About time to print those wedding photos

Time flies! Hanna and I celebrated our second wedding anniversary at ModMed, a good restaurant in Linköping. While we have talked a lot about getting our digital wedding photos printed, so far it has been all talk and no action. I'm a sucker for good deals, and I think I just found one that is way too good to miss. Fuji direkt is "the leading photo supplier in Scandinavia" according to themselves. I checked out their reviews and awards page and found a lot of compelling quotes. Here's the deal: One of the products that Fuji direkt offers is their photobook. It's available in multiple sizes and with hard- or softcover. You create the photo book by downloading an application and can then choose layout, templates and write photo captions freely. Perfect for our wedding photos. And right now it is for free (in Sweden only) in return for a blog post about it! They received a TIPA award for the photobook, on merits such as durable paper quality, fine color gradients and natural skin tones. I'll add a comment to this post once I receive the wedding photoalbum.

Unrelated to the photobook, I found another deal from Fujifilm: You can get 100 printed photos for free.

Feels like it's 1995 again with all internet freebies! Alta (la) vista, baby!

V8 and JavaScriptCore are really, really fast

JavaScript was born in 1995. Still, on the JavaScript VM scene three months is a lifetime. As Mark Rowe commented, I benchmarked a nightly V8 against a three months old JavaScriptCore (SquirrelFish). Which turned out to be unfair. Read the previous post for more information. Here's a new short version and new results:

On my machine given my unscientific measurements in Q2 2009:
V8 and JavaScriptCore are really, really fast.
TraceMonkey is fast, but often far behind really, really fast.

V8: Chromium 3.0.182 (182.0) snapshot 16837 23 May 2009
TraceMonkey: Firefox 3.6a1pre nightly latest-trunk 22 May 2009
JavaScriptCore (SquirrelFish extreme): WebKit r44078 nightly 23 May 2009

• Dromaeo JavaScript Tests (higher is better):
  
  • V8: 175 runs/s
    
  • JavaScriptCore: 195 runs/s
  • TraceMonkey: 53 runs/s
    
• V8 Benchmark Suite version 4 (higher is better):
• V8: 2324
• JavaScriptCore: 1882
  
• TraceMonkey: 289
• V8 Benchmark Suite version 3 (higher is better):
• V8: 2109
• JavaScriptCore: 2079
  
• TraceMonkey: 281
• SunSpider 0.9 (lower is better):
• V8: 859ms
  
• JavaScriptCore: 860ms
  
• TraceMonkey:1430ms

For the SunSpider bars lower is better, for the others higher is better. Read the previous post for more information.

V8 is really, really fast

edit: JavaScript was born in 1995. Still, on the JavaScript VM scene three months is a lifetime. As Mark Rowe commented, in this post I benchmarked a nightly V8 against a three months old JavaScriptCore (SquirrelFish). Which turned out to be unfair. Check out the numbers in the newer "V8 and JavaScriptCore are really, really fast" post instead.


Short version
On my machine given my unscientific measurements in Q2 2009:
V8 is really, really fast.
SquirrelFish is really fast, and often close to really, really fast.
TraceMonkey is fast, but often far behind really fast.

Longer version
If you haven't been living under a rock the last year then you know that there has been substantial progress in the JavaScript VM camps. I wanted to get some performance numbers from recent versions of V8, TraceMonkey and SquirrelFish.

Here's what I used (I'm on Mac OS X). It was the most recent versions at the time of writing (May 22nd 2009).
V8: Chromium 3.0.182 (182.0)
TraceMonkey: Firefox 3.5b4
SquirrelFish (extreme): Safari 4 Public Beta (5528.17)

To get somewhat fair performance figures I ran three benchmark suites: Dromaeo, V8 Benchmark Suite and SunSpider. I ran the JavaScript Tests part of Dromaeo since I intended to measure JavaScript, not DOM, performance.

Here are the very unscientific results from my Core 2 Duo laptop. I re-ran some of the tests a few times, best result posted. The browser was restarted between each test run.

• Dromaeo JavaScript Tests (higher is better):
  
  • V8: 176 runs/s
    
  • SquirrelFish: 138 runs/s
  • TraceMonkey: 46 runs/s
    
• V8 Benchmark Suite version 4 (higher is better):
• V8: 2325
  
• SquirrelFish: 1440
  
• TraceMonkey: 189
• SunSpider 0.9 (lower is better):
• V8: 865ms
  
• SquirrelFish: 1022ms
  
• TraceMonkey:1480ms

For the SunSpider bars lower is better, for the others higher is better. I may update this blog post with new numbers if I get better results (with the same versions). V8 is the fastest, SquirrelFish is second and TraceMonkey comes in last in all benchmarks. edit: These numbers are unfair since V8 was a nightly build (no stable Chrome released yet for Mac OS X) while the others were a few months old. Check out the less unfair numbers in the newer "V8 and JavaScriptCore are really, really fast" post instead.

All VM's have their own merits. Nothing beats getting real-world performance characteristics by throwing your own programs at them so do that if you want to do a serious evaluation of them. You may also be interested in evaluating code size and memory consumption, especially if you're into embedding. Oh and in that case, make sure that the JIT has a backend for your target.

To me the V8 source code was the most beautiful and TraceMonkey the least. This is very subjective so take a look for yourself. And while you're checking out the code run the log command so that you get a feeling of how fast the project is moving. And what they're changing. That may be a good or bad thing to you.

If you just want to run a fast browser then all three should be plenty fast for most (current) use cases. I run Mozilla Firefox myself since I'm addicted to extensions such as LastPass and Tree Style Tab.

THE POST IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE POST OR THE USE OR OTHER DEALINGS IN THE POST.

One password to find them

In the article "One password to rule them all" I elaborated about how I improved my password hygiene from terrible to excellent. To make a long story short I prefer to have unique (strong) passwords for all accounts and more importantly I don't want to remember any of those passwords. I use one single master password to retrieve all the others.
My previous setup for this was using Clipperz. A few weeks ago I found an even better alternative: LastPass. The best way to describe it would be as Clipperz on steroids. It's faster, it has an awesome Firefox plugin and most importantly it's much, much simpler to use. They have a bunch of screencasts on their site.

If you are still using one password for all your accounts, if you are using two passwords (one for important sites and another for less important sites) or if you are using the insecure built-in password managers in most browsers, then chances are that you're a password sinner just like I was. Try LastPass and improve your password hygiene!

Moved my blog from WordPress to Blogger and Dropbox

Administrating PHP software on my own server is not something I'm particulary keen on doing. WordPress has had its fair share of security vulnerabilities so far and at the end of the day I want a blogging solution that gives me peace of mind. I moved to Blogger. Blogger lets me vote with my feet any day I would want to since it has an export feature, so I'm not locked in. At the same time I switched to the domain lassus.eu, for no particular reason.

I also needed to put my blog images somewhere and came up with the nifty idea of hosting them on Dropbox. Dropbox is one of the best services I've ever stumbled upon and since it supports URL accessible files (in the Public folder) this seemed like a perfect match. Perhaps they have some bandwidth limits but I don't think that's ever going to be a problem for this blog.

Here's how I moved it:

1. Deleted all comments that were tagged as spam (hidden) from the Wordpress dashboard. This is important or else they will get imported to blogger.
2. Used the Wordpress export feature, yielding an XML file in Wordpress language.
3. Downloaded the Google Blog Converters scripts. The wordpress2blogger.sh script converted the XML file to Blogger language.
4. Copied all of my images from my server's wp-content/ location to the Public/blog/ directory in my Dropbox. Found out the public URL location of files in that directory using the "Copy public link" feature of Dropbox.
5. Search and replaced the images location (fancy.se/wp-content/ -> dl.getdropbox.com/u/283098/blog/) and domain (fancy.se -> lassus.eu) in the XML file. Used sed for this since emacs crawled on its knees on this 300K one line textfile.
6. Used the Blogger import feature.

So far everything seems to work just fine. The old permalinks doesn't work longer but I can live with that. Got the twitter feed integrated and everything. Uploading an image to new posts is as easy as saving it in the Dropbox folder and pasting a URL. And best of all - no more security worries.

Peace of mind.

One password to rule them all

I admit that I've had the worst web password hygiene until now. I've used more or less one password sprinkled over many sites. The number one reason for why this is a terrible idea is that I can't seriously trust all those sites (authors). Heck, it's not totally impossible that one or two sites actually store my username and password in cleartext somewhere (how horrible that would be). Imagine one of those sites being compromised. Add the fact that I'm typically olov, olov.johansson or olov.lassus on most sites. Impersonated!

The solution is to use one password per site (actually, even better is to ask for wide adoption of the OpenID identity system). All passwords should be reasonably hard to brute force or dictionary attack. I'd recommend at least ten characters, using a combination of alphanumerical characters [a-zA-Z0-9] and symbols (!"#¤%&/()=? ...). The longer and more obscure the passwords are, the better. All is well? Almost. How on earth will I remember all passwords? I have a terrible memory by the way. Solutions:

1. The web browser remembering my passwords. I wouldn't dream of using this. It's way flawed. The default is to not use a master password and thus store the sensitive data trivially scrambled on the disk. ..drumroll.. It's also unconvenient since the data is bound to one computer.
2. Writing down the passwords on post-its, in textfiles or similar. No comment.
3. Storing all passwords in an AES encrypted textfile, on my USB stick. I could never remember a 128 or 256-bit key so I would use one of the better hash functions on my one-password-to-rule-them-all. This can be cross-platform automated using the excellent TrueCrypt tool, for instance.
4. Storing all passwords AES encrypted on a site. A double SHA-256 on my one-password-to-rule-them-all yields the encrypt/decrypt key. Most important of all: all hashing and crypto should happen on the client side (on my machine). I use Clipperz. Even if the Clipperz database would be compromised I wouldn't worry too much (I would vote with my feet, though).

I was thinking about doing number three until I found the excellent Clipperz site (number four) and started using that instead.

Keep in mind though, if you opt for number three or four and lose your one-password-to-rule-them-all, then you're smoked! You need to remember it. You should also make darn sure that you don't write it down anywhere, in any form. It must be reasonably strong, see above.

Bottom line: My password hygiene is now so much better than before it's not even funny. I have to remember exactly one password. I have no idea what the password for my wordpress instance on this site is. To write this article I first opened Clipperz compact in the Firefox sidebar. I entered my username and one-password-to-rule-them-all. A couple of seconds later (after all client side JavaScript crypto operations were done) I just clicked the "Fancy blog" link, bam, logged in!

I can access and add passwords from any internet connected JavaScript enabled browser. I periodically download an offline copy from Clipperz (it's really more of a JavaScript application than a site) for being safe if Clipperz would go down.

Are you feeling guilty? Raise your hand and repeat after me. "I am a password sinner." Now go do something about it. Being lazy and/or having bad memory are no excuses anymore. The one-password-to-rule-them-all method might just be the silver bullet you have been waiting for.

One Password to rule them all, One Password to find them,
One Password to bring them all and in the darkness bind them

Visuals and more

Did some more Ruby on Rails fiddling on the CamDB site:

• List of all known manufacturers, linked to queries
• Recent added/edit sort order
• Increased precision printout (per suggestion)
• Blog integration
• Better visual design
• ..and a bunch of bug fixes