Barcamp Chennai 2 - Interesting!
October 19th, 2008
Hello friends! Barcamp Chennai 2 was superb! It was 2 days of fun. What was surprising this time is the sheer number of new faces in the crowd and the number of non-tech sessions. The non-tech sessions were high this time, though the tech sessions were pretty basic ones. Lots of networking happened this time and I came across a really cool bunch of people with whom I will be in touch.
Day 1
Yesterday morning, I attended a session on Git, by Sreeni from ThoughtWorks. Its a source control system which was developed by Linus Torvalds. I recently signed up at GitHub to host the SMS Web Service program & this session was really very helpful in getting me started. Next session was intro to Ruby on Rails by Prakash from ThoughtWorks (this was in a different track). Most of the hall roared with laughter when one of the campers asked what the difference between Rails and Javascript. Hmm! With this question I came out of the hall and met Kausik, Bharadwaj, Moyeen, KAPP, Shyam and a few more guys. We were discussing about programming languages, mainly about python and various IDEs. I also struck a deal with Shyam to collaborate on an open source mobile project. More details about it will be available soon.
By the time we finished our discussion on the hallways, it was lunch time and we headed to Tiffanys. We ragged Moyeen
about his GF and stuff. Moyeen is a good sport you see
so we had a nice time. Post lunch, there was a session on linux kernel basics and then came the best session of the day.
It was on Open Street Maps by a final year engineering student named Arun Ganesh. Open Street Maps is a community effort to map out the whole world. A wikipedia of sort for mapping. Arun had done some seriously good tasks of mapping out Teynampet & sharing it with the post offices in his area to get it validated. He also pointed out that, where Google or Yahoo maps take a few years to map changes in locality, those changes are reflected relatively immediately on OSM. That’s mainly because of the volunteers who edit the maps on a day-to-day basis. Unlike Google or Yahoo maps, OSM allows you to change the underlying mapping data itself, which is pretty cool. When Arun showed the OSM website on his browser, someone asked what the software was
The audience brought the ceiling down by laughing. I was pondering about building a mobile software for displaying OSM on Symbian mobiles. Interested anyone? I may start this in a couple of month’s time.
My session on the recent “Assign Categories” wordpress plugin was next. Response was good
and I’m happy. After this, there was a session on web 2.0 (old stuff?) but then, myself and a few others used the law of two feet and discussed various other topics between cups of coffee. I also answered a few questions on my wordpress plugin during this time. Day 1 came to an end with this.
Day 2
Today was superb I should say. The first session was from Viru [viru {at} physicssociety {dot} com] about “Indian Education System Sucks”. The word ’s**ks’ provoked the audience very much and what followed was very hot debate with a few solutions to the current problems. Solutions being that students should be allowed to ask questions and teachers should encourage that. Also, more amount of practicals should be introduced in the curriculum for understanding the subjects better rather than mugging up. I believe CBSE has solved part of the problem here. By making the syllabus huge, they have effectively discouraged students from mugging up & vomiting. So, to answer questions in the exams, they have to understand the subject well; else they flunk. There are lots of side effects to this. But we will discuss it some other time.
Second session was on “Global Financial Meltdown” by Syed, Sukumar and Ganesh (of Rupya). It was superb. Though I did follow the news on the financial meltdown, I learnt a lot from the discussion. One specific portion that still stays fresh is the news that India Inc. is spending Rupees 1 Lakh Crore to help the failing banks. They are buying stock at a discounted rate and imagine the returns when the meltdown ends!
. There was also a small discussion on how it affects the IT industry. Software service companies have to be on watch was a view that was shared by everyone.
Post lunch, the talk was on “Disaster Management”. Since Mr. Mani, DSP of Police couldn’t turn up, it turned into a fun group discussion. The hall applauded when Sukumar advised the campers to take “good care” of our lives. Point well taken.
After this it was time for our discussion using the law of 2 feet & then it was time for Thomas’ session on “How to become an innovator”. Crux of the talk is that, you have to condition your mind in to thinking out of the box and he recommends the books written by Edward De Bono. Siddhi’s session on creating a really good office space was enlightening as well. On the whole, Day 2 rocked and I learnt plenty of things today.
Wifi
Wifi sucked
Most of the time, it didn’t connect. Wifi Gurus are most welcome to share gyan on how to setup a reliable wifi for (un)conferences. May be this would have been a great session at Barcamp.
Photos
Please search for BCC2 or BarcampChennai on Flickr and other places.
Crowd size was optimum this time, which made the sessions all the more interactive. Were you there and I missed talking to you? If so, please drop a comment and I will get back in touch with you. Thanks!
Barcamp Chennai 2 happening today & tomorrow
October 18th, 2008

Yay! barcamp chennai second edition is happening today and tomorrow at IIT Madras in the IC & SR auditorium. The previous barcamp was truly awesome and I sincerely hope, this one will also meet the expectations. There are lots of interesting talks lined up and whats even more interesting is that, there are lots of new faces this time :D
We are also planning for an all-night code camp for tonight. If its happening, I will post more details about it here. If you are attending, do let me know. I will be around. For more details about barcamp, check out http://barcampchennai.org/.
If you are taking pics/videos/tweeting about the event, use the tag “BCC2″. That would make it easier to search and find the relevant pics, blog posts and videos.
See you there!
Bulk Assign Categories to Multiple Posts
October 14th, 2008
Here’s a cool new wordpress plugin that allows you to assign one or more categories to multiple posts in a single shot, with or without preserving existing categories.
This plugin will be very useful when you are migrating to your own wordpress blog, hosted on your domain. The default wordpress functionality is that, you can assign new categories to posts only by editing each post and changing the category assigned to it. So, if you have a large number of posts, then it will be a nightmare.
Enter this plugin.
With this plugin, assigning multiple categories to one or more posts is a breeze. Pop the plugin’s PHP file to your wordpress plugin directory, activate it and click on “Assign Categories” under the Manage menu. The page will show the list of available categories, followed by the available blog posts. You can select the categories, select the required posts and then click on “Assign Categories” at the bottom of the page. Now, all your posts will be assigned the new categories.
Currently, the plugin is in “beta”. The beta will go off in a few days and will contain search functionality also. The plugin has been updated with search functionality. Please download the plugin again.
The plugin is licensed under GPL v2 (the same as wordpress).
Download the plugin, take it for a test drive and let me know.
Microsoft TechVista
October 2nd, 2008
Microsoft Research (MSR) India conducted TechVista yesterday, a symposium by MSR to showcase some of the hottest research that’s been happening. The talks were interesting and so were the posters presented by various students from top notch colleges, some of whose research is sponsored by Microsoft.
After the usual keynote, the real talk began by 10.45 AM. The talk was about the “Future of Computing” by Dr. John Hopcroft. It was a very insightful talk with details about ‘the cloud’ that I could relate to; and also about information storing and retrieval in digital form. The next talk was by Dr. Richard Szeliski about “Weaving the World’s Photos”. This talk was more about Photosynth and the technology and algorithms that go behind it. The talk was simply awesome; especially the place when they mentioned about the SIFT and RANSAC algorithms. SIFT determines similar points in 2 photos taken from different angles while RANSAC is able to stitch those points together and form a 3D model of the image. Considering the fact there are 1000s of photos online for a popular place (E.g. Taj Mahal), with photos taken from different angles, the SIFT and RANSAC algorithms brings about the 3D model of the place. Then these points are optimized and the resulting images are stitched together. When pictures are more detailed and where users have tagged those details, these pictures are used when users zoom in and zoom out of the 3D model. It also removes all the “noise” from the photographs and gives an almost seamless 3D experience.
The next talk I attended was by Dr. Shafi Goldwasser about program obfuscation and one-time programs. I could related to this talk because of my very recent experiment
and paid full attention to this talk. I was smiling when one of her slides contained the last paragraph of this blog post from YUI blog. Many points in her slide were eye-opening such as ROKs and the slides that said where obfuscation fails.
It was lunch now. Somehow, most of these conferences mangle up lunch so badly that we want to give out a blood curdling yell. As soon as the morning session talks were over, myself and a few guys walked over to the Professors and were asking them a few doubts. By the time we went for lunch, most of the good dishes were over. So were the desserts
The talk immediately after lunch was some marketing blah blah about MSR that was putting me to sound sleep. I woke up and went to the poster presentations to check out what the Ph.D students had done. Some of the posters were really cool! I liked the ones on “Understanding the dynamics behind evolution of stable peer-to-peer networks” by Bivas Mitra from IIT-KGP, “Secure Distributed Computation and Communication” by Arpita and Ashish from IITM and PULRP by Deepthi and Kannan from IITB. It was about an hour by the time I finished looking through the posters. With my sleep vanished, I headed to main hall again to check out the next talk.
This talk was about “Computational Camers” by Dr. Shree K Nayar. It was just awesome! When I was college, I did a paper on Digital Image Processing and almost cried because of the complex equations
All of those were coming back in my head when this talk was going on. May be if I had known earlier, I would have applied for MSR as soon as I had passed out.
With this talk getting over, one of my friends who was a finalist of my batch’s MSAPP had come to the venue. Just as myself, Dhaval and Subhamoy were getting intro’d to him, we delved deep into quantum and relative physics, with a bit of astronomy thrown in. That twisted my brain in some crazy ways. Our discussion happened for more than 2 hours and I learnt a lot more from this discussion than from the ones that were happening inside at this time.
Oh! while I was talking to Subhamoy, he casually mentioned this story. His mobile had fallen in water & when he switched it on, it got short circuited. So, he removed the panels, took the mobile circuit to this lab, found the short circuits and resoldered everything again in their proper places. He is still using that same phone. THAT WAS AWESOME!
All-in-all, it was a day spent very well
I enjoyed every moment to the core.
Dissecting iMobile - Security Analysis of ICICI Mobile Banking App
September 27th, 2008
ICICI Bank’s iMobile website has some of the worst server side validations ever, which is what prompted me to download the mobile app’s JAR file, study it in detail and write this post. According to the website, until the Reserve Bank of India comes out with mobile banking guidelines and approves it, mobile banking is supposed to be halted. Technically, it means that, all existing users shouldn’t be able to use the service what-so-ever and new user signups should be prevented & a notification stating that they should retry later should be shown.
Therefore, in this scenario, I shouldn’t have been able to download the app to my mobile device. The website of ICICI fails in not enforcing this by providing the following ways:
- Existing users who have already installed the app are given an option to ‘Upgrade’ from within the mobile app itself. This opens up a webpage in the phone’s native browser, whose URL is http://mobile.icicibank.com/upgrade?version=null.
- The actual iMobile website has some stupid javascript validation, which is very easy to bypass using modern browsers. Heck, just by browsing the HTML source code of the page, you will be able to easily find the URL for the application JAR files. Put 2 and 2 together and you will be able to download the app.
Which brings me to explain Step 2 in detail:
document.jump1.action="https://infinity.icicibank.co.in/web/apps/"+fileName;. That line pretty much gives away everything. All you have to do is, navigate to the above mentioned URL and append a filename to it for download.What filename do you have to give and How?
Where ICICI Bank failed?
- They should have disabled the link mentioned in #1 above and replaced it with some text that says, “RBI mobile banking guidelines blah blah…”. But some clever users will bookmark the link to the JAR file and try to access the JAR file by bypassing the link itself. When they do that, the web server should return a “404 - Resource Not Found” error. Got it? Implementing this is pretty simple.
- There shouldn’t have been such a lot of useless javascript on the page. Firstly, they should have removed the device selection drop down box. Secondly, they should have replaced this page with an alternative. Thirdly, this mobile banking link should have been removed in the home page itself. Fourthly, they should have validated on the server for JAR file downloads and should have displayed the “404 - Resource Not Found” error page.
- Ok. Leave aside #1 and #2. At least the mobile app should have thrown soft errors when users try to access mobile banking from the JavaME app. Any bank would store all activity data for a certain period of time. So when you access the bank’s service from a mobile device, the server software surely knows about it, which means, the server software should have returned errors to the user instead of allowing the user to do transactions.
- There’s one more bug in the app itself. When you launch the app, it will prompt you to sync the data on the device to its servers for faster access the next time. When you click “OK” to synchronize, it will wait for a few minutes and show a message as, “There is no data to synchronize”. When you proceed further and try to access your info, it will again prompt you to sync the data. That’s frustrating. Either you should sync the data properly or you should access the server every time over a secure channel. As simple as that. That’s not followed too.
That was a long post already
We still have some more to go. Lets take a break.
Back? Ok
Now, lets dissect the actual JAR file and look into the technical details of its implementation.
The Manifest File:
Another important item is, “MIDlet-Name” property in the manifest. This property determines what name the user sees after he installs the app on his mobile. Using the same name, when future upgrades are made available, the app is just replaced in place of the old one, which means, if you modify the “MIDlet-Name” property and install the app again, you will have 2 copies of the same app. THIS SHOULD NEVER BE ALLOWED FOR A HIGHLY CRITICAL FINANCIAL APPLICATION. Isn’t it? As an example, try changing the MIDlet-Name of the Yahoo! Go JAR file and try to install the app again on your mobile. My E51 shows an “Invalid JAR” error message because of MD5 sum checks etc.
Some more Holes:
What should the bank do here?
- Shouldn’t allow the installation of 2 apps of the same JAR with different names. Take this example of the Yahoo! Go JAR file.
- I guess these mobile providers’ socket URLs are used for a one time basis to send verification SMS. If that be the case, they shouldn’t be present in the manifest file for a variety of reasons that I won’t discuss here.
- There’s an interesting property named “WSCDomainName” in the manifest file. I guess it expands to “Web Service Client Domain Name”, though I’m not sure about it. Suggestion: Encrypt the name value pairs.
- Most importantly, sign the application using the Java Signed program. C’mon, users are doing financial transactions and a signed app will increase their confidence of using this application.
Suggestion for Users:
Thats about it !
Of course, this blog post can’t be termed as a full fledged security analysis. But most of what has been ignored by the bank are mere basics. They must have more secure systems in place.
If you liked this article, kindly do me a favour by digging it. Thanks for your time.
Send Free SMS - Web Service
July 17th, 2008
27/Sep/2008 - Important Update 3: The web service has been updated yet again. If you are using the script on your own server, then please download the zip file again. Extract this zip file in the same place where sendsms.php is currently located and you should be good to go.
02/Sep/2008 - Important Update 2: The web service has been updated. If you are using the script on your own server, then please download the zip file again. Extract this zip file in the same place where sendsms.php is currently located. The zip file now contains an extra file named “htmlparser.inc” (version 1.2) from PHP HTML Parser. It’s an awesome library to parse HTML using PHP.
Important Update: After this comment from cssk, the web service has been updated. If you are using the script on your own servers, please download it again from here and just replace the existing file. Others, who are just accessing the URL on my domain needn’t make any changes to their code.
Hi friends, if you are in India and if you are developing software prototypes which has to send SMS alerts to various Indian mobile numbers, you needn’t spend a lot to buy SMS credits at the various sites. Over the last weekend, I spent some time hacking up a quick SOAP based web service which you can consume in your programs.
Before we proceed further, here are a few things you have to do:
- Get an account at http://www.way2sms.com/. Its a free SMS service and has tons of advantages; including 92 characters per message (rest of the characters are ads) and unlimited number of messages per day.
- Now you can invoke the web service in two ways from my domain itself. Web service endpoints and other notes given below.
- You can get the PHP source code and set it up in your own server.
Invoking the Web Service:
- The web service end point is at http://www.aswinanand.com/sendsms.php?wsdl. More details on how to consume a web service using Visual Studio is available here. Feel free to try with other languages and IDEs and let me know.
- Instead of consuming the web service, you can invoke the URL directly with the four parameters. Parameters are:
- uid = your way2sms user id
- pwd = your way2sms password
- phone = semicolon separated list of phone numbers
- msg = actual text message
- An example URL format is http://www.aswinanand.com/sendsms.php?uid=__USER_ID__&pwd=__PWD__&phone=__NUMBER__&msg=__MSG__.
Setting up the web service in your hosting space:
- Grab the SMS web service source code from here. The source code is licensed under “Creative Commons Attribution-Noncommercial”. Make sure you agree to the license terms before downloading
and kindly link back here or digg it. - Get the NuSoap library and upload it to your server. You may want to change line number 50 in our web service source code to point to the proper location of NuSoap on your server.
- Now as mentioned in the section above, you can now use the web service from your domain. Just replace “http://www.aswinanand.com/” with “http://www.your-domain.com/path/to/source/” and you should be good to go on your own :D
Improvements:
Of course, there are lots of improvements that can be made to this service. Way2SMS console gives you a list of all the messages that have been sent from your account so far. So, you could write another web method and expose it; which returns all the messages so far in the form of RSS feed, ATOM feed or JSON.
Any text after the 92nd character in the SMS is cut off. We could write a simple loop after line 36 to send multiple messages if the number of characters exceeds 92.
We should also be able to retrieve the list of contacts that are saved in Way2SMS as JSON feeds and reuse them to send messages instead of typing in mobile numbers directly.
I will update the script as and when time permits and update this space. Keep watching for more. This sort of web services can be developed for almost all SMS web sites. If you are developing a similar script for other SMS websites, let me know.
Some boring blah blahs:
- The code is not production grade. It was hacked quickly over a weekend. So use it at your own risk.
- You cannot hold me responsible for whatever problems that may occur for you in using this web service.
You could also do me a small favour by digging this post. Thanks!
RSS Feed Proxy - Finally one data format to parse all feeds
July 12th, 2008
Hey guys! I discovered two feed proxies.
- http://www.netvibes.com/proxy/feedProxy.php?test=1&url=__FEED_URL__
- http://my.live.com/cfw/news.aspx?fetchurl=__FEED_URL__
Replace the __FEED_URL__ with the feed URL of your choice. Of the two feed proxies above, I like Netvibe’s proxy as the best because of the following reasons:
- Feed output is JSON. This means that, netvibes has done all the necessary work to convert feeds of any type (RSS, ATOM, RDF etc.) into JSON.
- If you are writing a script to examine feeds from various sites, you have only one data structure to deal with
- Almost all programming languages support JSON. Refer to www.json.org for JSON libraries available for various programming languages.
- JSON by itself is very lightweight and eliminates most of the overhead of XML, thereby preserving bandwidth.
- A simple program in VB.NET to parse a JSON structure and get the required feed data in a Dictionary datatype is only about 9 lines of code. In Ruby, it will be even lesser. Compare the same with XML output. Even though feed parsers are available, you have to create your own wrapper above everything to get everything to work out properly. Reuse what you already have (DRY Principle). Netvibes has already done the bull work to convert all kinds of feeds into a common format.
- Best of all, no authentication is necessary to access these links :D
Live.com’s feed proxy returns the actual feed output. So, if the feed you are referring to gives RSS output, this proxy returns that. The same happens with ATOM, RDF etc. Keep watching this space. I will update the post with other feed proxy URLs that I encounter. If you go across any, please mention them in the comments section.
An ode to Ruby
June 21st, 2008
One of my juniors in college named Satish has written this small wonderful piece on Ruby (programming language).
Ruby makes a programmer smile
even when he’s using while
all the if’ and else’ and do’
reduces the work you do
kernel methods work like charm
conventions make work a form
all the while you reap the fruits
everyone gives java the boots!
Cool ! Ain’t it? ![]()
How To: Open a root terminal in Ubuntu
June 10th, 2008
I was playing around with Ubuntu & installing a few stuff from the terminal. One problem that quickly became a pain in the rear is that, I had to `sudo` everytime and give a password whenever a command that required admin privileges had to be run. Since, I was installing a few stuff, almost all commands required admin rights. So, without much ado, here’s how to open a terminal with permanent root privileges.
- Press Alt+F2. The “Run Application” dialog will pop up.
- Type “gnome-terminal” in the dialog and press “Enter”. This will open a new terminal window without admin rights.
- Now, in the new terminal window, type “sudo gnome-terminal”. You will be asked for your password. Give your password and press “Enter”. A separate terminal window with root privileges will open now. This is immediately visible because the usual “$” prompt changes to a “#” prompt.
There you go,
three cool steps to have your terminal with admin rights. If you press “Ctrl+Shift+N” from this new terminal, it will open another terminal window, which also has root privileges.
NTFS, Gmail Keyboard Shortcuts
April 18th, 2008
Two things today:
Few days ago, I was searching for information on NTFS and found 2 amazing articles from the good old MSJ (Microsoft Systems Journal). The links are below. Do go through them when you find time. Even though the articles are old, they offer a wealth of information.
- Windows NT 5.0 File System - http://www.microsoft.com/msj/1198/ntfs/ntfs.aspx
- NTFS Change Journal - http://www.microsoft.com/msj/0999/journal/journal.aspx
There are lot more articles available. I will post the links as and when I read them. Nice stuff !
As you already know, I have enabled keyboard shortcuts on my gmail account. Gmail actually shows you the list of available shortcuts right inside your mailbox, without us having to visit the keyboard shortcuts page. To access the list of keyboard shortcuts, you need to press “?” key, which is “Shift + /“. You will get the translucent black popup as shown in the below screenshot. You can press any key to close it.
Click the image to see a larger version.

