+++*

Symbolic Forest

A homage to loading screens.

Blog : Post Category : Linkery : Page 1

Teaching an image to think

Computers work in unexpected ways

Following on from yesterday’s post about log4j: another security article fascinated me in the last week, too. You might have already seen it, because it was widely shared on Twitter and computer people everywhere were amazed and aghast at its engineering and its possibilities. The log4j vulnerability is a relatively pedestrian one by comparison, using something that is an entirely documented and public feature of the library. This, on the other hand, is a completely different animal.

It’s a hack which lets you run code on a stranger’s iPhone just by sending them a message. They don’t have to click on anything, they don’t even have to open it, all their phone has to do is receive it and the hacker can take their phone over. At least, could: the fix for this security hole was fixed three months ago in iOS 14.8 and later. If you are running an older version of iOS on your phone or tablet, then, er, maybe don’t. The analysis of how this hack works, by Google Project Zero, has started to be published; and if you’re a programming nerd, it is beautiful and amazing and horrific in just the same way that a biological virus is.

In short, this hack relied on the fact that an iOS device, when it receives an animated GIF, tries to hack the GIF a little so it will always loop forever whatever the GIF itself actually says to do. It does this in an unhealthy way, though. When it opens the file to change it, it doesn’t matter if it’s not actually a GIF. The software will try to be clever and say “ah, looks like your file’s got the wrong name there, don’t worry, I still know how to open one of these” and do it. Even if it’s not a GIF and therefore doesn’t really need to.

Secondly, the hack relies on a bug in an open source PDF-reading library, in the part of the code used to open embedded images that are in an obscure and rather out-of-date format mostly used by fax machines. PDF is a big, complex and rambly format (believe me I know, I’ve been on-off trying to write a .NET PDF writing library for some years now) so it’s not surprising there are bugs and holes in PDF-reading software. What this hack does, though, is frankly brilliant. It uses the capabilities of the compression algorithm of this particular graphics format to implement an entire virtual CPU in the memory of the target device. It’s a small CPU but it is a Turing-complete one, which in technical terms mean that if you ignore practical limits of time and memory, it’s just as powerful as any other computer. An entire virtual CPU…created by feeding a carefully-designed image into a buggy image decompression routine.*

Frankly, if you’re a software developer, this is genius. Evil genius, to be sure, but genius nonetheless. I’m somewhat in awe of it, in a dirty way. It’s a wonderful level of lateral thinking, to know that the bug is there to exploit and work out a way to reach it and trip it up to begin with; and then to build an entire virtual machine from the basic Boolean logic operations available inside a particular image format. As I said above, it’s beautiful, it’s amazing, and it’s horrific in the original sense of the word. It’s awe-inspiring. I might be good at my job, but I can only look upon this with amazement and envy.

* I assume the image itself looks like just so much white noise if you could actually view it, but you can’t have everything. It reminds me a little of Neal Stephenson’s early-90s novel Snow Crash, in which a carefully-designed image that looks like white noise can hack the viewer’s brain.

The past is a foreign country

Or, some news about a legend.

Back in the mists of time…

…oOo…oOo…oOo… wavy dissolve effect …oOo…oOo…oOo…

…I lived in Edinburgh and worked for a little 3-person tech firm, out of this guy’s study in his family house. And one day, he said to me:

Do you know the secret Armenian restaurant?

He described a building I’d walked past many times, tucked into a corner between the road and the railway lines near Abbeyhill Junction. As he described it, I recognised it immediately, because I walked past it on my route to and from the supermarket. It was, it turned out, something that sounded almost too magical to be true. A secret restaurant. It didn’t advertise, didn’t have a sign, didn’t send out flyers or list itself in the phonebook. If, however, you did somehow find its phone number from a friend-of-a-friend, and if the owner answered and felt like opening and thought you might be a good guest, you were given a booking, could come along, and enter a dark candlelit room where you would feel you were at an Armenian family party for the evening. The owner would cook all the food, then come out and meet everyone and talk to you and make sure he liked you. Like something from a fairy tale, strangely magical and otherworldly, and where the hosts might suddenly turn against you if you weren’t careful or said the wrong thing.

My boss had never been. He didn’t actually have the magic phone number himself, he just knew people who did, it was only really word of mouth that the place even existed. The building was solidly real, though, in Victorian red brick and with a boldly-painted Cyrillic sign above its archway. Whenever I walked past the gates were always firmly closed, the paint peeling and the building slowly fading, with buddleia bursting from parts of the brickwork.

I’m sure I could, if I’d dared, got hold of the number. My boss certainly could have done; he had a wide range of contacts from a broad range of social circles and scenes. Even if I had, I’m not sure I would have dared try to get in. I was a different person back then, much less brave than I am now. Besides, the story is so perfect, I would in some ways rather not have known if it was real or not.

Well, it was real. Someone at BBC Scotland has written an article about it.

It’s quite a sad story, the end of it at least. It’s interesting to know, though, that in some ways the secret Armenian restaurant has had a huge influence on Edinburgh, and on the Edinburgh culture scene. Given that the story has always stuck in my mind, too, it’s probably had a big influence on me in one way or another over the post-Edinburgh parts of my life. It’s almost like an urban fantasy. Sometimes, maybe, the land of faery can exist, or at least something approximating it.

And another cemetery note

Or, something to read elsewhere

Coincidentally, following on from yesterday’s local cemetery post, I came across an interesting article elsewhere: a piece by author David Castleton on the 1970s Highgate vampire panic. I was vaguely aware that this story involved a classic supernatural panic of the Spring-Heel Jack variety combined with feuding paranormal investigators and self-styled vampire hunters; the article tells the full story in intriguing detail. Whether there really was a vampire striking terror into 1970s Hampstead, you’ll have to judge for yourself.

For a long time I’ve had an idea in the back of my mind, the character of a paranormal investigator who tries to stay rational even as everything around him isn’t. I haven’t actively written anything down for a long time, but every so often I come across a little bit of information about the Highgate vampire or something similar and a few more lines of notes go in the appropriate place. Maybe it will come to something one day.

As far as I’m aware, at least, there aren’t any vampires active in the Greenbank area; as a sensible rational person who has seen a dead body and has handled human bones, I tend to treat cemeteries as interesting cultural and archaeological spaces rather than as haunted nexuses of mystical power. Still, it makes me wonder slightly when I take The Children to wander round the cemetery, and when we leave they start waving goodbye to people “we’ve been playing with” who aren’t actually there.

Not Photo Post Of The Week

In which we don’t have many photos, but do have some of the latest guided busway gossip

Back in August, we went away to Cornwall. As you’d expect, I took the camera, and took hundreds and hundreds of photos. They slowly went online – very slowly, because I’m impatient, and it takes a long time to upload photos when each one weighs about 4Mb.

Moreover, a few weeks after we got back from Cornwall, we moved house; and after we moved house, we were offline for about two months whilst we argued with various broadband providers whether our flat really existed or not. All that time, we were out taking more photos, which slowly built up. As a result, when we did finally get online, I had a rather large backlog of photos to deal with. Plenty of photos for me to upload 30-35 photos per week, and post the best few on here every Friday.

800-odd photos later, though, the end is in sight. I’m still working on the photos from the Easter weekend, but after that, that’s about it. The backlog is over, and I’m going to be putting photos up within a few days of taking them. Which leaves Photo Post Of The Week a little stuck, without the regular flow to pick the best of. I’m not entirely sure what to do with it. Do I return to it when I have more to show, or do I go back and post here photos that I took months or years back? I’m still trying to decide. Maybe it will just be replaced, with a sign like this:

Sign, Bedminster

In the meantime, there have been more Bristol Guided Busway developments following my most recent post on the topic. Chris Hutt yesterday published “At Last, The Truth” about the history of the West of England Partnership’s plans for Prince St Bridge, and Bristol Traffic has pointed out that their plans to replace the Bristol-Bath Cycle Path with a buses-only road are still marked out clearly on their maps despite being tactfully edited out of the text, which merely mention their aspiration to build an Ashton-Emersons Green route one day. Personally, I think Chris is being a tad optimistic as to whether he’s discovered the truth and the whole truth, as you could say, but we’re certainly closer to it than we’d be if we were relying on the West of England Partnership’s own somewhat misleading and vague publications and press releases.

Recent search requests

In which we wonder what people are searching for

More things, around the interwebs, that people have been looking for…

the deirdres are a rather good band from Derby – see here.
photo enlargement 99p – it does sound like a bit of a bargain rate. Unless, of course, you want to enlarge a photo of 99p, which is possible too.
unexplained black moods aren’t very nice, but if they’re that unexplained I’m not sure there’s very much you can do.
emo kids handcuffs – I have a lovely picture in my head, now, of emo kids handcuffed to street furniture in all their hang-outs – outside the art gallery in Exchange Square in Glasgow; outside the Corn Exchange* in Leeds, and so on. I wholeheartedly endorse this idea. Come on, people, together we can make it a reality.
triangle sidings are the London Underground sidings in South Kensington, in the basement of the Cromwell Road Sainsburys, where the air terminal used to be. More information, and photos, here.
chocolate coins left at doorstep – I don’t remember ever mentioning this, or anything of the sort. But if anyone does want to leave some chocolate coins on my doorstep, then, please, feel free to!
cara page journalist. Cara Page was, the last I heard, writing for the Daily Record. She’s infamous – at least in certain circles – for writing “exposés” about the sex lives of fairly boring and ordinary people, such as a charity shop worker from Peebles. None of it is “newsworthy” in any conventional sense of the word, but tabloid editors still strongly believe that a bit of Carry On-style tame dirtiness sells papers. Sadly, that’s all I know about her. And that, I think, is probably enough search requests for now.

* Now there’s a name that’s always puzzled me a little. “Hello, my dear sir, I’d like to swap this corn, if you may. For … erm … some different corn?”

The Unconnected

In which we bear bad news

Breaking bad news to people is always hard to do. Even if it’s something as mundane as a dead computer. I took a quick look at a machine one of the staff had brought in from home, in my lunch break; it’s vitally important she gets it working again, apparently, because it’s got all her daughter’s schoolwork on it, and they have to have a computer now to do all their assignments on.* It only needed a quick look to show that it’s not coming back to life. Its hard disk is almost certainly now a former hard disk, with no hope of getting her homework back.** But how do I tell her?

Latest addition to my RSS reader: Bad Archaeology. The navigation is a bit awkward, and their “latest news” page doesn’t seem to get archived, but there’s some very good stuff in there, if, like me, you would love to try poking members of the Erich von Däniken Fan Club with long pointy sticks. Their latest article is on King Arthur, as an example of what happens when you set out to prove a point, and try to use archaeology to do that. I’m tempted to write something longer about exactly that, soon.

In other news: I’ve been listening to Phoebe Kreutz lately. Her songs make me smile, and make me want to listen to more of her songs. So that has to be a good thing. Hurrah for good things!

* I’m not sure I believe that. This isn’t a rich town, and there must be many many children in the area whose parents don’t have a PC.

** A normal boot sequence halts with “Non-system disk or disk error”, which, if your other drives are all empty, is never a good sign. A Linux boot CD finds the hard disk, prints out lots of nasty disk hardware errors, and then says it can’t read the partition table. Not good, not at all.

Percentages

In which we make some numbers up

According to Martijn, 47% of all blog posts consist of links to other blogs.*

Well, according to new research by the FP Militant Invective Laboratories, an entire 0.3% of current blog posts consist of links to blog posts about the proportion of blog posts which just consist of links to other blogs.

No, really. Honest. No, I didn’t just pull that number out of thin air. What sort of person do you think I am?**

* well, actually, he made it up. But it could be true.

** Oh, OK, I did really. But you never know.

Tasty

In which we look forward to a delicacy

Science news of the week: scientists have finally invented an odourless breed of durian, the tropical fruit which is popular in the East Indies, but entirely impossible to obtain in Britain. It smells like a potent mix of vomit and custard, and is banned from the cargo holds of every airline because of that. In Malaysia, several people are killed by durian every year, not because of the smell, but because they are large, spiky, and grow high up in trees. My former Malaysian flatmate would send me news clippings about deaths rising at the start of each durian season. Note to European publishers: start getting those durian recipe books ready now!

Sleeping satellite

In which we notice that Google Maps is a step back in time

Google Maps has recently, it seems, spread its high-resolution satellite coverage over much more of the UK than before.* It now covers, for the first time, this part of the world.

I spent quite a while looking at various places around the area, seeing what I could spot; and it quickly became obvious that even though Google have only uploaded the pictures recently, they’re not new pictures. I asked around the office for advice, and as far as we can tell, the pictures are four or five years old. The new cinema next to the Boating Lake is, on Google, an empty field. My car isn’t anywhere to be seen, because I didn’t have a car back then. Wee Dave spotted his own car, outside his old house.** Various other buildings haven’t been built, or are still there on the pictures having been knocked down a few years ago. It’s intriguing; and I can’t help wondering just how Google picks its areas to upload, and if it’s been sitting on these tiles since Google Maps UK first started.

* Thanks to Martijn for mentioning it, otherwise I wouldn’t have noticed

** actually, he spotted “the one that the missus wrote off a few years ago”