These are a few of my favorite things

No, I won't be talking about "raindrops on roses" or "brown paper packages", but rather a set of software tools I have found I cannot live without. Well, ok: I won't die or something, but if I have to use a computer without the following installed, I get very frustrated:

1. Servant Salamander
   
   
   
   • The next step after the good old Norton Commander, this Orthodox File Manager (OFM) allows me to perform file operations faster than Windows Explorer or any command-line I have ever used.
   
   
   • This is the software that keeps me on Windows and the best $30 I ever spent. I have yet to find anything that equals it for other platforms, although Krusader comes close and Midnight Commander still feels as akward to use as Norton Commander does after trying Servant Salamander.
   
   
   
   


2. SciTE
   
   • SCIntilla-based Text Editor. Syntax-highlighting, auto-completing and folding compact editor. I use it to edit every text file when I'm not using Visual Studio. Look for the occasional patch from yours truly on their mailing list.
   
   


3. Maxthon
   
   • Internet Explorer with tabs and stuff! The single best feature is the download control, which allows me to turn off, by default, JavaScript, ActiveX, Java, sounds and videos. This makes it really easy to surf safely and only turn those features you need when you trust the site, although a persistent "safe list" would be really nice for those sites I visit often.
   
   
   • Some of you may point out that Firefox also has tabs and a similar script disabling facility (which does support a safe list), so, err..., until I can configure it to have an experience like I have in Maxthon (which is a similar problem I have with most OFMs), I'll stick with Maxthon a little longer.
   
   


4. Net Transport (NetXfer)
   
   • Fantastic software for downloading files. I use it primarily to queue up and throttle downloads, but it's also super at preparing batches of downloads through its browser integration that scans the current HTML for links and allows you to pick which ones to queue up. It also supports tricky protocols and scheduled downloads. It looks like my wish for BitTorrent support has recently come true, so I'll be trying that new version out very shortly. :)
   
   

Next time, I'll post about other cool software you've never heard of, but this time I can sort of tolerate using a computer without.

Always provide a manual option

My wife and I picked up a friend from the Ottawa airport the other day. On our way out, we had to pay for parking at one of those booths with a mechanical barrier. Only when we paid, the barrier didn't go up. The attendant looked at us funny, saying: "Ok, you can go now", and we looked at him with an equally funny look saying: "Sure, just lift the barrier first".

After a few iterations of this, including the attendant's assurance he had pressed the right button (and hence the gate should be up), he realized maybe we weren't making it up (he's facing the other way) and told us he had to call someone else to get it open. That someone else eventually showed up with a set of keys and a screwdriver-like tool, which he proceeded to use to open up the mechanical barrier's box. This got the barrier to lift, apparently mechanically.

The RISKS? Well, you'd hate to have the power go out or have an emergency of some sort, since it can obviously fail. Those gates should use a mechanical assist -- thus allowing a human being the option of lifting the barrier themselves -- instead of a completely mechanical drive, just like most garage door openers have that dangling string you can pull on to switch to "manual mode".


Since this blog is about software, ummm... the lesson is the same! Always provide a manual option or an override in software. It's no coincidence computers in movies always have an "override" option (although it's admittedly unlikely those people can somehow always get authorization to do so), but the message is clear; there's always a special circumstance where normal rules/validation conflict or aren't appropriate and thus should be temporarily disabled.

That is, if you want your software to be used. After all, business must go on and if the software refuses to accept unusual input (especially as the business evolves), then people will work around the software and use it less and less.


So think about this issue the next time you need to implement some sort of validation and make it more like guidelines.

SanDisk is "cruzing" for a bruisin' with their U3 Launchpad

Tonight, I was helping my mother with her Mac laptop and new "SanDisk U3 Cruzer Micro" memory stick. She purchased it to be able to "carry pictures around", mostly from her computer to the Jean Coutu so they could be printed. Simple enough.

She tells me she had had some difficulty when she last tried it, so, this being 2006 and plug-and-play no longer needs to be [air] quoted, I ask her to plug it in to see what would happen. She does and some "disk utility" thing seems to pop up. She might have clicked something that was bouncing in her dock or something (my attention was diverted for a second) but there it was. I recognized the window for what it was, and had her exit it since I also noticed a new icon on her desktop that looked like what you should expect from plug-and-play.

She double-clicks on said icon and, as expected, a window opens up with the contents of the removable device. Except there already files in there. A System folder, a Documents folder and some EXE. At first, I thought it might have been the case she picked up a used memory stick. By digging into the folders, I notice it's software that would most likely be bundled, such as Skype. I simply have her delete everything on the memory stick, except that the EXE in the root folder wasn't getting deleted because it was marked as "protected". "Weird, but not a problem", I tell her; "I'll just erase that when I try it in my laptop".

So she plays around for a bit, I show her how she can drag pictures from iPhoto into the window representing her memory stick and all goes well. I show her how she "ejects" the device before unplugging it (she remembered the scolding she got last time she didn't eject it first) and then I plug it in my laptop to make sure the pictures were indeed copied.

After plugging it in to one of the USB ports, I notice my computer taking a long time "installing" the new drivers. I thought that was odd as I frequently pop in my digital camera's SD card in the appropriate slot on the side of the computer and it works just as floppy disks did. Then I notice the set of "devices" being detected includes a "CD-ROM" (??) and this animated splash screen follows by saying that the launchpad is loading and it will appear in my system tray when it's done loading. Only it just hung there, most likely because I was running under a low-permission account; I kill the process and fire up my favorite file manager, only to notice there are TWO new devices showing up and one of them indeed looks like a CD-ROM drive.

I'm pretty sure I didn't miss a Slashdot announcement on compact disks being reduced to the size of a dime (mini-SD cards excluded) and then I realize what had happened; that EXE on the memory stick had been executed and had installed some "drivers" to be "helpful". Remembering why Sony sucks, I start to panic: what if I just got infected with some similar shit? Why weren't my permissions low enough to prevent this?? Why didn't I turn "AutoPlay" off earlier???

If you are still reading intently at this point, you are probably a fan of hyperlinked IT drama stories, and that's pretty sad. Just scan like everybody else and scroll already to the part about removing the damn thing, which has been placed just below this paragraph to ease you into this "scrolling to the interesting stuff" business.

How to remove the damn thing

Web searches for "remove driver u3 sandisk" didn't yield anything interesting except that I noticed lots and lots of people are trying to sell or review the damn things. Note to self: remember to repeat the search and click on Google's "Dissatisfied? Help us improve" link. The closest I found was this answer from the U3 support commonly asked questions:

6. I want to uninstall the U3 Launchpad from my smart drive

The U3 Launchpad is only supported on Windows XP and Windows 2000 operating systems and this restriction extends to U3 Launchpad uninstallers. A U3 Launchpad uninstaller is a software module that removes the U3 Launchpad and re-configures the drive to be a single mass storage USB drive. U3 Launchpad uninstallers are only available for and must be run on Windows XP or Windows 2000 machines. The locations for the uninstallers are provided here:

...followed by two links to the product pages that contain no actual uninstallers (surprise, surprise! - but I did find a link called Launchpad Removal) and the last one allows you to download a program that pretty much reformats your memory stick to remove all traces of the launchpad software on the memory stick.

How to remove the malicious, self-installed drivers

Errr... I'm not sure. Before I found the uninstall software, I tried uninstalling the drivers from Device Manager, but they would come back after plugging the stick in again, even though I was holding down SHIFT the whole time and had disabled AutoPlay for removable drives. Hmmm... Note to self: investigate how to enforce the "no autoplay whatsoever" group policy and file a bug report with Microsoft if that's not possible... no, if it's not super easy.. not that either; if it's not THE DEFAULT BEHAVIOUR on new installs.

The best way is probably to reformat the stick with another operating system, or one that's suitably configured to not get itself infected when plugging stuff in.

What's the problem, here?

You must work for SanDisk or be one of the programmers of U3. I would like to point you to the THE RISKS DIGEST. Read it for a while. Browse through their archives. Find the story from two or more years ago that talked about how easy it would be for malicious programs to automatically run when memory sticks are inserted into PCs and how it could be used for instamatic industrial espionage/sabotage and how this has led to organizations filling in all USB sockets with epoxy (or simply removing them from boxes) to avoid having to deal with the problem altogether.

Now that you are enlightened in the matters of responsible software engineering, go convince your superiors that you should ship BLANK MEMORY STICKS and an optional software CD instead, after releasing instructions or software for removing all traces of your drivers in my registry as well as proving to me, in some way or another, that you didn't also install a keylogger or other malicious software on my computer.

In Conclusion

I'm obviously not paranoid enough about checking my system for the presence of a rootkit infection or disassembling the software to confirm/deny my fears. Maybe someone else (with more free time than me) will come along and make a more informed determination. Oh, and I should stick to the point and stop telling long, boring IT drama stories.

Console.WriteLine ( "Hello world!" );

I'm _finally_ blogging! Now to find something interesting to write about...