for once.

Recovering deleted files from ext-3 filesystems

2008-07-24T19:51:00.005-04:00

Exercise for the reader: where can you insert a space in this command to delete all of your files: "rm *.toc" ?

At work today, I managed to delete a document I had been writing for an hour and a half, just as I completed it and was about to add it to source control. What a royal pain in the butt.

It's no secret that most operating system do not actually erase data from a drive when they delete a file; rather, they update meta-data to mark the file as deleted. For this reason, there are "undelete" utilities for various operating system. And, although I found plenty for the ext-2 filesystem, there are none for the ext-3 filesystem. In fact, the journaling-aspect of ext-3 actually zeroes-out some imporant structures on disk, making traditional undelete utilities virtually impossible.

Still, I didn't give up. There is a way, which I'll document here for google to find.

I very quickly rebooted my computer into single-user mode. Single-user mode was helpful, in my opinion, because there were fewer processes running---any of which could have written to a temporary file that, by chance, could have occupied the same disk sectors as my file.

Next, I unmounted my /home partition.

Then, I went looking for my document on the partition. In my case, /home is /dev/sda6. The beauty of unix is that it treats everything---even partitions on your harddrive---as files, and it has a rich set of commands to operate on files. Here, I will literally grep my harddrive for my file.

To do this, you also need to know a crib for your file. In my case, I knew my file contained the text "An Algebra of Dispatch Rulesets."

Then, I executed this command:

strings /dev/sda6|fgrep --before=1000 --after=1000 "Algebra of Dispatch Rulesets" >foo

The strings command reads every byte from the harddrive, and only outputs runs of at least 4 printable characters. This fast pre-processing greatly reduces the work that grep has to do.

I used fgrep instead of grep because searching for a fixed pattern is much faster than searching for a regex. The --before= and --after= flags tell fgrep to print out 1000 lines of context before and after the match.

After this command completed, I was lucky enought to find the final draft of my document---among a lot of crap---in the file foo. I removed the crap, and recovered my file.

I was lucky in a couple of ways, and you may not be so lucky. First of all, my document was written in LaTeX---a plaintext format---which made it easy for me to identify the beginning and end of my document.

Also, my disk is only about 10% full, which means the operating system has no need to fragment files. As a result, my file appeared as a single, contiguous run in foo. On a more crowded disk, the OS will break the file up into blocks and stores them wherever; in that case, one would have to search for each of the blocks and re-assemble them into the original.

Anyway, I got my file back, and I hope you do too.

Oh yeah, recovering the file took about 2 hours. I probably should have just re-written it.

UPDATE: A friend tells me that this utility can undelete removed file on an ext3 filesystem.

flickr hack: how to remove the newfangled flash uploader using adblock

2008-06-30T01:03:00.004-04:00

When you upload photos to flickr through there web interface, it will try to use their fancy flash file uploader. Personally, I prefer the "basic uploader," which is accessible from a link at the bottom of the uploader page.

Here's a quick hack on how to automatically use the basic uploader using adblock. The trick is this. First, flickr tries to insert the uploader flash object. If javascript on that page determines that it was not loaded, it will fall back to the basic uploader. If you use adblock to block the flash uploader, then you will automatically go to the basic uploader.

So, log in to flickr, go to the upload page, and then block the following url using adblock:

http://flickr.com/images/upload/yuploadcomponent.swf

Quick an easy, and hella useful

An implementation of SHA-1 on the PIC16 F88

2008-06-27T23:19:00.004-04:00

Here's an implementation of the SHA-1 message digest algorithm for the PIC16-family of 8-bit microcontrollers. I wrote it as part of a larger project (secret, until a soon-in-the-future date). I have verified it against several testcases of varying length (up to 1,000,000 characters), and it all seems to work well.

The code for this implementation is 520 instruction words, though a careful coder could chop it down by perhaps as much as 64 words. A more pressing issue is that it requires a lot of RAM--120 bytes, across two banks. For those unfamiliar with these microcontrollers, I give perspective by saing that the PIC16F88--a relatively big PIC16--has 368 bytes of RAM total.

When using the byte-oriented API, simulation shows that an average of 685 instructions cycles are required for each message byte, or reciprocally, about 7KB/sec throughput.

So, please enjoy the source code. It works fine with gpasm and gpsim, though I haven't tried it with the windows-only tools provided by microchip.

Gripe: Abusive rental agreements

2008-06-27T14:38:00.002-04:00

Daya and I have recently been considering buying a house. Our logic has been that flipping a house in five years is favorable to renting. In actuality, the equity built over five years in this market is quite small, and (at least for us) renting would save us money. Oh well, I'm disappointed, but I'll get over it.

Having decided not to buy, we instead signed a lease. The last clause of this lease includes this very questionable clause (the bracketed words are my addition, for suspense):

17. The relationship of the [tenant] and the [landlord] shall be that of a guest and an innkeeper, respectively, and nothing herein shall be construed to give the [tenant] any additional rights including, but not limited to, those of a tenant under a residential lease. These parties specifically agree that this agreement does not establish a landlord/tenant relationship and is not governed by NJSA 2A18-61.1 [sic] or NJSA 2A:18-53, commonly known as the New Jersey eviction statute.

So who would write such a dastardly, evil clause into their leases? Princeton University. In the original, "[tenant]" was written as "student", and "[landlord]" was written as "university."

Despite this, the rental market in Princeton, NJ still somehow made this lease favorable; the graduate housing that Princeton will provide is at perhaps half the market rate. We signed. So what did we give up?

NJSA 2A:18-61.1 and NJSA 2A:18-53 limit the circumstances under which a tenant may be legally evicted. The limits laid out in law are mostly reasonable: one can be evicted if they fail to pay rent, if they are a terrorist (I'm not joking), etc. It also allows for the eviction of tenants convicted of drug crimes (questionable...), or if you refuse to pay an increased rent (very questionable...). Because my relationship to Princeton will be that of a guest and their inn, they can evict me not just for being a terrorist, but for whatever reason they wish at any time.

I understand that Princeton basically wants the right to evict me if I drop out of grad school, but still, this is wrong. I am so sick of being shat on by landlords.

Hacking Firefox 3.0 -- Removing unused menu items

2008-06-17T22:27:00.008-04:00

A co-worker convinced me to download Firefox 3.0 for Firefox download day, and I took the bait. So far, Firefox 3.0 seems really, really fast, but I haven't been using it for days yet. I'm going to try to be the first guy to release a cool hack for Firefox 3.0. Please play along here.

When I use Firefox, I've noticed that there are perhaps a dozen menu items that I never use. For instance, I never try to open a new window (instead, I use tabs); I never use any of the send link/page/image to variants, since I use gmail and haven't ever set up a email client within firefox. I never use the Work Offline button (I don't really know what it means).

Same thing with the right-click context menus. I don't right click a page to stop loading, instead I hit escape. I never copy image contents, set desktop background (in fact, my window manager is set up so that my background is a terminal window).

Most importantly of all, I never never never mean to hit the File -> Quit menu item; most likely I mean to hit File -> Close Window, which is inconveniently located in the middle of the menu. In terms of keystrokes, ALT-F down down down is much farther away than ALT-F up.

So, If I never use these menu items, why do I have to filter through them every time I use my web browser?

Well, now I don't, and the screenshot at left demonstrates the newer, smoother, less-crufty layout. Here's how you do it yourself:

It turns out that all of the user interface widgets in firefox are defined in a series of XUL files. By modifying these files, we can make our menu layouts match our personal use cases.

A moment of caution, however. XUL files are XML documents, and they are tightly coupled with other parts of the software. Who know how many calls times firefox calls document.getElementById() and doesn't check the return value. Don't risk it. Instead of removing items from this file, or even commenting them out, we're going to set the XUL hidden="true" attribute for undesirable menu items. Similarly, if you are moving elements, you may want to preserve the parent-child structure of the document, or you may break some XPath query hidden in firefox' gut.

It should also go without saying that you should backup every file you modify. Having said that, I'm not responsible for you.

Find your firefox installation directory. On my computer, this is /usr/local/bin/firefox; on windows, I would guess it's in C:\Program\ Files. Within this directory, you will find a subdirectory called chrome/, which contains a series of .jar files. Our target is browser.jar.

Copy browser.jar to browser.jar-old right now, before you forget. Oh yeah, close firefox.

Now copy browser.jar to a temporary directory, and unzip it with whatever tool you use. If you have trouble with this step, rename it to browser.zip, and unzip that.

You should see a directory called content/browser/, and in this directory, a series of .xul files. We are interested in content/browser/browser.xul. Open it up with vi, and look at it until you understand how it works.

For our purposes, you only need to understand the meaning of a new elements.

< popupmenuset > - here, popup refers to popup menu. The main popup set is the main menu bar used in firefox, and it contains the File, Edit, View, etc menus.
< menupopup > - this can refer to a popup menu (such as the File Menu) or to a context menu (like when you right-click on the page).
< menuitem > - this refers to a menu entry, such as Open under the File Menu.

So, to remove an unwanted menu item, first find the offending item, and then add the attribute hidden="true".

And to re-order misplaced menu items, re-order the elements.

When you are done yicking with the innards, re-zip the entire directory tree into an archive called browser.jar, and put it where you found the original. Start firefox, and see how you did.

If you get weird behavior, re-examine your modifications or revert to the original file. Lather, rinse, repeat. Enjoy.

And while we're on the topic, let me throw-in a few about:config tweaks that I find completely necessary for Firefox 3. I got most of these from LifeHacker.

dom.disable_window_open_feature.menubar, dom.disable_window_move_resize, dom.disable_window_move_resize, dom.disable_window_move_resize, dom.disable_window_move_resize, dom.disable_window_open_feature.titlebar, dom.disable_window_open_feature.titlebar must all be set to false to avoid annoying behavior;
browser.tabs.closeButtons = 2, to put the close tab button on the right, not on each tab (like firefox 1.5);
browser.backspace_action = 0, so that backspace is equivalent to the Back button;
browser.chrome.toolbar_tips = false, to hide tool-tips; and,
browser.tabs.tabMinWidth = 75, so it will show more tabs before scrolling them.

Lesson in humility: failed headset crown race press

2008-04-27T15:25:00.008-04:00

Part of doing-it-yourself is failing to do it yourself. It's not a bad thing unless you refuse to learn from it. Up until now, I had made it a point to only post my successfuly hacks/tweaks/mods/etc to this blog. However, today's post is abouta well-planned diy tool that didn't work. Let's try to learn something from it.

While doing my annual bike tune-up, I realized that part of my headset was installed incorrectly. I designed and built this tool in an attempt to fix that.

First, a bit of terminology.

A press is simply a tool that works by pressing things together, in contrast to a jack which pushes things apart. There are lots of kinds of presses: simple ones use a screw, complicated ones use pneumatic or hydraulic pressure.

A bearing is a mechanical component that acts to reduce the friction between two parts which move relative to one another. A ball bearing is a bearing which uses balls to accomplish this (though many other types exist: the brass bushings on cantilever brakes are an example of non-ball bearings).

And now some bike terminology.

The fork is the fork-shaped piece of a bike which straddles the front wheel (n.b. the things on the back are called the stays, and are NOT a fork). The steer tube is the tube which extends up from the fork to the stem, which connects to the handlebars. The fork crown connects the steer tube to the two tines of the fork.

The headset is a pair of bearings which connect the fork to the rest of the frame, allowing you to steer without much friction. Those two bearings in the headset are cup-and-cone style bearings. These types of bearings are popular in older bikes, but are being gradually replaced with cartridge bearings. This is unfortunate, since cup-and-cone bearings can be adjusted for a prolonged life, while cartridge bearings must eventually be thrown out and replaced. Nonetheless, because the main force on headset bearings are thrust forces (parallel to the axis of rotation), and because of the size of the bearings, cup-and-cone style bearings remain the standard for headsets.

A cup-and-cone bearing consists of three pieces: two races, and a set of balls. Sometimes, those balls are held in a ring formation by an unnecessary, though helpful piece of metal or plastic called the retainer. One of the two races is concave (the cup), and the other is convex (the cone). The fork crown race is the cone which is seated on the steer tube just above the crown, on what is called the crown race seat.

The crown race is press-fit onto the crown race seat, which is to say that the crown race seat is slightly larger in diameter (1.185") than the internal diameter of the crown race (1.180"). This minor difference in diameter (only 0.005 inches) is enough to make it hard to install, though once installed, it may as well be a piece of the steer tube.

So, as I was stripping my bike down for its annual paint job, I noticed that the crown race was incorrectly seated, and I decided to remedy it. It only took a few seconds for me to decide that I wouldn't be able to press it on by hand, and so I went forth building a tool.

I tried two variations on the same design. The first attempt failed: as I tightened the drive bolt, it worked well until the steel bar bent, and then the plastic snapped, and ultem shrapnel ricocheted off of my luckily-closed eyelids. Although a failure, it worked for a while; the race was halfway pressed onto the race seat. I was encouraged to try again, using a heavier construction that hopefully wouldn't snap, crackle and pop.

I have annotated the picture on the left.

I used my lathe to turn a piece a ultem plastic (a metal replacement, similar to delrin) into a race guide. The race guide had a 1.125" hole bored through the center of it, so it could slide along the length of the steer tube, and had a larger recess bored at one end of that hole to snugly fit the crown race.

I then drilled and tapped two holes on either end of the race guide, and used bolts to fasten the race guide to a bar of steel placed between the two tines of the fork. A third bolt--the drive bolt--past through the center of that steel bar against an ultem plunger, which pressed against the other side of the fork.

Again, I have annotated the picture on the left.

I wrapped some fabric around the new paint on the fork, and began torquing the drive bolt. Just like the first time, it began working. In fact, this second attempt put the race close to the right position.

But alas, it too failed.

The failure was very similar to the first time. First, the steel bars bent. And again, since it seemed so close to being complete, I chanced tightening even further. Unlike my first attempt, however, the plastic never broke. Instead, the press tore the head off of one of the hanger bolts.

Disheartened, I decided I would need to try a different technique. But what? I couldn't easily make this design larger, since I was already working with the largest plastic stock I had available. I read and re-read Sheldon Brown's advice, until it came to me.

Duh! I have a lathe.

I chucked the crown race, and took a few (i.e. added) a few thousandths to the race's internal diameter. The race still had to be pressed onto its seat, but I could do that under hand power using the race guide I had already built.

So, as I mentioned earlier, there is a lesson hiding in here somewhere. I'll try to be thorough it down, but please let me know if I elide anything:

Lesson 1: Keep it simple, stupid (KISS). This is the prime directive of engineering. By elaborating the design, I added too many points of potential failure.

Lesson 2: Determine which problem constraints are true constraints, and which are only constraints in name / by convention. The crown race should be tight on the crown race seat so that the steer tube doesn't rattle within the bearing. But does it need to be press fit? There will be no motion between crown race and steer tube, so long as the bearings are doing their job. By increasing the internal diameter, I allowed easier installation, but without sacrificing holding power.

Lesson 3: Wear eye protection.

Spring bike maintenance

2008-04-27T14:50:00.003-04:00

Spring is finally here, even in the frigid New York City, and time has come for my annual bike tune-up. Sure, I could take it to a bike shop, but then I'd miss out on all the greasy hands, the hundreds of little cuts on my hands, the OCD adjustments that a bike offers, and the feeling of triumph of riding the optimized bike.

Now, I admit that my hand was forced into doing a tune-up. Work has kept me busy enough that I just put off the repairs, one weekend after another. It was a mechanical failure that got my focused.

Daya, Chris and I were at Ben's surprise birthday party at a brewery on the ground floor of the Empire State Building. Eventually, we got sick of paying $7 / pint, and decided to go back to Brooklyn. Our destination was a bar called "Alligator Lounge," serving $5 drafts and a free pizza with every drink (no, really). We set up a race: Daya and Chris took the subway, I rode my bike.

I took 5th Ave down to Union Square Park, and got onto Broadway. I kept flying south until I hit Grand St, realized I went too far, and backtracked to Kenmare. I took the Williamsburg Bridge, landed in ... Williamsburg, and then started looking for the bar. People on the streets tried to give helpful directions, but each pointed me in the wrong direction. Finally, when the alligator lounge was in sight, I started pedaling from a read light, and then ...

My chain fell off.

This is rare, but not unheard of. I have my bike rigged with only 1 chainring up front, and no front deraileur. Thus, as the rear deraileur shifts from side to side, there is a slight chance (say, once in 200 miles) that my chain will fall off.

But not this time.

As I started to put my chain back on, I noticed that my chainring had inexplicably bent itself beyond repair. My bike could be pushed, but not ridden, and I was still miles from home. Knowing that I had lost the race, but that I should have won, I pushed my bike the last few blocks. Daya and Chris were there, smug with their victory. This was the first time I had lost a Subway-versus-bicycle race, and I was not happy.

But I digress; this post is about my spring bike tune-up.

I replaced my broken 48T chainring with a new 53T chainring. This has upped my ratio significantly, but still in my comfort zone. I also replaced the chain, and put on a new 8-speed 11-28 cassette (same as before). I put on new brake shoes, bought new cycling shoes and installed new cleats.

But that's the less interesting part of the tune-up. I also did some work on my headset, and I repainted. Each of those is a big enough task to warrant their own posts. So, those posts come next over the next few hours. Stay tuned.

Shout-out to Dennis Ferron

2008-04-26T23:37:00.003-04:00

Dennis recently linked to me from his blog, and I wanted to say thanks, and to point out a particularly cool post. Ferron's Guaranteed No Mess No Mixups Method for Swapping Rims without Relacing is something that I wished I had happened upon years ago.

The problem: you have a new rim, and you want to build a wheel. This task is typically a pain, though some people enjoy doing it.

The special circumstance: you already have an old wheel built.

The critical observation: in addition to re-using the spokes and hub from the old wheel, you can preserve the information stored in the old wheel's lacing.

The method: put the two wheels side by side. Transfer one spoke at a time from the old wheel to the new (in careful order), and you save your self a lot of hassel.

Well done Dennis.

One liner updates

2008-04-11T08:40:00.003-04:00

I have accepted Princeton's offer. In September, I will be a graduate student at the Computer Science Department at Princeton University.

The weather has been beautiful recently.

Work is going well. I work at a rate of one todo list page per day. There, I have observed quite a bit about ruby on rails, and I think I'll have to post about that soon.

My mother is coming to visit soon.

Although I had a minor in math, I still think that taxes are confusing. The astute reader will note that math is not arithmetic.

I just went through a week of infirmity... Something gastrointestinal. I'm happy to report that has passed.

I've been playing with my lathe a lot. I built a crank puller, as I said I would. Now I just need to convince myself to stop making minor changes to it, and to move on to a new project.

My apartment has a mouse. I'm trying really hard to kill it, but it is apparently smart enough to take the cheese off of the traps without dying. Bastard!

Single-serving tools

2008-03-30T19:37:00.003-04:00

Every so often, you find yourself in need of a unique tool to fit the situation. Most of the time, such a tool can be bought. Though, because of their limited need, stores must sell these for a higher price to average out the lesser demand. Compounding this fact, no one wants to pay a lot for a tool they'll only use once.

I've collected a list of all the one-time, single-serving tools from recent memory. If you have similar single-serving tools, I'd like to see them.

(1) An improvised headset press.

I needed to install the bearing cups to a 1-1/8" threadless headset on the bicycle I was building. But, I was only going to do this one time, so I didn't feel like buying a tool, even if it only cost $20.

My solution was this. A 1/2" screw is used to push two soft plastic plates together. These, in turn, push the cups into the headset. The plates were made out of some plastic from an old cutting board.

For best results, stick the cups in the freezer for half an hour--they will contract slightly and fit more easily.

(2) An exceptionally long allen wrench.

Have you ever needed a really long allen wrench? Well, I did when I was constructing the drawer set for my new lathe. Local hardware stores didn't sell allen wrenches this long--at least not in metric--so I built my own.

Take a normal allen wrench and hacksaw-off the bend. It's hardened steel, so it will mess up your blade--use a worn-out blade. Take a length of 3/8 round steel, bore a 1/4" hole at one end, at least 1/2" deep. Insert the hex bit, and then weld it on to the rod.

Also, bend the far end of the rod, or weld on some sort of handle. I used my lathe to turn the rod down a bit, making it easier to bend.

Ultimately, this 5mm wrench will reach more than nine inches deep into a 1/2" hole.

(3) An easy way to measure angles.

When I moved into my apartment, I immediately devised a plan to build an long shelf above head level in the hallway. Because this apartment had been sliced off of a single family residence, it had an awkward hallway in the wrong place. The hallway space seems like a significant fraction of my apartment, and without the shelf it would all be lost.

The problem was that the walls in this hallway didn't meet at right angles. It's very ad-hoc, with three turns at angles around 13-31 degrees. I needed to measure these angles or the wood wouldn't meet right.

Sure, protractors are cheap, but one wasn't available when I had my inspiration.

I built this out of some 1" extruded aluminum angle-stock and a small machine screw, nut an washers. The trick? A hole is drilled on each bar, 3.5" from the pivot point. For any angle, the two holes and the pivot point make an isosceles triangle. Then, if I measure the distance "h" between those two holes, I can calculate the angle between those bars as 2 * sin ( h / 7 ).

The shelves, by the way, look great and line up perfectly.

So, anyone else have single-serving tools to share?

My minilathe, and several mods thereof

2008-03-25T23:50:00.002-04:00

It's been a while. There are various excuses for that, but the main excuse is that I've been putting in long days at my new job.

The big news (on the diy/hacking/modding front) is the arrival of my minilathe. I had been dreaming about owning a minilathe for a long time. I had always been frustrated by the cost and accessibility of various machine parts; to me, it's torture when you have a great idea and no way to build it. I looked forward to all of the rights and responsibilities given to lathe owners.

This lathe is just one brand of a common chinese lathe, sold by Cummins, Harbor Freight, Grizzly, and others.
One benefit of this oft rebranded tool is that many online communities have sprung up about how to use or modify it, for example the right-wing 7x10 minilathe group. However, the Cummins model is in a class by itself. It is simultaneously the cheapest, and shipped with the most accessories, including a faceplate, a 3-jaw chuck with both internal and external jaws, 5 HSS tool bits, a tailstock chuck, a dead center, a set of change gears, a steady rest and a follower rest. It is a great value.

Let me first say that, despite the limitations inherent to small lathe, this lathe is quality. Every moving part has a gib or some other way to adjust it. Although each part may slowly wear out, the designers have provided the end user with a way to compensate.

Let's compare it to the famous Sherline Mini-lathes. Among hobby machinists, Sherlines have a good reputation for quality, and are comparable to my Cummins in size. However, Sherlines do not include change gears and a feed screw -- necessities for cutting internal / external threads -- nor do they include a compound slide, thus one cannot cut bevels. Oh yeah, Sherlines cost more too.

Enough about comparisons, on to the juicy stuff. I unpacked the lathe. The first thing you need to do with a machine like this is take it apart. I took it down to it's solid pieces, cleaned off the factory grease, re-greased. re-assembled and adjusted it. These preliminaries are critical, since they give you a good understanding of how the machine all works, and yield a certain confidence toward using or modifying the machine.

So, what modifications have I done? First the simple shit: I removed and recycled the two chip guards. Then, I removed the plastic do-hickey covering the emergency stop button. Perhaps I'm misunderstanding it, but it seems much safer to have a clear path between my left hand and the stop button. Additionally, I replaced the bolts that secured the hand wheels, since they tended to hit my knucles.

Next, I grabbed some strong magnets pulled from a scrap hard drive, and used them to keep track of the various chucks. I find that the use of a magnet is just slightly entertaining, perhaps only on the subconscious level, but that is enough that I never forget to replace the key. I don't imagine I'll ever accidentally leave it in the chuck.

I don't own a grinder with which I can grind my tool bits, but I can put a small arbor-mounted grinding wheel in my lathe. The beauty of this is that I can use my lathe's compound slide to get a precise angle onto the tool bits. Similarly, I realized that I can use fragments of hackway blades to shim-up the cutting tool.

My lathe came with a lot of accessories, and suddenly I had nowhere to keep them all, let alone work. So, I went to work building a drawer set. I collected a bunch of scrap wood and plastic from around the neighborhood (and trash day in Brooklyn contains enough wood to build a few houses, I'm sure). The drawer set is sturdy as hell. I added in a few solid brass drawer pulls that I found at the Park Slope Flea Market to finish the effect. So much of this sort of improvised building involves moments of inspiration. This simple allen wrench holder is one such example.

Most recently, I built a apron chip guard, inspired by the one that Varmint Al made. One failing of the minilathe design is that it leaves the gears behind the apron exposed, and poised to collect metal chips from the cutting action. As Jobst Brandt once said, "Commercial abrasive grinding paste is made of oil and silicon dioxide," and so I was concerned about these chips, even though the gears were otherwise greased. So, here is how I built it:

Cut a sheet of 1/8"-thick pastic to the rough contours of the lathe's apron. I used some plastic that used to be part of a printer's enclosure. Drill a hole large enough for the gear's shaft (I cut mine 7/8" since I had that bit available, though smaller would do). Drill and countersink five holes around the perimiter of the chip guard.

Transfer those holes from the plastic chip guard onto the back side of the apron using a center punch. Drill and tap those holes. I used a #36 drill, and a 6-32 tap, though anything of similar size will work. The apron is made of cast iron, which is a surpisingly soft metal. Nonetheless, proceed with caution so you don't break your tap, and use lot's of wd40.

This is a view of the back side of the apron after the five holes have been drilled and tapped.

Clean out all metal chips from the area, and re-install the gears.

Drench the gears in a heavy grease. I used an old hacksaw blade as a spatula to really muck it into the nooks and crannies.

Install the chip guard. It is secured down by five 6-32 machine screws. Re-install the apron onto the lathe, and rejoice in your apron's newfound ability to repel chips!

Multi-color lamp from (some) reused materials

2008-03-07T19:50:00.005-05:00

I've seen this style of fabric-draped, muted-light lamp all over new york recently. I decided to build my own, and make it glow funny colors.

The schematic is really simple; I wanted to keep it that way. A PIC16 is used to create three PWM signals. Those three signals feed into three NPN transistors to drive a stack of colored LEDs. I proper design would use resistors both at the base and the emitter, but I was lazy last night.

Also, this thing has source code.

Tryin' to keep it simple. I put it on some perf board, and wire wrapped it. I tried to space the LEDs evenly on both sides of the board. The obverse:

And the reverse.

Then, I made a frame out of two coat hangers. I wrapped them with some packaging material from my new job's recent Ikea visit, and sewed it on.

It starts to look a little bit better as more sewing is done.

Finally, it looks like this in the dark:

Last minute notice: Free class on TIG Welding tomorrow

2008-03-03T20:01:00.003-05:00

Christian just told me that 123 Tompkins Community Space (map) is offering a free workshop on TIG welding Tomorrow, 4 March 2008, at noon-o-clock. I don't think I can make it (see note about new job in previous post), but I wish I could. Why?

Well, I say that I know how to weld, by which I mean I can use an oxy-acetaline kit, and I can use a MIG welder. Still, that limits me to steel. TIG welding, on the other hand, can be used to weld a greater variety of metals, such as aluminum, magnesium, copper, and alloys thereof. If you're interesting in bicycle frame building, for instance, this is the kind of welding you want to learn (in addition, of course, to brazing).

Additionally, I'll plug this by reminding everyone that it's free, rare for anything educational in NYC. Show up, enjoy it, and... you know, leave a donation if you have fun.

It's been too long

2008-03-03T19:34:00.004-05:00

My appologies for taking a week or so off from the blog. I assure you there is more to come. Here are some of my excuses for slacking on the blog:

I have started a new job, where I work as a Java developer, though so far our work has mostly been assembling Ikea furniture. The office is awesome--on vibrant Franklin Ave in Crown Heights, Brooklyn. I like how every five minutes or so someone stops by to ask "so, what is this place?" Apparently, the office was an abandoned/condemned building for many years, and though people are glad it's no longer rat infested, the neighborhood really wants another restaurant, lounge, or other public space. The job has been keeping me busy, but in a good way.

I've heard from a few Graduate schools. What? I forgot to mention that I applied to a few PhD in CS programs? Yeah, I did.

So far, Princeton has made me a good offer, and CMU and UPenn have rejected me. More schools are pending. At the moment, it looks like I'll be moving to small town Jersey unless Columbia wants me. On a related note: does anyone out there live in Princeton? What do you think of it? Of particular interest to me are cultural events, bike-friendliness, a leftish-leaning populace, and urbanity (ha!).

I purchased this lathe today, and am looking forward to its arrival. As far as metal lathes are concerned, this one is dirt cheap (though still an expensive tool). I plan to fit this into the cheaphack mission by working with scrap materials. I anticipate my first project will be a crank puller, followed by fancy brass crank bolts and top bolts, working my way into Stirling engines. Don't worry, you will be posted.

I have two projects on the way: a stylish lamp made from recycled materials, and a bicycle generator built with an old air conditioner. Stay tuned for more absolutely cheap diy technology.

More on the Mystery CCD

2008-02-22T11:23:00.004-05:00

Yesterday I posted about a mystery CCD that I found in a flatbed scanner. It has no part number on it; all I knew was that it has 22-pins. I was hoping that it was like an LCD module---multiple vendors but a single footprint. Sadly, this is not the case.

Proof by counterexample: Toshiba produces at least two 22-DIP CCDs with incompatible footprints: the TCD1707D and the TCD2905D. From my analysis below, I now know that this CCD is neither of those.

I pulled out the continuity tested and started tracing connections. Here's what I've found:

GND
GND
buffered input 1
GND
buffered output 1
+12V
GND
buffered input 2
buffered input 2 (8 and 9 are the same)
GND
GND
GND
odd, see below
buffered input 3
+12V
GND
buffered output 2
buffered output 3
GND
buffered input 4
GND
GND

By "buffered input," I mean that the pin is driven by a 74HC04 inverted, through a resistor. By "buffered output," I mean that the pin is fed into a simple transistor inverter. By "odd", I mean that two '04 inverters are put in series and drive themselves through a capacitor. The output also drives this pin through a resistor.

Since this device has three outputs, I infer this is a color CCD. I suppose I could have read the packaging on the scanner, but I threw it out before I thought to check.

Photos from last night's full lunar eclipse

2008-02-21T21:11:00.002-05:00

Here are some photos of last night's full lunar eclipse.

c. 9pm

c. 10pm

c. 11pm

Mystery CCD: Help me identify this part

2008-02-21T20:56:00.003-05:00

I pulled this out of a flatbed scanner. It's a linear charge-coupled device (CCD). I want to use it in a project (see below), but I don't have any datasheet. All I know is that it has 22 pins. Any pointers would be greatly appreciated.

So what do I want to use it for? I want to put it next to a radioactive mass and use it to generate truly random numbers.

Update: Where to watch tonight's lunar eclipse

2008-02-20T18:24:00.002-05:00

According to Only the Blog Knows Brooklyn, a good place to watch tonight's lunar eclipse in Park Slope is at 9th St and 7th Ave. Here, an amateur astronomer with a telescope will be letting people have a nice glimpse, and talking about what's going on.

About 8:45pm -- 10pm. Don't miss it or you have to wait until 2010!

Meet me at Make:NYC #4

2008-02-18T16:50:00.002-05:00

The fifth meeting of Make:NYC will take place this Saturday, 23 Feb 2008, noon-o-clock at 325 Gold, 2nd floor, Brooklyn.

There will be seminars on soldering and LEDs (whoo hoo??), but more importantly, there will be show and tell.

Now I just have to put a thingy together for the meeting.

All packaging should have a deposit

2008-02-17T11:04:00.004-05:00

You simply don't see soda cans or bottles on the streets of Brooklyn. Similarly, it's sometimes hard to find scrap metal on the streets (I'm the kind of guy who looks for that stuff). You do, however, see plenty of paper products, such as food-wrappers, and tons of plastic bags.

What is the distinction?

Anything that can be redeemed for money--even small deposits of $0.05/ea--is actively scavenged and turned into cash. This is a beautiful consequence of urban society. There are so many people here, and the bell curve of income extends so far to either extreme, that material scavenging is (relatively) proffitable to some. There are homeless people who canvas all the streets of Brooklyn looking for any material that have a deposit. A single can is worth shit, but if you fill a shopping cart with them, you can get a good meal or whatever. In effect, we pay the homeless to clean up certain types of trash, and they do it.

As metal prices have risen over the last few years, this is true for scrap metal too. Copper, brass, and aluminum have gone through the roof. If someone leaves some left over copper plumbing pipe on the street, it will be collected and redeemed at a scrap yard. Again, the homeless are in effect paid to clean up the streets.

Even failing that, New York offers free curbside pickup and recycling of glass, plastics, metals and papers. The variety of recyclable is much broader than I have seen elsewhere. For example, you can leave more than metal cans on the curb, but anything which is "mostly metal," such as old bike frames, refrigerators, air conditioners, toasters, etc.

I often think about systems in which the remaining trash--the paper and bags on the streets--is similarly collected and recycled or reclaimed. There are a few difficulties with that, but I believe they can be overcome.

Paper-as-food-packaging is often not recycled because it has food scraps on it--an overzealous blot of mustard, meat juices, whatever--and unlike metal or plastic food containers, paper products cannot be washed before recycling. If the city tried to offer recycling of this kind of paper, recycling bins would attract animals, and recycling plants would need to perform additional steps to purify the fiber. As much as I demonize these discarded food wrappers, I am old enough to remember when McDonalds used to put each hamburger in a styrofoam container, and I recognize they are the lesser of evils.

Perhaps the only way to reuse this grade of paper would be to compost it, and then use it in municiple parks, donate it to community gardens, and sell it to homeowners or landscaping companies. There is precedent to suggest this could work. Many municipalities dredge their waste treatment facilities, and sell this as compost. Also, I know that some beer breweries sell their waste as compost.

Plastic bags are also tricky. Native New Yorkers may not realize this, but people really go crazy with the bags here. In my native Virginia, people would always ask if you wanted a bag if it were clear that you could get along without one. When I moved here, I was surprised to learn that they always try to give you a bag. I had never thought of putting cups of coffee into a bag until I moved here. I've bought single, self-contained products, like a gallon of milk, and sure enough they'll put it in a bag if you're not quick enough to exclaim "but it's already got a handle!"

Plastic bags can be recycled into new plastic bags, or into fiber to create materials such as polar fleece. It's perhaps not the best reuse, but it is reuse. However, the city does not pick up plastic bags on the curb. The consumer's recycling options are limited; I am fortunate enough to be a member of the Park Slope Food Coop, which will recycle many of these bags.

Now that I have established the potential for the reuse of paper and plastic, we need only implement a system by which these materials are collected. I propose one solution: deposits for paper and plastic. I know this is possible, because they do it elsewhere.

Without doing too much research, I know that there is an additional cost per-bag at stores in France and Ireland. This is a tax to encourage people to bring their own bags, and I think it's great. But what if we could not just implement that tax, but also return it per bag returned? And for the case of paper, what if fast-food restaurants would serve you a burger on a plate, and charge a packaging tax for wrapped food to-go?

It's difficult, but it could make New York cleaner.

Lunar eclipse, Wednesday night

2008-02-17T00:18:00.001-05:00

Slashdot reports:

KingArthur10 writes "It will be the last lunar eclipse until December 2010, and it should be spectacular. Shades of turquoise and red will pour over the moon's surface as it moves into the Earth's shadow around 8:43pm EST. As NASA reports: 'Transiting the shadow's core takes about an hour. The first hints of red appear around 10 pm EST (7 pm PST), heralding a profusion of coppery hues that roll across the Moon's surface enveloping every crater, mountain and moon rock, only to fade away again after 11 pm EST (8 pm PST). No special filter or telescope is required to see this spectacular event. It is a bright and leisurely display visible from cities and countryside alike. While you're watching, be alert for another color: turquoise. Observers of several recent lunar eclipses have reported a flash of turquoise bracketing the red of totality ... The source of the turquoise is ozone.' So, all of you amateur astronomers need to get out there and take pictures. It might be worthwhile sharing them on sites like SpaceWeather or Flickr so that our Asian, European, African, and Australian brethren can witness the sight as well."