The Smell of Molten Projects in the Morning

Ed Nisley's Blog: Shop notes, electronics, firmware, machinery, 3D printing, laser cuttery, and curiosities. Contents: 100% human thinking, 0% AI slop.

Category: Home Ec

Things around the home & hearth

  • Why Friends Don’t Let Friends Use Windows: Torpig

    For those of you still using Windows, here’s a sobering look at why you shouldn’t: an analysis of the Torpig botnet by an academic group that managed to take over its command & control structure for a few days.

    The report is tech-heavy, but well worth the effort to plow through.

    Here are some of the high points…

    Why do the bad guys do this? It’s all about the money, honey:

    In ten days, Torpig obtained the credentials of 8,310 accounts at 410 different institutions.

    … we extracted 1,660 unique credit and debit card numbers from our
    collected data.

    Does an antivirus program help?

    Torpig has been distributed to its victims as part of Mebroot. Mebroot is a rootkit that takes control of a machine by replacing the system’s Master Boot Record (MBR). This allows Mebroot to be executed at boot time, before the operating system is loaded, and to remain undetected by most anti-virus tools

    In these attacks, web pages on legitimate but vulnerable web sites are modified with the inclusion of HTML tags that cause the victim’s browser to request JavaScript code from a[nother] web site under control of the attackers. This JavaScript code launches a number of exploits against the browser or some of its components, such as ActiveX controls and plugins. If any exploit is successful, an executable is downloaded from the drive-by-download server to the victim machine, and it is executed.

    What happens next?

    Mebroot injects these modules […] into a number of applications. These applications include the Service Control Manager (services.exe), the file manager, and 29 other popular applications, such as web browsers (e.g., Internet Explorer, Firefox, Opera), FTP clients (Leech-FTP, CuteFTP), email clients (e.g., Thunderbird, Outlook, Eudora), instant messengers (e.g., Skype, ICQ), and system programs (e.g., the command line interpreter cmd.exe). After the injection, Torpig can inspect all the data handled by these programs and identify and store interesting pieces of information, such as credentials for online accounts and stored passwords.

    If you think hiding behind a firewall router will save you, you’re wrong:

    By looking at the IP addresses in the Torpig headers we are able to determine that 144,236 (78.9%) of the infected machines were behind a NAT, VPN, proxy, or firewall.

    If you think you’ve got a secure password, you’re wrong:

    Torpig bots stole 297,962 unique credentials (i.e., username and password pairs), sent by 52,540 different Torpig-infected machines over the ten days we controlled the botnet

    If you think a separate password manager will save you, you’re wrong.

    It is also interesting to observe that 38% of the credentials stolen by Torpig were obtained from the password manager of browsers, rather than by intercepting an actual login session.

    Somewhat more info on Mebroot from F-Secure.

    Remember, the virus / worm / Trojan / botnet attacks you read about all the time only affect Windows machines. Linux isn’t invulnerable, but it’s certainly safer right now. If you’re running Windows, it’s only a matter of time until your PC is not your own, no matter how smart you think you are.

    If you have one or two must-gotta-use Windows programs, set up a dedicated Token Windows Box and use it only for those programs. Network it (behind a firewall) if you like, but don’t do any email / Web browsing / messaging / VOIP on it. Just Say No!

    For everything else, run some version of Linux. It’ll do what you need to get done with less hassle and far less risk. It’s free for the download, free for the installation, and includes all the functions you’re used to paying money for. Just Do It!

    If you think using Linux is too much of a hassle, imagine what putting your finances back together will be like. Remember, the bad guys will steal everything you’ve ever put on your PC, destroy your identity, and never get caught.

    Now you know… why are you still stalling?

  • Halogen Spotlights: FAIL

    Exposed Halogen Spotlight Bulbs
    Exposed Halogen Spotlight Bulbs

    This pair of halogen outdoor spotlights has been in place for at least a decade; they don’t see much use, so the filaments haven’t burned out in all that time.

    A lens fell off a few days ago, at which point I realized that it was the second lens to fall off; where the first one got to, I cannot say. I suspect they’ve never been turned on in the rain, as a single drop of water on a halogen capsule would shatter it like, uh, glass.

    The right-hand bulb was evidently the first to fail, as it’s full of toasted spider silk, seed husks, and bug carapaces. The reflector aluminization doesn’t like exposure to the Great Outdoors, although it’s in surprisingly good shape for the mistreatment it’s seen.

    I installed a pair of ordinary fused-glass spotlights from Ol’ Gene’s stash that Came With The House; they’ve been in the basement at least as long as those halogens have been on the side of the house. I suppose he put the good spots up there and kept the plain ones in reserve.

    Maybe the “new” spots will last for another decade?

    [Update: frienze reports another bulb failure…

    Submitted on 2014/05/30 at 10:44
    I searched for a more on topic post to stick this, but — alas! — it seems to be closed for commenting.

    Before tossing out the bulb, I decided to take a few pictures.

    Overview
    Overview different angle
    Detail of failure
    Less useful detail turned the other way around

    I half suspect the bulb might not actually be broken in the strict sense of the word, but I decided against actually testing that theory.

    Trying to show the broken socket part is a lot harder. It doesn’t photograph well.
    The broken socket
    What the connector is supposed to look like (in a socket part that arrived broken just like that straight from China… and it’s not like it broke in transit; the protective top simply wasn’t there at all)
    Here you can maybe see it a bit better
    And here it is next to some dried garlic
    ]

  • Garden Fork Repair

    Mary intercepted a complete, albeit defunct, garden fork on its way to the trash and brought it home for repair. It turns out that the handle’s socket had loosened and split around the tine shank, but all the pieces were pretty much in place.

    Looks like a job for JB Weld Epoxy!

    Mix the epoxy with my dedicated mixing screwdriver, butter up the shank, blob the excess epoxy into the socket, shove the parts together, clean off the outside globs, and let it cure overnight.

    The trick is to get enough epoxy in the socket to fill the voids and mechanically lock the shank in place. This probably won’t work for forks used by burly guys who heave rocks over the horizon, but for our simple needs it’ll do just fine.

    Every now and again it’s OK to do an easy repair without a trace of CNC…

  • My Eyeglass Sizes: A Summary

    Having decided to try getting sunglasses from one of those “our lab is in Hong Kong” places, the question arises: what lens & frame size do I need?

    Rummaging through the heap produces this assortment:

    Frame label Lens size Frame width Earpiece Commentary
    53-19 53×40 141 145 Current glasses
    55-16 55×45 142 140 Current sunglasses
    54-16 54×45 133 135 Old sunglasses
    56-16 56×45 137 133 Wire rims, aviators
    52-19 52×39 140 140 Clear, previous daily
    56-16 58×50 135 130 Aviators, too big

    The obvious conclusion is that any lens in the low 50s x 40-ish range will suffice. Pity that the LPS (low-price supplier) doesn’t have anything non-aviator-ish or un-dorky (even by my slack standards) in the 40-ish range, but maybe it’ll work out OK.

    Some general observations.

    I used to wear relatively large aviator-style lenses, as I worked on little parts that occasionally went sproing. Not enough energy to merit safety glasses, but annoying enough to want good eye coverage. These days, alas, I tend to wear a headband magnifier.

    Progressive bifocals require a relatively tall (and, it seems, currently unstylish) lens. Aviators solve that problem, but really are too large for my face. No matter that I wore them for years.

    Anti-reflection coating is wonderful. Pity that the LPS can’t put it on tinted lenses; I’ll see how that works out.

    I wear one pair of glasses all day, every day, and take fanatic care of them; we have an ultrasonic cleaner pretty much dedicated to eyewear. By and large, my lenses last forever. The frames, as you’ve seen there, tend to fail first.

    [Update: It turns out 53×35 lenses really aren’t tall enough for gray 20% transmission sunglasses: the progressive transition is a bit cramped and there’s too much daylight around the top & bottom. I think they’ll be OK for biking, as I wear hideous goggles to keep the dust out of my eyes. A pupillary distance of 62 seems OK. About $63 delivered.]

  • TaxAct vs TurboTax: The Bottom Line

    After considerable bashing & crashing, both TurboTax and TaxAct produced the same bottom-line number. TA requires considerably more manual intervention in spots where TT simply does the right thing.

    The NY state tax refund apportionment issue is entirely non-obvious; if we hadn’t been running TT in parallel we’d have missed that one entirely. The need to manually patch up the maximum IRA contribution limits took a while to figure out, too, as we’d based our contributions on half the total, which put one of us over the “limit” computed by TA.

    TA does have linkages to (some of) the source lines used in its calculations, but doesn’t have nearly the same level of hand-holding as TT.

    TaxAct is far less expensive overall: $20 with “free” Fed plus $8 for NYS e-file. TurboTax is about $45 with “free” Fed and $20 NYS e-file. Basically, you can buy TaxAct and file both returns for less than the base cost of TurboTax.

    You could probably use TaxAct for most personal returns with no problems other than the state tax refund gotcha. It’s marginal for the complexity of our return.

    So our bottom line is that we might just continue to run both in parallel next year:

    • TurboTax wins hands-down for closely following the gruesome details of the tax code.
    • TaxAct wins for cross-checking and less-expensive filing

  • TaxAct: Roth IRA Calculation Puzzlement

    Another issue with TaxAct, which seems to have arbitrarily divided our Earned Income amount between us for the purpose of computing the maximum IRA contributions.

    My query to Tech Support:

    Line 8 of the Roth IRA Contribution Worksheet produces the correct value for our return.

    Line 9 divides that number into two unequal parts, placing the larger part in the first column as a calculated (blue) value and the smaller part in the second column as an editable (green) value.

    The two parts in Line 9 add up to Line 8, which is correct.

    However, we do not understand why the two values in Line 9 are not equal. There is no link to an explanation and the “Forms Help” does not address this issue; we cannot find any basis in IRS Pub 590 for initially dividing Line 8 into anything other than two equal parts.

    We have changed the smaller part to half of Line 8, whereupon the larger part correctly adjusts itself to the same value.

    What is the tax-law basis for the initial calculated values in Line 9?

    Thanks…

    The reply:

    Dear TaxACT(R) Customer:

    Initially the TaxACT program will divide the amount proportionately to income.  If you follow the questions and answers through to complete your return, you are prompted to make the needed adjustment.

    Now, as it happens, there dosn’t seem to be any division of our income that produces the observed difference; it’s not obvious how TaxAct defines “income” for this purpose.

  • TaxAct: State Tax Refund Apportionment FAIL

    We’re running TurboTax and TaxAct in parallel this year and came across a difference in how they handle state tax refunds.

    As nearly as I can express it, if you itemize deductions and made estimated tax payments for 2007 and made a payment for 2007 in January 2008 and got a state tax refund in tax year 2008 for 2007, then you must reduce the refund by the fraction of your 2007 estimated tax paid in January 2008.

    The question I submitted to TaxAct was:

    According to IRS Pub 525 (2008), state tax refunds must be apportioned according to the estimated tax amounts paid in each quarter for users making itemized deductions. The Pub 525 “Example” in the middle of the second column on page 22 explains our situation.

    TaxAct accepts the total refund amount as an input from our 1099G and accepts the 2008 estimated tax payments, but does not (seem to) have any mechanism for allocating the refund based on 2007 (not 2008!) estimated payments.

    There is no provision on the “State and Local Tax Refund” worksheet for this calculation.

    We are using TurboTax to cross-check our work. It prompts for the actual 1099G amount and the 2007 estimated payments, then calculates the correct amount on a separate “Sched A Line 5 Worksheet” and feeds the result into Form 1040 Line 10.
    However, TurboTax has imported our 2007 return, so it (presumably) knows about the dates for those estimated tax payments. TaxAct does not and we have not found a place to enter those dates and amounts.

    We think the workaround is to input a bogus 1099G amount by subtracting the unrecoverable part of the refund ($100 in the IRS example) from the actual 1099G amount ($400 in the IRS example), then also subtracting that amount from the “Prior year state and local estimates” line in the Sched A Line 5 calculations.

    Does TaxAct handle this situation in a manner we have not discovered?

    If not, is our workaround the correct way to handle this situation?

    We were unable to find any TaxAct documentation explaining this situation, but perhaps we were not looking in the right place. Is it documented anywhere, other than in Pub 525?

    Thanks …

    Which generated this reply:

    Dear TaxACT(R) Customer:

    The TaxACT program does not make these calculations.  The work around that you suggested is the easiest solution to this problem.  If you make this adjustment to the 1099-G, you may want to attach a note to the return showing what you did.  To do this:

    Preparer Notes can be used by the paid preparer, electronic return originator or taxpayer to provide additional, voluntary information related to the tax return but NOT required to be attached to it.

    To access these screens in the Online return:
    1. Click on the Federal Q&A tab
    2. Click on Miscellaneous Topics and then Click on Review Topic on the Quick Q&A Topics screen (you will only see the Quick Q&A Topics screen if you have been through the Federal interview questions once already)
    3. Click on Additional Information for Electronic Filing (the last one in the list) and then Click on Continue
    4. Click on the electronic filing information option for your situation and then Click Continue

    This will electronically file with the Federal return, however, will not be transmitted to the state.

    So, basically, unless you happen to be intimately familiar with this bit of tax arcana or you’re using TurboTax, you’ll get sucker punched. As nearly as we can tell, it doesn’t make much difference to the bottom line, but you don’t want to find that out the hard way.