View From The Edge

Bailouts

2011-12-06T13:46:00.001+01:00

It is a slow day in a little Greek Village. The rain is beating down and the streets are deserted. Times are tough, everybody is in debt, and everybody lives on credit.

On this particular day a rich German tourist is driving through the village, stops at the local hotel and lays a $100 note on the desk, telling the hotel owner he wants to inspect the rooms upstairs in order to pick one to spend the night.

The owner gives him some keys and, as soon as the visitor has walked upstairs, the hotelier grabs the $100 note and runs next door to pay his debt to the butcher.

The butcher takes the $100 note and runs down the street to repay his debt to the pig farmer.

The pig farmer takes the $100 note and heads off to pay his bill at the supplier of feed and fuel.

The guy at the Farmers' Co-op takes the $100 note and runs to pay his drinks bill at the taverna.

The publican slips the money along to the local prostitute drinking at the bar, who has also been facing hard times and has had to offer him "services" on credit.

The hooker then rushes to the hotel and pays off her room bill to the hotel owner with the $100 .

The hotel proprietor then places the $100 note back on the counter so the rich traveller will not suspect anything. At that moment the traveller comes down the stairs, picks up the $100 note, states that the rooms are not satisfactory, pockets the money, and leaves town.

No one produced anything.

No one earned anything.

However, the whole village is now out of debt and looking to the future with a lot more optimism.

And that, Ladies and Gentlemen, is how the bailout package works ;o)

(PS: Of course, the real problem facing Europe is that the rich German DOES indeed realize what is happening and doesn't want the Greeks to get off scot free and so is demanding his cut in the way of interest on the $100!)

Dog For Sale

2011-11-11T18:28:00.001+01:00

A guy is driving around the back woods of Montana and he sees a sign in front of a broken down shanty-style house: 'Talking Dog For Sale' He rings the bell and the owner appears and tells him the dog is in the backyard.

The guy goes into the backyard and sees a nice looking Labrador retriever sitting there.

'You talk?' he asks.
'Yep,' the Lab replies.

After the guy recovers from the shock of hearing a dog talk, he says 'So, what's your story?'

The Lab looks up and says, 'Well, I discovered that I could talk when I was pretty young. I wanted to help the government, so I told the CIA.

In no time at all they had me jetting from country to country, sitting in rooms with spies and world leaders, because no one figured a dog would be eavesdropping.'

'I was one of their most valuable spies for eight years running...

But the jetting around really tired me out, and I knew I wasn't getting any younger so I decided to settle down. I signed up for a job at the airport to do some undercover security, wandering near suspicious characters and listening in. I uncovered some incredible dealings and was awarded a batch of medals.'

'I got married, had a mess of puppies, and now I'm just retired.'

The guy is amazed. He goes back in and asks the owner what he wants for the dog.

'Ten dollars,' the guy says.

'Ten dollars? This dog is amazing! Why on earth are you selling him so cheap?'

'Because he's a liar. He's never been out of the yard'

Why iOS Data Protection is Adequate for Corporate Use (And Why The Siri “Vulnerability” is a Non-issue)

2011-10-21T15:13:00.001+02:00

First things first. The so-called Siri "vulnerability" that was widely reported this week is a dumb non-issue created by journalists seeking sensationalist headlines. A simple setting disables the ability to use Siri without unlocking the phone rendering the whole issue moot. What the sensationalists fail to take into account is that the iPhone is a consumer device. Most consumers don't even use a passcode. The obvious default setting for Siri in this case, as one of the attractive new USPs of the iPhone 4S, is to allow use even when the phone is locked - I don't think you can fault Apple for this.

Now on the other hand, things need to change when these consumer devices are allowed in an enterprise. Exchange Active Sync (EAS) or Mobile Device Management (MDM) software should be used to apply minimum security policies, which should always include a complex passcode of more than 4 characters, auto wipe on multiple failed passcode attempts and, of course, disabling Siri without unlock (this latter capability would required MDM, since it is not available in EAS). There are many other security settings that should be addressed too, but the main one is the passcode.

Once the passcode is enabled, Data Protection is turned on. Now, Data Protection is NOT full disk encryption, although encryption IS turned on globally. However, you should assume that it only encrypts data in applications that support the Data Protection APIs (this is an over simplification, but the details are too complex for a blog post and are the subject of an Analysis Brief that will be available shortly to NSS subscribers).

Out of the box, that is the iOS Mail client, for example. Other commercial apps will support Data Protection too, though these are few and far between right now - GoodReader is one of the best known. Others include USB Disk Pro, mobilEcho and the Box.net iOS client. There are several more, but not enough of them given that these capabilities have been available since the pre-release of iOS4, and we are now on iOS5!!! This continues to be a sore point with me as many developers make a big deal out of pushing their apps as business-class, yet spend more time making nice UIs and not enough securing the data that they are supposed to be protecting. Bear in mind that these apps will typically be used to access corporate documents, in many cases storing locally on the device outside the control of corporate IT. That data needs to be encrypted.

With apps that support Data Protection, you have an additional layer of encryption on the iOS device. If you have a passcode set on the iPhone and you turn on Data Protection in GoodReader, all of the docs stored in the GoodReader sandbox will be encrypted in the same way as data stored by the Mail app. You can even have some data in the clear and restrict encryption to certain files or folders.

So far so good, but what about those “researchers” that have written about the fact that jailbreaking an iOS device or connecting one to Ubuntu will provide access to all data on that device? Yes, unfortunately it is possible to jailbreak an iOS device and completely bypass the passcode. There are other ways to bypass the passcode too (such as that issue with Ubuntu). Because of the way iOS implements the Data Protection capability, once the passcode is entered or bypassed, all of the data on the device that is not protected by Data Protection APIs specifically is unencrypted on the fly.

Therefore, if someone jailbreaks my iPhone they will be able to access all of the documents stored in the ReaddleDocs or PDF Expert sandbox because the iPhone will decrypt on the fly as the data is accessed. However, if they try to access my Mail data or anything stored in the GoodReader sandbox, they will only see encrypted data. Same thing goes for items stored in the keychain. Anything stored in the clear will be accessible when a device is jailbroken. Anything written using Data Protection APIs will remain encrypted.

Only by entering the passcode can that encrypted data become available. This is an important distinction that needs to be understood. Jailbreaking/bypassing the passcode DOES NOT BREAK iOS ENCRYPTION - it merely bypasses the basic protection on the device. Anything stored using Data Protection APIs WILL REMAIN ENCRYPTED EVEN FOLLOWING JAILBREAK.

There is no way to brute force the passcode off-device since it is tied to the hardware. If you have auto-wipe turned on, too many attempts to brute force the key on-device will result in a wipe. One nasty problem is that you CAN do brute force attempts on-device without triggering auto-wipe by bypassing the UI APIs that ask for the passcode, so that is why security-conscious folk need to ensure they use a longer, complex, alphanumeric passcode that will resist brute force attempts.

So there you have it. Could Apple’s encryption scheme be better? Yes, of course it could. There are some caveats, and I would have preferred it to be full-device encryption, or at least to have a central document storage area that is always encrypted by default. However, my opinion is that iOS devices are perfectly acceptable and secure enough for corporate use PROVIDING they have a sensible security policy applied, Data Protection is turned on, a complex passcode is used and any sensitive data is ONLY stored within apps that support Data Protection APIs. Corporate users should always ask iOS developers if their app supports Data Protection and avoid those that do not.

The Sophos post and original Fraunhofer research, and any others spouting similar opinions, can be dismissed with a simple analogy, since they appear to assume Data Protection is not being used - if that is really the case, it is like leaving your keys in the ignition and locking the door, then complaining when someone smashes the window and drives off with your car!

I am taking a significant number of inquiries from NSS client each week on this subject, proving that it remains confusing for many. I hope this helps a little. In addition, as I mentioned earlier, there are a couple of NSS Labs Analysis Briefs in the works covering iOS Data Protection and other security issues facing corporate users of consumer devices. These will be available to subscribers only. Follow me on Twitter (@bwalder) to keep informed as new research is released.

Testing Times for CISO's

2011-09-30T17:31:00.001+02:00

Performance and effectiveness claims from vendors of network security products can never be taken at face value. In a process crucial to making the right buying decisions, how do the CISO, CIO and other security professionals ensure that new in-line security products are tested thoroughly in an environment that replicates as closely as possible that found in his or her own network?

Selecting security products is a complex process that carries significant risks if not executed correctly; poorly chosen products can fail to protect against serious threats, cause serious performance problems for enterprise networks and waste scarce financial resources. CISO’s, CIO’s and other security professionals need to develop and execute an enterprise-specific in-house testing plan before evaluating and purchasing security products.

Failing to test security products before buying them means organizations run the risk of performance limitations, security failures and overspending. Weaknesses in security coverage can often remain undiscovered for long periods of time, leaving those organizations at risk of losing corporate assets or compliance status. Installing in-line security devices such as Firewalls, Intrusion Prevention Systems (IPS), and Secure Web Gateways can lead to a false sense of security unless vendor claims are verified. Critical servers often remain unpatched in the belief they are protected by an IPS, when claimed coverage is actually less effective than promised. In addition, fear of false positives can lead enterprises to run IPS devices in a less secure IDS mode, thereby forfeiting protective properties and increasing operating costs and risk. Selecting the wrong network security device can thus expose a company to serious threats from both inside and outside the network perimeter.

Poor performance from an in-line device once placed in a live network can also have serious consequences as latency increases to unacceptable levels. High latency or frequent “fail closed” events can result in active devices being redeployed in a passive state or having blocking disabled, significantly reducing their effectiveness.

Cost is an issue too. Without performing relevant tests in-house, organizations could be persuaded to overspend significantly, purchasing devices with performance and coverage levels that are not required.

In-house testing can help alleviate many of these problems, and it is important for organizations to use testing procedures designed for their own threat environment to determine the best in-line network security products for their specific needs.

NSS Labs has recently published an Analysis Brief covering key points CISO’s need to know about testing security products, entitled The CISO’s Guide to the Importance of Testing Security Devices (subscription required). Follow me on Twitter (@bwalder) to keep informed as new research is released.

How Will You Manage iOS5 Devices in Your Corporate Network?

2011-07-21T13:47:00.000+02:00

I have taken a significant number of inquiries recently from NSS Labs’ enterprise clients to discuss the increase in the level of demand for employee-owned devices to be used on corporate networks. One of the disturbing trends is the number of CIOs admitting that end users are connecting those devices to the enterprise network with or without permission. Where security requirements and risk profiles permit, many organizations would be better advised to accommodate and control this behavior rather than attempt to prohibit it.

In the past, it has been possible to enforce centralized control over mobile devices, and many companies standardized on single-vendor solutions such as the BlackBerry Enterprise Server (BES) from Research In Motion (RIM.) Users do not typically select Blackberry devices for personal use, however, and are bringing increasing pressure to bear on IT departments to permit access to corporate resources from a single device – their own.

In many cases, employees will discover for themselves how to configure their personal mobile devices for corporate access, leaving IT departments with a dilemma – locate and prohibit unauthorized access, potentially limiting employee productivity in the process, or embrace the consumerization trend and find a way to manage and secure access via personal devices.

IT departments need to exercise control over smartphone and tablet devices, whether company-owned or employee-owned. Employees are typically reluctant to cede control of their personal devices to IT. However, the added benefits of being able to access corporate resources such as email and file shares is frequently enough to persuade them to submit to some degree of centralized management.

With the release of iOS version 4, iOS devices such as iPhone, iPod Touch and iPad can be more effectively deployed, managed and secured in enterprise environments providing sufficient care is taken over securing the data on these devices and enforcing suitable corporate security policies. iOS5 will allow us to take things a step further, particularly given its ability to enable mobile devices to exist without being connected to iTunes (previously a huge bugbear for many organizations worried about deploying consumer-grade software in an enterprise network.)

One caveat here is that this move to a completely untethered, over the air (OTA) deployment scenario of the OS, updates, device activation, backup/restore, and even day-to-day synchronization may well introduce new attack vectors.

Business customers also need to realize that Apple continues to consider itself primarily a consumer company. It retains no sizeable enterprise sales force, offers no specific enterprise-level support (forcing enterprise customers to rely on third parties), and refuses to communicate road map details outside of the company. Organizations need to consider these issues as part of their evaluations of iOS devices for enterprise applications. One glimmer of hope is that the recent introduction of Apple’s B2B App Store program permitting volume purchasing of apps (though not yet volume discounting!) may mark the beginning of an increasingly enterprise-friendly Apple. Well, we can hope!

NSS Labs has recently published an Analysis Brief covering iOS management and security issues in more detail, entitled Managing iOS Devices Securely in the Corporate Network (subscription required).

I also have an Analysis Brief in production right now for our subscribers that will address the Data Protection capabilities in iOS4 and iOS5, and how they should be used to protect sensitive corporate data. Follow me on Twitter (@bwalder) to keep informed as new research is released.

Can you have too much security?

2011-06-23T13:44:00.000+02:00

Where organizations rely on application-aware security policies for their network security devices, or rely on Data Loss Prevention (DLP) products to prevent leakage of sensitive corporate material outside the network perimeter, the use of encrypted traffic means that those devices are suddenly blinded to the content, rendering deep packet inspection to the application level impossible. Cybercriminals are aware of this, and often make use of encrypted channels for covert command and control communications for botnets, as well as data exfiltration from the corporate network.

Given the risk that encrypted channels may be used by malicious entities for botnet command and control or data exfiltration mechanisms, enterprises are faced with an unpalatable choice – leave traffic in the clear or lose visibility into the encrypted data stream. Of course, there are solutions to the problem – there always are! – such as ensuring that network monitoring and security products can handle decryption, inspection and re-encryption of traffic on the fly.

The only issue is, how much of your already straining-at-the-seams security budget can you allocate to add SSL inspection capabilities to your infrastructure?

And while this may seem the obvious solution, on-the-fly SSL inspection can have a number of issues that need to be considered, not least of which privacy and performance. Vendor data sheets usually do not reflect accurately real-world impact on performance, forcing organizations to perform their own testing to ensure network security devices are fit for their intended purpose.

NSS Labs has a group test report in the pipeline covering SSL inspection capabilities of network security devices, and in the mean time, we have published a useful piece of research on What CIOs Need to Know About SSL and its Effect on Network Traffic Inspection Capabilities (subscription required).

Follow me on Twitter (@bwalder) to keep informed as new research is released.

Apple Gets Cozier With Enterprises With iOS5

2011-06-09T13:41:00.000+02:00

One of the most frequent questions I hear in inquiry calls with our enterprise clients at the moment is “how do we manage and secure iPads on our corporate network?”

Not “tablets” (at least, not yet), but “iPads” specifically.

Whereas the smartphone began the push for consumerization and “bring your own device” (BYOD) in the enterprise, the iPad has consolidated that move. The dynamic has changed because the iPad appeals equally to senior executives and mere mortals, and the IT department finds it much harder to push back when the CEO demands his corporate email on his new iPad. Secure board communications systems (BCS) are also something of a hot topic right now, and the iPad is making a significant impact in that market too, offering, as it does, an attractive alternative to lugging around giant paper-based folders of corporate documents.

With the release of iOS4, Apple introduced a number of features that finally allowed IT departments to consider the iPhone and iPad as “enterprise ready.” Mobile Device Management (MDM) APIs and Data Protection capabilities provided the means for enterprises to manage and secure both the devices themselves and the data stored on them.

Questions remain as how best to secure both device and data, and forthcoming research from NSS Labs on Data Protection and MDM will provide actionable advice to assist our enterprise clients in deploying these devices in corporate networks.

iOS4 still fell short in a couple of key areas when it came to enterprise deployment, however. The lack of secure email support and reliance on iTunes – a consumer-grade software product - for critical processes such as device activation and backup were two major concerns.

As expected, both of these will be addressed in the latest iOS5 release, though it remains to be seen how welcoming enterprise customers will be about certain aspects of Apple’s new baby. Having installed iOS5 on a few devices, I can say that it appears very solid so far for a beta product, though it is still missing some features that were promised in the WWDC keynote.

S/MIME support addresses the secure email concern adequately, and it appears to work well. I tested using both standard commercial and self-signed certificates, and digital signing and encryption functions worked fine for sending and reading messages. Certificates are installed via configuration profiles using the iPhone Configuration Utility (IPCU), following which they need to be selected for signing, encryption or both on a per-mail account basis. This process will need to be streamlined in larger deployments by the use of third-party MDM solutions in order to scale. Grabbing certificates from messages sent to you to store in the address book is a simple, one-click process.

The objection to iTunes has been addressed by the new “PC free” capabilities in iOS5. Apple explained at its developer conference that the aim was to add sufficient features on the device to remove the requirement for users to tether to their desktop. At the consumer end of things this includes features such as on-device photo editing, calendar creation and mailbox creation. For the enterprise, the killer blow comes with on-device activation and over the air (OTA) operating system updates, eliminating the requirement for iTunes in deploying iOS devices. Delta updates are also possible now, meaning that it will no longer be necessary to download the whole OS each time Apple issues a change. Backups will be achieved via the new iCloud service, and it remains to be seen how secure and acceptable this proves to be for enterprises (at this point in time I am unable to test all of the iCloud features.)

So nothing earth shattering, but a steady evolution of the system to make it ever more acceptable to enterprise customers. Apple could, and should, have gone further, however.

Multiple email signatures with per-account defaults is a feature to which users are accustomed on their desktop mail clients. This is still missing from iOS and, while not a major problem, is something I find irksome on a daily basis as a business user.

More serious is the continued omission of support for the iOS Data Protection APIs by Apple’s own “business” apps – Pages, Keynote and Numbers. Apple announced Data Protection with a fanfare with the release of iOS4 and informed us that, although Mail was the only native app to support those APIs back then, others would quickly follow. That appears to be an empty promise, since I am not aware of any other apps in the Apple stable that support the encryption APIs today.

This capability becomes even more important with the announcement of the multi-device synchronization capabilities of iCloud, which could easily see confidential documents created on a Mac desktop pushed out automatically and invisibly to iPhones and iPads, where they will rest unprotected.

Finally, we still do not have the ability to prohibit the creation and use of the escrow keybag when synchronizing to iTunes. This would be a simple feature to implement, and would provide an additional layer of protection for those relying on Data Protection capabilities to protect their data on mobile iOS devices. One other option would be to force permanent “PC free” mode, prohibiting iTunes synchronization at all, though that would require apps to support iCloud natively for file transfer, and is not something we are likely to see in the immediate future.

I have an Analysis Brief in production right now for our subscribers that will address the Data Protection capabilities in iOS4 and iOS5, and how they should be used to protect sensitive corporate data. Follow me on Twitter (@bwalder) to keep informed as new research is released.

[UPDATE]: Some have reported issues with S/MIME in iOS5, and the beta implementation does certainly seem to be a little "quirky" at the moment. I found issues when using certificates issued by public CAs such as Verisign, which I circumvented by installing self-signed certificates that I created using OpenSSL. Naturally, this does not play well in the world outside your test environment, but if you are just looking to test functionality, I found that both sending and receiving signed and encrypted messages worked fine using this solution.

Curated App Stores, Security, And Why The Next Kindle Will Be An Android Device

2011-04-17T13:38:00.000+02:00

We have been having some interesting discussions internally about the recent Android malware fiasco and how things need to be improved if Android ever wants to be taken seriously as an OS fit for use in an enterprise environment.

There has been some serious rhetoric against Apple's "walled garden" approach in recent months but, like it or not from a philosophical standpoint, it certainly provides more protection for users than the Android Market. Some claim that the Apple approach stifles innovation. Pah! (Yes, I said "pah" - add to that a "pish and twaddle", if you will.) One needs look no further than the sheer number of apps to shoot holes in that argument. Granted far too many of them are designed to emulate the passing of gas - some of us might argue that more controls are required, not fewer!

At the other end of the spectrum there are some truly excellent apps. Evernote, PDF Reader, TeamViewer, WebEx, GoToMeeting, Pages, Numbers, Keynote, QuickOffice, DocsToGo, SoundNote - these are all apps on which I rely daily. And for sheer awesomeness look no further than GarageBand and iMovie. No shortage of innovation and quality there then.

And from the point of view of the user - particularly the non-computer savvy user - all of this just works. Couple of clicks to search for your app. One click to purchase, download and install. And - most important of all - Trojan-free once it arrives. Curated app stores are essential to the well-being of the ecosystem.

Google needs to emulate that experience with its Market, though its very credo seems to suggest that will never happen. Yet without it the store will descend into anarchy, with users scared to purchase for fear of what new and terrible piece of malware they might be introducing to their phone or tablet.

So along comes Amazon from nowhere, and in one fell swoop it might have beaten Google at its own game. Amazon has the position of trust. It has the customer review infrastructure in place. It already has our credit card details (who hasn't bought anything from Amazon?) And now it has an Android Appstore (TM) to go with it. Now all it has to do is make sure that the stuff it sells is safe.

It has promised to do that, by applying both quality control and security vetting to the app review process. So why wouldn't you buy from there rather than the Google Android Market? Well, I would - I already have. But my Auntie Edna probably wouldn't. It is way more difficult than the Apple process, and right now requires a multi-step process just to get the Appstore app on your phone. It is not that difficult, but it is certainly a sub-optimal user experience compared with the "It Just Works" approach of Apple.

So what needs to happen for the Amazon Appstore (TM) to succeed? Simple - it needs to arrive pre-installed on Android devices. Lots of them. And while I am sure Amazon is probably in discussions with a bunch of carriers to achieve that objective, what better way to make sure it happens than to ship it in huge numbers on Amazon's very own Android tablet - The Kindle IV?

Give us that great Kindle experience with Android flexibility at a super-low price point, and you might just have your iPad-killer... I certainly haven't seen one among the devices announced so far.

Don't forget to follow me on Twitter (@bwalder) to be kept informed of new research.

Secure Low-Cost Data Sharing and Collaboration With iPad

2011-03-17T13:37:00.000+01:00

Cloud-based storage services offer a low-cost alternative to high-end enterprise-class collaboration tools. At the same time, a new class of intelligent mobile devices — smartphones and tablets, spearheaded by the iPad — is driving the need to share sensitive data while on the move. For many organizations, the basic requirement is the ability for a small group of users to share a set of documents related to a specific project.

With business needs and the sudden availability of viable mobile platforms driving this initiative, IT departments are struggling to determine the security of the cloud and mobile platforms that compose this new infrastructure. Senior management's adoption of new and attractive devices, such as the iPad, makes it extremely difficult for IT departments to prohibit their use on corporate networks. Dropbox and iPad have become an irresistible combination.

Given the availability and low cost of these low-end solutions, users are taking advantage of them in their own homegrown solutions, often regardless of corporate policy. Thus, it is imperative that IT departments address these low-end solutions quickly to restrict their use, or transition users to a more appropriate environment to ensure that those solutions are as secure as possible.

I have a new Analysis Brief in the pipeline that examines the security issues surrounding the use of cloud-based data sharing and collaboration services to share sensitive corporate data with your iPad.

Follow me on Twitter (@bwalder) to be kept informed of new research.

Testing Times In Security

2011-02-23T13:35:00.000+01:00

I am speaking to more and more enterprise clients who are doing their own in-house testing of security devices. Some of them invest in large, dedicated test networks and knowledgeable personnel, others invest in a single rack of virtualization and load generation equipment. But for all of them, the aim is the same - reduce risk of compromise by throughly testing equipment against enterprise-specific criteria before purchase.

Security vendors' marketing claims are often exaggerated, and frequently do not reflect real-world or enterprise-specific conditions. Performance of complex network security devices is difficult to determine accurately, yet failure to do so can result in significant negative impact on the network should the wrong device be selected or a chosen device configured incorrectly.

Testing is not necessarily about proving that the most-capable, most-expensive product is the best choice. A well-designed testing plan may actually show that a lower level of performance is acceptable at certain points on the network, and this can reduce purchase and deployment costs. IT organizations that do not perform relevant tests in- house may introduce serious security and performance issues to their networks by purchasing underspecified devices, or may overspend significantly on higher levels of performance and coverage that are not required.

Security effectiveness of complex security devices is often the most-difficult area to evaluate, because it requires expertise with attack traffic, and even live exploits. Evasion testing in particular seems to be a challenge for even the best-equipped enterprise test labs (hardly surprising, since it also appears to be something of a challenge for many of the security vendors out there!) For those with the requisite expertise in-house, however, a basic security effectiveness test bed can be created at a relatively low cost using virtualization technology and commonly available test tools. Virtual machines can be used to create an environment that is safe and repeatable, allowing security-conscious organizations to verify the often inflated vendor marketing claims.

Although it requires little in the way of specialized expertise and test equipment, testing the user interface (UI) and device management capabilities is often overlooked when evaluating complex network security products.

This is a mistake, however. A management system that does not meet organizational requirements reduces the effectiveness of a security solution. If a task is too difficult to perform, then it will be executed poorly or inconsistently, if at all. Operational costs can also be reduced drastically via well-designed centralized management systems.

Those who take testing seriously also implement continuous testing programs, making them an integral part of the ongoing security maintenance regime. I have seen numerous instances in the past of a single poorly written signature crippling the performance of an IPS. Firmware updates can also break previously solid inspection processes — anti-evasion techniques appear to be particularly prone to disruption between firmware updates.

Once initial deployment of your security device is complete, perform a full benchmark test to establish a baseline for your existing deployments. Every time a new firmware upgrade, signature pack update or change in security policy is applied — however minor it may seem — the device should be retested and the results compared against the baseline. In-place, ongoing penetration tests on the live network can also help to identify changes in security effectiveness following updates. This process of continuous monitoring makes it possible to monitor, identify and correct adverse impacts on performance or security effectiveness.

We currently have a number of ANalysis Briefs in the pipeline covering performance testing, security effectiveness testing and managing security devices. Together these will provide you with plenty of background material gleaned from almost 20 years in the security testing industry, along with some actionable advice to help you avoid costly mistakes when selecting and implementing complex network security devices.

Don't forget to follow me on Twitter (@bwalder) to be kept informed of new research.

How to Secure the Corporate Data on Your iPad or iPhone

2010-12-17T13:33:00.000+01:00

A recent survey of CIOs showed that 85% had received requests for Apple iPhones, iPods or iPads to be used in the enterprise, and that almost 75% had found that end users were connecting those devices to the enterprise network with or without permission.

This push towards using employee-owned devices from the bottom of the organization has been matched by the push to use iPads in particular from board-level executives, and IT security professionals are being squeezed in the middle, forced to support devices which were never designed for enterprise use and which offer unique challenges to secure, deploy and manage effectively.

Given the popularity of the iPad among executives, it was important that Apple made significant improvements to make its devices more enterprise-friendly, and this it attempted to do with a raft of new features in iOS4. Alongside new management capabilities came improved data protection, making iOS4 devices far more secure and more straightforward to manage than their predecessors.

However, there remains some confusion between "encryption" and "Data Protection," as used by Apple when referencing its latest security capabilities in iOS 4. Apple has created a framework for Data Protection that goes far beyond previous encryption capabilities and addresses many of the prevailing data security concerns. Encryption was introduced in iOS 3 and is "always on," but even when the device passcode is set it does not prevent files from being accessible in the clear under certain circumstances.

Though additional file-level encryption is available under the new Data Protection capabilities in iOS 4, the default state of data on an iPhone or iPad is "always available" to preserve backward compatibility, and sensitive data stored on iOS devices remains unprotected in many cases.

Of the Apple applications, only Mail supports full data encryption right now, and few third-party software developers have implemented the Data Protection APIs. Therefore, sensitive corporate data can be at risk if an iOS device is compromised.

A brand new Analysis Brief is in the pipeline covering iOS5, asking how secure Apple's new Data Protection capabilities are, and providing actionable advice on securing corporate data on iOS4 devices.

Follow me on Twitter (@bwalder) to be kept informed of new research.

A Good Security Testing Plan Will Save Time and Money

2010-12-09T13:31:00.000+01:00

Few enterprises in today's environment of highly constrained IT and security resources can afford to waste time and budget on network security products that exceed — or do not match — their requirements. While it is tempting to forge ahead in evaluating the biggest and fastest, hardware-accelerated, nuclear-powered "Next Generation" security toys, a well-designed testing plan may demonstrate that a lower level of performance is acceptable at certain points on the network, and this can reduce purchase and deployment costs.

An effective testing plan will enable the enterprise to select cost-effective security solutions that align with internal requirements for performance and system integration. The availability of advanced test tools enables a complete test lab to be created in a single rack of equipment, making it possible for almost any organization to perform in-house testing.

When embarking on a testing project, it is also important to decide in advance the eventual use case for the products being tested — a device intended for a branch office environment is unlikely to perform well if tested as an enterprise core product, for example.

In consulting independent test reports, be wary of those test houses that do not recognize the value of use-case testing. Look for those that either seek to certify a product against a particular use case, or that recommend one or more use cases based on the results of the test. A simple "pass/fail" result with no indication of a suitable use case renders a test worse than useless — even misleading.

We have an ANalysis Brief in the pipeline that examines each of these issues in more depth and defines testing best practices that will save precious resources when evaluating complex security devices.

Follow me on Twitter (@bwalder) to be kept informed of new research.

Firesheep: Should CISOs Ban Employees From Using Unsecured Public Wireless Networks?

2010-12-06T13:29:00.000+01:00

The release of the Firesheep plug-in for the Firefox browser has made it trivial for even unskilled attackers to intercept and interfere with private data on unsecured public wireless networks.

Since attackers can use the tool to send messages and make posts on behalf of the victim, organizations using social networks for marketing, support or brand enhancement may suffer serious consequences as a result.

Chief information security officers (CISOs) need to make employees aware of the risks and provide them with the necessary tools to counter them, but should they be banning the use of unsecured wireless networks for any company-related communications?

This note (for subscribers only), entitled "What CIOs need to know about SSL and its effect on network traffic inspection capabilities" answers that question and provides action plans for both employees and software developers to combat the threat of session hijacking, in addition to covering how IT departments can balance the need for enhanced security with the need to inspect encrypted traffic on the corporate network.

Don't forget to follow me on Twitter (@bwalder) to be kept informed of new research.

Cannes Symposium Round-Up

2010-11-12T13:15:00.000+01:00

I just arrived home after an incredibly busy week at the Gartner Symposium in Cannes. At least I only had a couple of hours to drive, compared with the lengthy flights of some of my colleagues.

With the final day of the conference coinciding with Cannes basking in 24 deg C sunshine on a national holiday, the beach was full of sunbathers and even swimmers (no kidding!), and the restaurants along the beach and Croisette were thronging with folks enjoying the late summer weather. It was quite a struggle to get in my car and leave! Mais, c'est la vie! I suppose I should at least be grateful that our attendees were dedicated enough to resist the temptations outside and stay for the final sessions!

There were over 3500 attendees, with over 1600 of those CIOs (those are the advance figures we had - I am sure those stats will be updated to include on-site registrations if they haven't been already) and it seemed like most of them passed in front of me in my little one-on-one booth over the four days of the conference!

OK, maybe not quite. But I did have a pretty full one-on-one schedule, and it seemed like the majority (all except a couple on virtualization security, in fact) fell squarely into two camps:

1. Advanced Persistent Threats (APT) and what can be done (if anything) to secure against them and remediate following exposure (and we could be talking "real" APT or just targeted persistent threats here - I lumped them all together). What was alarming was that of the several meetings I had covering this topic, at least half of them were not inquiring out of academic interest – they had recently been or (in one case) were currently under attack and were struggling to cope.

2. Securing the iPad on the corporate network. Interestingly this was not usually phrased as “securing tablets” or “securing mobile devices” but was iPad specific, although several did require a more platform-agnostic approach. Typical questions were how to manage these devices, what kind of security policies to put in place, and exactly how secure is the data stored locally on them. I have a research note due for publication shortly which ties in directly with some of these issues, entitled "How To Secure Corporate Data on Your iPad or iPhone.”

I was allowed out of my little one-on-one cell for an occasional bathroom/meal break and to host an Analyst User Roundtable (AUR) on "Virtualising Security, Securing Virtualization". This was a very interesting session which exposed one key point. I had three broad groups defined by maturity, in-house vs outsourcing, and public vs private companies, and thus each group had different requirements and opinions. However, across all groups there was one idea which was common: “We do not trust the hypervisor…yet!”

This mistrust of the hypervisor is preventing them from consolidating some servers, since they are unwilling to mix assets with different security trust levels on the same piece of physical hardware.

Don't forget to follow me on Twitter (@bwalder) for news of published research notes, weather reports on the south of France and where to find the best loup de mer in Cannes...

Like Lambs To The Slaughter - What Is Firesheep?

2010-10-29T13:14:00.000+02:00

As with Advanced Evasion Techniques (AET), Firesheep has garnered significant publicity recently by rejuvenating interest in an old security problem via the creation of a slick new tool. Unlike AETs, however, the tool at the centre of this publicity storm has been released to the general public, for good or ill.

HTTP session hijacking, or "Sidejacking" as it is sometimes called, is nothing new. Papers exist discussing the technique as far back as 2004. Several applications have also been written in the past (Ferret, Hamster, Cookie Monster and FBcontroller to name a few) to take advantage of the technique. However, Eric Butler, a Seattle-based freelance software developer, has rekindled interest in the issue via the release of a simple-to-use Firefox plugin called Firesheep.

Either on its own on a Mac, or coupled with Winpcap (or Ettercap) on a PC, Firesheep can capture traffic on any unsecured wireless network to which you are connected and extract details from session cookies used by any of the web sites configured within the Firesheep application. These cookies are used by web applications such as Twitter or Facebook to register the fact that you have successfully authenticated to the host site. They do not contain your password details, but they do not need to. By using the cookie to piggyback on your unencrypted communication, the attacker running Firesheep can impersonate you and gain access to the application you are using.

It couldn't be easier to use. The attacker just fires it up, turns on packet capture, and waits for the sidebar to populate with account details it has detected on the network. He clicks on your details, and hey presto - he sees on his screen exactly what that you see on yours. And he can interact directly with the host application. He could post status updates on Twitter or Facebook on your behalf, for example. OK, that might not be too serious for some, but for those whose job it is to represent the public face of a major corporation then the potential for mischief is significant.

Should you stop using all public, unsecured wireless networks? Well, no. That would be overkill.

At the end of the day, the real solution is for providers of web applications like Facebook and Twitter to use secure connections for all their operations. In the mean time, there are a number of precautions you could, and should, take, and these (and other key points) are the subject of a research note I have just completed (subscribers only).

Don't forget to follow me on Twitter (@bwalder) to be kept informed of new research. Just don't do it from an unsecured wireless network - you never know who might be watching!

AET Update

2010-10-27T13:11:00.000+02:00

Stonesoft held a joint publicity exercise with ICSA Labs last night in the form of a live Q&A session via conference call.

It was fairly embarrassing, given that there was a total of three questions (two from the same person which seemed to confuse evasion techniques with actual exploits), and the whole thing was wrapped up after 25 minutes with most of it being taken up by Stonesoft execs repeatedly denying that this was just a publicity stunt (and still no real details).

So, why was it a bust? Lack of interest or lack of understanding?

Well, given the confusion mentioned above, I suspect a lack of understanding, which is worrying. And one reason why I am inclined to forgive Stonesoft this blatant hijacking of the evasion issue, since if it continues to at least raise awareness and force other vendors to take it more seriously in their own testing, then it will have been A Good Thing.

So let me clear up the confusion. Evasion techniques are not, in and of themselves, exploits. Any attacker would need a functioning exploit which is already proven to work against the target host. If the host is unpatched and the in-line defences (IPS/NGFW) have no appropriate signature, the exploit will be successful - game over. If the IPS/NGFW has a signature covering the exploit, then it will be blocked - score one for The Good Guys.

This is where evasions come into play, however. Having noted that his exploit has been blocked, the attacker will then begin to use the same exploit coupled with one or more evasion techniques to disguise the exploit and render it invisible to the IPS/NGFW inspection engine. Chances are, right now, it will then work, since so many IPS engines fare so badly against even the most basic evasion techniques.

Note that if the target host has been patched against the exploit, then no amount of evasion will help. This is the key differentiator here - evasion techniques are only good for "cloaking" and delivering an exploit unmolested past a NGFW or IPS. Once your host system is patched against a particular vulnerability, it is safe (until the next one is discovered!)

Take a look at the most recent NSS Labs IPS Group Test Report to get some idea of which IPS products do well against evasions and which do not. Now this is where Stonesoft is to be commended. Because in trying to fix its own problems it went beyond those tools which are freely available to testers and wondered what would happen if it extended a few of the techniques and combined them. The result was the Predator tool and this latest slew of publicity.

It bears repeating that the criticism levelled at Stonesoft to this point is due to a lack of originality, not lack of seriousness of the problem. In the conference call last night ICSA voiced a very significant qualification - that 9 of the 14 PCAPs Stonesoft provided them to validate the claims had not been seen before in tools which were freely available. In other words, Stonesoft has not invented or discovered a whole new type of evasion technique (as I have already pointed out, I was personally using several of their so-called "new" evasion techniques in public testing over seven years go) - it has, instead, extended and combined existing known techniques to create a new set of problems for NGFW/IPS vendors to solve.

In other words, we are no worse off now than we were before Stonesoft made its claims - but there is still a significant problem which needs addressing. And it is time the IPS industry woke up and addressed this issue. There are products on the market today which have had issues with evasion techniques since the day V1.0 was launched, despite being pulled up time and time again in independent tests.

Which vendors are you considering for your next NGFW/IPS product? Ask them about evasions. Ask them about the Stonesoft AETs. And then make them PROVE they have an answer. In your own network, under your control. Or in an independent test lab under the control of a trusted third party. But NOT in their own labs.

Because the thing is, some vendors don't seem to understand the problem any more than the public at large. If they did, I wouldn't have had to fail the same products, year after year, for the same problem when I was testing these things myself.

As I mentioned previously, I have a research note in the works covering evasion techniques and how they can (and can't) be used against your perimeter defences. Given the level of interest in this subject, I might try to push up the delivery date.

Follow me on Twitter (@bwalder) to be kept informed.

Storm In A Teacup? More on Advanced Evasion Techniques (AET)

2010-10-20T13:07:00.000+02:00

Following my recent post on the Advanced Evasion Techniques (AET) "discovered" by Stonesoft, I thought I would update you with a few discoveries of my own.

After further investigation it would appear that there is not really that much that is actually new here. Don't get me wrong, there is certainly a threat here, and if there is one good thing that comes out of this it is that a few vendors might start taking evasion testing more seriously than they have in the past.

It appears that Stonesoft went through an independent testing process at the end of last year, failed several of the evasion tests, and started to do some research in order to improve their product. In developing their own tool to help them test, they started "fuzzing" the evasion techniques - an automated process which tries millions of random evasions, both in isolation and in various combinations, in order to find those which work. Bear in mind that it is possible to "evade" a typical TCP/IP stack too, so for an evasion test to be valid, it should allow a previously-detected exploit to bypass and IPS/IDS undetected whilst remaining capable of being reassembled by the target vulnerable host.

What they came up with was a number of new "discoveries", which under closer scrutiny appear to be techniques which have been well known for many years in the testing industry. In particular, they are laying claim to the discovery that layering multiple evasions - particularly evasions from different layers of the protocol stack - can succeed where single evasions will not. Well I know for a fact that this technique - along with around 90% of the others which they are claiming are new, have been in use for 7 years or more in the testing industry. How do I know this? Because I was the one doing it!

As founder and CEO of NSS Labs, I pioneered a range of IPS/IDS/Firewall testing techniques which are still in use today. In particular, I devoted a significant amount of time to the study of evasion techniques and was using many of the "new" Stonesoft AETs - including the all-powerful layering - way back in the naughties. I had to use my own tools back then, developed in-house. That certainly made it a challenge to layer MSRPC fragmentation with TCP segmentation and IP fragmentation in the same attack, but it was doable. And I did it. What IS new from Stonesoft is the fancy Predator tool, which they are not releasing to anyone (sensibly). It is a GUI-driven "One Stop Evasion Shop" and looks a lot nicer than the multiple command line tools I developed....

In addition, one of the "evasions" they have discovered seems to be less of an evasion and more of an exploitation of a particular bug which can be found in some IPS products. Again, part of a data leakage test which I was running against these products some years ago. I am surprised that it is still causing problems for some vendors... but there you go!

There is nothing new under the sun. What Stonesoft has done is taken existing evasion techniques and extended them. In doing this, they have created a few specific evasions I have not used before, but they are still extensions of known techniques. Kudos to them for taking this so seriously - it should do wonders for the security of their IPS and firewall products. Hopefully it will also force other vendors to follow suit and take this more seriously. You, the customer, deserve that at least. There are far too many IPS/IDS products which are still today failing to protect against even the most basic of these techniques (as seen in recent independent tests), let alone the more complex variations Stonesoft is publicising. Signatures are just not enough!

But don't fall for the FUD here... nothing has changed. AETs are not the WMD that will bring our perimeter security to its knees. Yes, they are a serious problem, but no more serious than before Stonesoft launched its publicity drive. Except, of course, that the bad guys are watching too...

Don't forget to follow me on Twitter (@bwalder) to keep up with my blog entries, research notes and random thoughts on wine, coffee, Labradors, golf, life in France and.... oh yes.... security.

Discovery of Advanced Evasion Techniques (AET) Could Cause Headaches For IPS/NGFW Vendors

2010-10-17T13:05:00.000+02:00

The Finnish security company Stonesoft said today it had found new techniques that bypass current security systems and which cyber-criminals could use to gain access to internal protected assets of many companies. Stonesoft said that as a result of the advanced evasion techniques (AETs) "companies may suffer a significant data breach including the loss of confidential corporate information."

Is this another round of hype or is there a genuine threat here?

Well, the bad news is that AETs do appear to exist. However, they are an extension of an existing threat category rather than a new one.

The problem is that a lot of in-line security devices - IPS in particular - don't do that good a job of coping with the basic stuff that is already out there, so this stuff is just going to make things worse!

Why is this a threat? Let's imagine you have something like Stuxnet which is proven to be effective at spreading itself around via remote exploits (amongst other techniques). Hopefully users will patch their systems, but in the mean time, they deploy sigs on their IPS, thinking that gives them additional time to test and roll out patches. It would be a trivial matter to alter Stuxnet to incorporate these evasion techniques, thus prolonging its life (don't forget - many users won't bother patching at all, and many more will delay - we know this is true from experience).

Or, another scenario: I am a cyber criminal with a new exploit for which I paid $5000 and which guarantees 100% ownership of a particular system. This I have tested and verified. So I run it against a public-facing target and find it is ineffective. I can be pretty sure this is as a result of in-line defenses. Do I throw out my $5k investment and move on? Not on your life. I deploy some simple evasion techniques and breeze on through.

For casual hacking by non-tech morons using toolkits and pre-packaged attack tools, evasion techniques are not widely used (though a number of the more advanced/expensive "blackware" tools do include evasion techniques). For those involved in targeted attacks, however, they are in common usage.

Right now Stonesoft has not released any of these tools (thank goodness!) Nor, I have to say, has it been particularly forthcoming in releasing any technical details. It claims that the AETs have been verified as real by independent test labs, but I have yet to see any evidence that this is true beyond a couple of vague quotes and sound bites. This has all the hallmarks of a carefully stage-managed publicity stunt about it.

That does not mean the threat is not real - I have seen the techniques in action and I am convinced they have the potential to cause significant mischief. There is a big difference, however, between watching a carefully managed demo by Stonesoft personnel over a secure link to getting one's hands dirty by testing hands-on. Right now it is possible that the majority of what is deemed "new" could be little more than layering older techniques on top of one another (something I was doing a decade ago to test IDS products). That doesn't make them any less effective, of course, it just means that this particular announcement is more about marketing than security. Once I see some hands-on verification by a trusted third party I will be happier.

I am also convinced that Stonesoft is not the only one to have discovered these flaws. My guess is that this is also just the tip of the proverbial iceberg. If I was making a living out of targeted attacks and cyber crime I would have been keeping these under my hat for a while now - I bet those shady folks are not happy that they are finally out in the open.

Even with the range of evasion tools and techniques currently freely available, however, security vendors have proven themselves incapable of handling even some of the most basic of those techniques. There are products on sale right now that I tested over 5 years ago and which still to this day cannot handle these issues. It is hard to do good TCP stream (and even IP packet) reassembly at high speeds - one major IPS vendor, for example, ships its IPS with all anti-evasion protection turned off by default because it is such a performance hog! It is not too much of a stretch to say that you might as well not bother deploying the thing at all if you are not going to switch them on!

If there is one takeaway from this round of publicity it is that you should make sure that the IDS/IPS/NGFW product you are about to buy or have already installed is resistant to these kinds of evasion techniques - and don't just take the vendor's word for it!

I have a research note in the works covering evasion. Follow me on Twitter (@bwalder) to keep up with announcements of research note releases.

One final point - this stuff is applicable to IDS and in-line protection only (i.e. IPS/NGFW) and does not help bypass good anti-malware scanning or EPP. Defense in depth, folks... defense in depth...

Intel + McAfee: Game Changer or Disaster Waiting to Happen?

2010-08-20T13:02:00.000+02:00

While an acquisition of McAfee was hardly a shock (it has been on the cards for some time) the acquirer did come as something of a surprise. I am sure we can all think of at least one - if not more - suitors who would have been a better fit for McAfee. Mind you, what does McAfee care? Payday is payday...

Intel obviously wants to improve the security posture of its products and can gain some good R&D from McAfee to help with this. However there appears to be very little synergy between the two companies. They have different customers, different routes to market, different cultures. Intel development cycles are measured in years, whilst McAfee needs to be able to react quickly. There are no channel benefits, no new market opportunities, and not a whole lot of revenue enhancement. And to cap it all, Intel has never really demonstrated that it actually understands the software business. Or the security business for that matter - look what happened to LANDesk and Shiva.

The biggest area of speculation is over whether it is feasible for Intel to build in EPP-type protection into its silicon, since this would provide the most exciting outcome from this merger (though one in which the anti-trust folks would doubtless take a long hard look). How feasible it is to embed security at such a low level – given that silicon is relatively fixed and security products need to be able to change on almost a daily basis – remains to be seen. Low-level capabilities with APIs and firmware hooks are probably the way to go here, though other security vendors will presumably be able to exploit those as well (if not, the lawyers will have a field day).

Clearly given the recent acquisition of Wind River Intel also has its eye on the embedded/mobile market - which is going to be huge(r) - and the McAfee acquisition could dovetail quite nicely with this, as well as giving a boost to Intel's vPro platform. But if this is all Intel wanted, it could have paid a lot less for a smaller company with better technology and less baggage - but that company would not have had the McAfee brand name, of course, which will be important as Intel chases a diverse range of customers for its new security technology!

And there is always the little niggle that in the mobile world, vendors such as Apple, RIM and Microsoft have control of the platform - and therefore the security - not the chip makers. Additional layers of security can't harm, but it is unclear whether they are as necessary as in the PC world. To date, users have been unable and/or unwilling to pay for additional security software on smartphones (Apple, for example, will not permit the use of key system calls required by antimalware vendors under the terms of its SDK).

While there is undoubtedly some intellectual property and R&D at McAfee that will be able to help Intel in its goal of offering more security features in its chipsets and related software utilities, it is unclear why it felt it needed to own McAfee to deliver this. It was already benefitting from an established partnership, and given that Intel clearly paid full value then it is obvious that it REALLY wanted this to happen – perhaps it is a defensive move to prevent others getting their hands on a key partner? Either way, almost $8 billion is a lot to pay for McAfee.

The first fruits of this union are slated to be delivered some time in 2011, apparently based around exposing limited security capabilities built into existing Intel chips. Integrating EPP-type security into silicon, if feasible, will take much longer.

One area which worries me is that I do not see where the network infrastructure security product line fits into Intel’s plans. I am hoping that IntruShield, one of the market-leading NIPS products, is not left to languish in the bowels of Intel and die a slow and painful death (McAfee assures me it won't since, it (McAfee) will continue to operate as a separate business unit). Intel could tinker with IntruShield, of course, by swapping out the network processing hardware for their own (if it is not already in there!) and replacing custom silicon (ASICs/FPGAs) with generic Intel processors. This could revitalize the IntruShield product line or it could finish it off altogether. If they have no clear strategy (and if they have, then why put McAfee in the Software & Services division?) it would be better if they spun it off into a separate company or sold the technology to an interested third party.

Bottom line: while in the long term this acquisition may benefit Intel in its fight with ARM for the embedded processor market and even AMD in the PC market, it is fraught with potential pitfalls for McAfee’s existing customers if the company gets distracted in a very competitive market.

New McAfee enterprise clients and existing ones coming to the end of a refresh cycle will be looking long and hard at how focused they think McAfee will be on their business in the next 12 months. The fact that this comes hot on the heels of the recent flawed security update which crippled thousands of corporate PCs will not help matters. Symantec, Sophos and Trend Micro (amongst others) must be rubbing their collective hands in glee right about now.

But perhaps the bigger questions are: will other chip manufacturers feel they have to follow suit to keep up with Intel? Or is Intel about to go on a security shopping spree? And which security vendor will be the next to be snapped up?

Who Pays For Testing You Can Trust?

2010-07-09T13:00:00.000+02:00

This is a question often overlooked both by those who scream "bias" and those who cry "but I want all my information for free!"

The point is, should you stop and think about it for more than a minute, there is no such thing as a free lunch - or a free independent test report. Someone, somewhere, has to pay for it. And at the end of the day, the test lab has to make a living, and there are only three ways it can do that:

1. Free testing, free reports, money comes from advertising

2. Money comes from participating vendors - reports are made available for free

3. Testing is free to vendors, end-users have to pay for reports

That's it. Those are your choices. And in all honesty, there is no difference between options 1 and 2, except that advertising revenue is hard to come by and the tests are never likely to be as thorough as you would like. Option 1 is the magazine model, and we can ignore it when discussing independent test labs.

So the proper labs are left with two choices - vendor pays or end-user pays.

First question is, does the fact that the vendor pays for the test devalue that test in any way? The answer is, "it depends on the integrity of the lab". If the lab prepares a solid, vendor-agnostic test methodology and sticks to it and reports all results, warts and all, for all vendors in the same way, then the model works just fine. Where the vendor (or in some cases, a consortium of vendors, even when watered down with tame test labs) gets to define the test methodology, or veto test methodologies it does not like, then there is something rotten in the state of Denmark. Avoid reports that come out of such a process.

You can usually sniff out the best methodologies - look for the ones that are open, thorough, published, clearly vendor-agnostic and which result in tests which are repeated time after time in the same way. Avoid "methodologies" which are aiming for the lowest common denominator, or which are "one-offs", clearly specified by a single vendor to show their product in the best light. How can you spot those? Simple - they are indeed one-offs, and you will never see that test methodology used to test another product. Labs should have a different test methodology for each product category - watch out for the ones which have a different methodology for each vendor!

I speak from experience here, having spent almost 20 years in the testing and certification business before joining Gartner. Now personally, I never used to accept single-vendor sponsored reports. Not because I wasn't confident I could still do the same rigorous, independent test, but because of the perception. If the vendor concerned doesn't like the report, he gets to squash it - that's his right as the commissioning entity. But if he does well in the test, then he will be more than happy to publish the results. Unfortunately, no matter how scrupulous the tester and the testing process, anyone who doesn't like what the report has to say (other vendors, or end users who purchased competing products and don't like that their choice was not validated publicly) will cry - usually loudly and publicly - "well of course they were bound to win - they paid for it!" Very unfair on all concerned, but almost inevitable.

Group tests usually work better, since even when the vendors are paying, it is obvious that they are a) all paying the same, and b) they are all being tested and reported under the same methodology. Unfortunately, the vendors still usually get the option to squash reports which can have the unwanted side-effect of a group test of 12 vendors resulting in a finished report containing only 2! In addition, vendors can hide behind budgetary issues as an excuse for non-participation.

This brings us to option number 3. This is a huge gamble for the test lab, which can spend months testing products only to find that sales do not cover costs. But the advantages are clear. They can dictate who is tested and can include vendors who would prefer not to participate because of technical issues. This approach is fine as long as the vendors are given the option to provide technical support and ensure their product is correctly configured.

As with the paid group test, everyone is treated equally and the results are reported warts and all. This time, the vendors don't get the option to pull out of the test if they do badly, of course, and this can result in some nasty repercussions for the lab. Vendors who do badly will go on a massive PR damage limitation offensive which will include some very public denouncements of the process and findings. Sometimes these attacks are not so public, aimed at existing customers via private communications, making it almost impossible for the lab to defend itself against unfounded allegations.

The end result, however, is a report which is much more valuable to the end user and potential purchaser of the products under test. The down side, of course, is that now it has to be paid for! C'est la vie. You can't have your cake and eat it too!

The vendors, too, must learn that they cannot have it both ways. If they do not want to pay for testing up front, then when the lab finds problems with their product what can they expect for free? Certainly the lab should tell them what they found and why the product did poorly. But how much information are they obligated to provide? Surely that is the extent of it? Should they be expected to act as an unpaid QA facility for vendors? Or should they - should we all - expect that these products do what the vendors claim, and if they don't they need to be fixed at the vendor's expense?

The vendor is always at liberty to go away and invest in research and technical staff to reproduce the bugs or problems found. Or it can choose to pay for consultancy to expedite that process. I keep seeing vendors complaining in public forums about how they did poorly in tests and the test lab won't provide them with all of their test material to reproduce the tests.

Well why should they? Shouldn't that be considered their intellectual property? Should they not be recompensed for helping vendors fix these glaring errors? How do you as end users feel about vendors which will not invest in their own QA process but expect external entities to do it for free?

Who amongst us here is willing to work for free? It is not a widely accepted concept - don't apply it to others unless you are prepared to do it yourself.

Terminology Bloat - What's Wrong With the Horseless Carriage?

2010-05-19T13:00:00.000+02:00

We all know how much the IT industry loves its terminology and especially its TLAs. So do we really need more?

Neil MacDonald's blog entry posits the idea that it might be time to retire the term firewalls. He raises a good point that with the addition of user- and content-aware technology to provide more control than the IP address/port approach of "traditional" firewalls, the Next Generation Firewall (NGFW - hey, that's a FLA!) the technology has advanced beyond what was originally envisaged from simple policy-enforcement devices. But, and this is a big but, they are still policy enforcement devices, wherever we place them in the network or, indeed, the stack.

What is wrong with retaining the original term, modified with something that describes its new functionality ("Next Generation") or specific purpose ("Web Application")?

In England, when we go to the builder's merchants to buy tiles, we specify roof tiles, wall tiles, bathroom tiles, floor tiles, patio tiles, etc. They are all tiles, we just prefix them with their intended location. In France, however, we have a different word for each type of tile (tuile, carrelage, carreau, faience, etc.) This makes life difficult for the foreigner, and much more confusing.

Whilst I am sure those of us working in the industry would just love to invent a new term for these wonderful new devices, spare a thought for the poor end-user. Enterprises may have got to grips with the terminology, for example, but the SOHO user has only just begun to understand what a firewall is all about. And we still can't decide what exactly constitutes a NGFW, for that matter, so how many new terms will we need to come up with to cover all of the feature options the vendors are scrabbling to include in their new firewall products? Hopefully not as many as there are French words for tile!

Let's not move the goalposts again. Let's stick with the horseless carriage option for just a little longer.

[UPDATE]: Neil responded in his latest blog post and makes a great point. Where functionality and, more importantly, the administration requirements are significantly different from a "traditional" firewall - as in Neil's example of the WAF - then a name change would be appropriate. The biggest problem with keeping the same term for all those different tools is, if you have a hammer in your hand, everything starts to look like a nail. My argument was simply that I would prefer to see the term NGFW adopted before AASG (Application Aware Security Gateway) - I don't think we need to ditch the term firewall just yet.

Don't Shoot The Messenger

2010-03-17T12:58:00.000+01:00

Testing is hard.

For a while there I thought of making that the end of this blog post, but I guess I should elaborate a little. Testing is hard, whether you are a vendor looking to do QA, an independent test lab doing competitive analysis, or an end-user trying to decide which product to buy.

Good test plans are difficult to draw up, and solid methodologies are difficult to create. End-users often use independent reports to create short-lists before doing their own in-house testing or proof-of-concept projects. This is why vendors get so upset when they don't do well in such reports. This is understandable, but what the vendor does next is often a good indicator of character.

The first thing to do, of course, is to verify that problems highlighted in the report are genuine. Vendors should work with the test lab wherever possible and be prepared to do so with an open mind, not get all defensive about the fact their precious product has a flaw. If the test lab can show you time and time again (live or on video) that they owned a target host protected by your product, then you probably have an issue that needs fixing!

Secondly, dedicate some resources to fixing the problem rather than generating marketing FUD to disguise it or deflect attention away from it. Yes, this costs money, whether you do it all in house or engage the test lab to help. Don't expect someone else to fix your product for free!

Third, bask in the glory that comes with fixing a problem quickly and professionally thus leaving your customers exposed for the minimum possible time.

What you SHOULDN'T do is shoot the messenger!

I have seen three examples recently of vendors going on the attack straight away when they don't like what is in an independent report - one in the IPS area, one in Web Application Scanning, and one in AV.

In each case the vendor in question launched public attacks on the various test labs, one of which led Mike Rothman of Securosis to predict the death of product reviews. I think Mike is wrong in this dire prediction, and end-users had better hope that I'm right, because such reviews - when done well - are all that stands between the purchaser and all that vendor hype. That and a Magic Quadrant!

Of course, the vendor is entitled to put forward his point of view. It is not difficult to spot weak methodologies, and these can do more harm than good, and the only recourse a vendor has to to refute the results publicly.

But when you have been caught out, when your product has been shown to have a repeatable flaw, posting falsehoods and ad hominem attacks in an attempt to discredit the report, the methodology, and the engineers who carried out the tests is simply not professional.

The problem is, if the test lab in question DIDN'T foul up the test, you are going to look pretty stupid when they are forced to reveal more and more of the problem in order to dispel your FUD attack. And your customers are going to be upset too, as you dedicate marketing resources to hide an issue better addressed by engineering resources.

If you are a customer of a vendor who engages in these tactics, I would encourage you to make every effort to talk to whoever produced the report which upset them. Try to understand the problem, and make sure that it doesn't affect you. If it DOES affect you, see if they can help you reproduce the tests in your own environment (if it is not too dangerous to do so). At that point you can go back to your vendor with some concrete data, and you will also be in a position to verify any fixes they release for the problem in the future.

I have a series of research notes in the pipeline right now on testing: what you should know, and how to do it properly. It strikes me they are sorely needed!

Identity Theft - A True Story To Chill The Heart

2010-03-08T12:57:00.001+01:00

It's typical that on the evening before you are about to leave on business for four days you realise your propane tank is empty (there is no mains gas in our village). And you will not be back home until Friday evening by which time it is too late for them to make a delivery before the weekend. And, oh look, the weather forecast has turned to snow by Monday. And so you face a bleak, cold weekend with neither heating nor hot water before they can replenish your gas supply on Monday. Oh joy.

What has this got to do with IAM, you might ask. Nothing at all. But it does give you some idea of my state of mind as I headed north to London to attend the fourth Gartner Identity and Access Management (IAM) Summit - not the happiest, as you can imagine.

But solace was to be found in the warmth of the welcome I received from my colleagues, most of whom I was meeting for the first time in London. And drink. But mainly the welcome...

IAM is a key area for Gartner's clients, of course, and so the agenda was packed with the best and brightest of those Gartner analysts who specialize in Letting The Good Guys In (LTGGI). As a tin-head myself, and part of a separate group in the Gartner Security, Privacy & Risk team tasked with covering technologies for Keeping The Bad Guys Out (KTBGO), I was not actually involved in any of the presentations. Instead, I got to observe my new colleagues in action, brainstorm ideas for research, try to sell them on the fact that if we kept everyone out, Good and Bad, it would make life (and security policy creation) a lot easier, and talk to some of our clients face to face for the first time.

Pretty soon I had forgotten all about propane problems as I immersed myself in IAM-enabled cloud architectures, security monitoring, role & entitlements management, fraud prevention and federated identity management. There were workshops too, many of which were fully booked almost as soon as the summit started, and a constant stream of analysts and clients to and from the one-on-one meeting rooms. Attendee numbers were good, an excellent sign in tough economic times, and everyone I spoke to seemed to be getting a lot out of the event. If you missed it - shame on you. Book early for next year!

Things ended on a light note with a true story of identity theft from writer and comedian Bennett Arron. It all started with a mail-shot from a home shopping catalogue company to an old address, which allowed the unscrupulous person now residing at that address to place an order and open an account with the home shopping company. That credit account allowed him to acquire a mobile phone or two. From there it was not too difficult to open bank accounts and obtain credit cards - all in Bennett Arron's name.

The end result was Arron, who had already given notice on rented accommodation to buy a house, failed to acquire a mortgage, couldn't rent another property, couldn't get a line of credit, burned through savings and ended up penniless and living with parents with his pregnant wife. It took him two years to clear his name, by which time property prices had tripled and he could no longer afford to buy a house anyway! No compensation was forthcoming from any of the companies who allowed a criminal to open accounts in someone else's name, though Arron did get a one-man comedy show out of the material and Channel 4 made a documentary on him. So that's OK then.

One remarkable thing that he demonstrated in the documentary was how trusting people can be when faced with official-looking situations. He donned a suit and tie and set up a stand in a local shopping mall offering people advice on the perils of identity theft. He also offered a free service to protect their most sensitive information provided they would... yes, you guessed it.... give him their most sensitive information.

In just two hours he spoke to twenty people, eighteen of whom happily handed over their name, address, date of birth, credit card numbers, expiry dates and even the 3-character CVV/CVS numbers from the signature strips. Only two people refused. Only one person thought better of it and returned to the stand.

"Hey, this isn't a scam is it?", he asked.

"Errrr.... no"

"Oh, that's OK then. Thought I'd better check though...."

True story!

And just goes to show that no matter how many firewalls and IPS you have installed, social engineering will get you every time.

As part of the documentary Arron attempted to prove how easy it would be to steal someone else's identity. He settled on then Home Secretary Kenneth Clarke, since it would need to be a high profile "theft" to get everyone's attention.

Arron applied for a duplicate birth certificate in Clarke's name, and within 3 days it arrived. Using that, he applied for a duplicate driving license from the UK Drivers & Vehicle Licensing Authority (DVLA), which took just a couple of weeks to arrive. As part of this process, the DVLA requested photographs for the license which had to be authenticated on the reverse with a statement from a trusted, non-family member that this was a true likeness of Kenneth Clarke. This Arron completed himself using a false name. Something of a root trust issue, here, I think....

Naturally, with a birth certificate and driving license Arron could have gone on to open various accounts, building up to bank accounts and credit cards. Scary stuff. One good thing came from this - it is now no longer acceptable to use a birth certificate as the sole means of ID when applying for a UK driving license. Wonder if they have plugged that photo certification loophole too?

As the summit comes to an end and I set off back to my home in France, I reflect on how identity theft would be so much more difficult to accomplish here by virtue of a few simple controls that are universal.

In France, if you want to open any sort of account, from a bank account, through mobile phone all the way down to the humble supermarket loyalty card, you need to provide one piece of photo ID (ironically, a UK driving license is permitted!) and at least one justification of current address. This needs to be something serious, like a bank statement or major utility bill (electricity bill, fixed phone line, but NOT a mobile phone bill).

We often consider these controls to be the bane of our lives here, since they add a layer of complexity to the most simple tasks, but in the light of Bennet Arron's story it makes perfect sense.

Sometimes customer satisfaction is not everything - sometimes you have to put security requirements ahead of signing up that new prospect.

Why we shouldn't write off chip-and-PIN just yet

2010-02-16T12:57:00.001+01:00

There has been some pretty wild speculation in the last few days that the death of chip-and-PIN is inevitable, based on the creation of a man-in-the-middle attack developed by computer researchers at Cambridge University.

According to the Cambridge researchers, there are over 730 million payment smart cards in circulation worldwide using the EMV (Europay, MasterCard & Visa) protocol (2008 figures). Known to bank customers as “Chip and PIN”, it is widely used in Europe, is being introduced in Canada, and there is pressure from banks to introduce it in the USA.

Since its introduction in the UK the fraud landscape has changed significantly: lost and stolen card fraud is down, and counterfeit card fraud experienced a two year lull. Inconvenient, then, that they now claim the protocol is broken.

Apparently, the Cambridge researchers succeeded in building a man-in-the-middle device that reads a valid card and, at the appropriate point in the card verification process, sends the correct "PIN verified" code to the terminal, whether or not a valid PIN code was entered. Of course, the man-in-the-middle device needs a way to communicate with the card reader, and this is achieved by inserting a fake card into the reader which is connected to the MITM device by a bunch of wires.

So, it is is an interesting theoretical attack, to be sure. However, you would need a valid stolen card to start with (OK, not impossible) plus a backpack full of electronic gear and a fake card dangling from some wires. Obvious enough to tip off the merchant that something is afoot, do you think?

Here in France, where they have been using chip-and-PIN technology successfully for over a decade, many retailers have portable card reading terminals. They will take your card from you to insert into the reader and pass it back for you to enter your PIN. Not much opportunity to use your umbilically-challenged fake card there, then!

Even using fixed readers at the point of sale (POS), the fraudster would have to keep their hand in such an unnatural position throughout the transaction (whilst entering the PIN with their free hand) that it is beyond belief that alarms would not be raised (they would look like some weird, deformed, miniature concert pianist in action!)

In other words, even though a flaw in the EMV protocol has been discovered, to claim chip and PIN is broken is a bit harsh on the back of this. Indeed, simple physical protocol changes would be enough to foil any attempt to use this technology.

People are claiming that they have experienced fraudulent debits from their accounts via chip-and-PIN cards. The banks are denying liability because subsequent investigations show that a valid PIN number was entered. Leaving aside that it is highly unlikely that any of these fraudulent withdrawals have been made as a result of the Cambridge technology (nor is it likely any will be made in the near future) these sort of claims always make the papers.

The less-newsworthy reality is, however, that the majority of these withdrawals will be the result of careless disclosure of the PIN number (either by allowing someone an over-the-shoulder view when entering the PIN at the ATM, or by having a PIN "cheat sheet" stored in the wallet or purse) followed by theft or loss of the debit card. Human nature dictates that very few people will own up to these personal failures, and will instead blame the banks in an attempt to recover their money.

Apple iPad: Security Considerations

2010-01-28T21:47:00.001+01:00

Now all the brouhaha surrounding the new Apple iPad has passed, let's take a more considered look at this device: world changer, or solution looking for a problem?

Many people have erroneously stated that the iPad is a product with no market because the netbook already covers that gap between smartphone and laptop perfectly adequately, and thus - as a device with a "proper keyboard", is superior to the iPad.

They are missing the point.

In his presentation, Jobs stated that in order for this new device to have a reason for being, it would have to outperform either (or both) the smartphone or the laptop in seven key areas:

Browsing

E-mail

Photos (sharing/viewing)

Video

Music

Games

eBooks

The netbook can do all of this, but does none of them better than a laptop. A netbook is, after all, just a small laptop, and exists purely because it offers a lower price point.

The iPad, however, scores at least 4 or 5 out of 7 (I am not convinced it can do either music or iPhone-type games better than the iPhone, nor e-mail better than a laptop), which is enough to give it a pretty significant potential market.

Yes it has some perceived "problems": strange screen aspect ratio; no GPS; no camera (think video conferencing, not photo taking); and, above all, no multi-tasking (that in is a REAL shame). But despite all of that, it is still the proverbial game changer.

Once you factor in the ability to use the new iWork apps to do some serious word processing, spreadsheet or presentation work, you have a serious contender for Travelling Companion of the Year for most corporate road warriors.

Let's face it, unless you are doing some serious keyboard/mouse work or need some significant screen real-estate, there is not much reason to choose a 6lb laptop over a 1.5lb iPad. And even the keyboard issue could be resolved with the addition of the keyboard dock accessory.

And herein lies the potential problem for the corporate security guys. In creating the perfect road warrior machine for the mobile workforce, Apple has created a repository for gigabytes of sensitive corporate data without any apparent way to a) secure it or b) remote-wipe it should the machine be lost or (more likely given its initial highly desirable status!) stolen.

It took some time for Apple to offer a nod to the security world with the iPhone and include the sort of features that meant at least the CSO wasn't tearing his hair out every time an employee turned up to work with one. These included both encryption and remote wipe capabilities, but no mention was made of these during the iPad launch.

The reason for that is probably that, if they work at all, they wouldn't be very effective in a device like this. The remote wipe capability, for example, relies on the iPhone being connected to a cellular network. Unfortunately, the vast majority of iPads will probably be sold with no 3G capability, thus eliminating this feature (not that removing the SIM card wouldn't have the same effect, of course!)

Does the iPad offer device-wide encryption for all user documents? There was no mention of this, and the iPhone's encryption mechanism proved fairly straightforward to bypass by anyone with a modicum of hacking knowledge anyway.

Whereas the iPhone was never likely to be used to store gigabytes of corporate data, however, the iPad is designed for just that. And the use of basic office productivity applications means that some means of quickly and easily getting the documents on and off the device is required. A quick look through the new SDK reveals that it will be achieved by making those documents available via a mountable share - a far cry from the current situation where applications and their data are sandboxed.

How well that mechanism will be protected (if at all) remains to be seen. But one thing is for sure - in the next 60 days the CSO/CISO is going to have to put some thought into how this latest creation from the boys in Cupertino is going to fit into his corporate security policy.

Golf In France

2009-04-22T17:16:00.001+02:00

If you are new to golf in France the best course of action is to apply for a license from FFgolf (http://www.ffgolf.org). As well as providing you with the means to obtain an official French golf handicap, the most important feature is insurance coverage should your errant golf ball hit a building, car or head (or should someone else's ball hit YOUR head!)

The license has space for a "carte verte" sticker, which you can obtain after being accompanied on a 9 hole round by any club pro. The idea is purely to ensure that you can complete 9 holes of golf in under 3 hours and you don't kill anyone in the process. A basic knowledge of rules and etiquette is also expected, but there is no "test" as such.

When you first obtain your license, you are allocated a handicap of 54. This is GREAT - you get 3 strokes per hole over someone who plays from scratch, and this allows you to compete in club competitions far earlier than you would be able to in the UK (bear in mind that in France you need a current medical certificate from your GP certifying your fitness to play golf before you can play in any competitions, even "fun" ones organised by your local club - this has to be renewed each year)

If you have a valid handicap in any other country, FFgolf will simply transfer that to your new French license if you inform them. For the "newbie", you can begin to reduce your handicap by playing in any "proper" competition organised by your local club. These can be sponsored events with prizes, or "classement" competitions which are generally held weekly at every club with the sole aim of allowing people to register a score towards their handicap.

Note that you cannot simply register any old score card towards your handicap, it has to be from a recognised competition where the club will print out official FFgolf score cards which must be marked by one of your co-competitors, signed and handed in at the end of the round - all very official (well, this IS France, after all).

Every license holder gets their own "portal page" on the FFgolf site which allows you to track the current status of your license, whether you have a carte verte, whether you have registered your medical certificate, and the evolution of your handicap (plus stats of your current position in your club, the league, the region and nationally!)

My advice for anyone looking to play over here regularly would be to apply for a French license regardless - it costs 48 Euros a year and gives you the benefit of the insurance. Officially, a license is obligatory to play on any French course, though the likelyhood of that being enforced is remote. Of course, if you have an accident and you are without insurance, things could get tricky...

If you already have a handicap, you can have it transferred to that license, and you don't need to do the carte verte test. If you don't have a handicap but you play regularly, you could probably just explain and ask the club for the carte verte sticker - they might give it to you or they might require that you complete one round with the pro. Probably worth doing, since it only needs doing once and then you are "official", and it really is VERY straightforward to do (not at all like getting a carte grise!)

If you are just an occasional visitor, there is no need to do anything, but you should make sure your travel (or golf) insurance policy covers you for accidents abroad.

As with the UK, there are clubs that will insist you have a handicap to play (proven by your French golf license) and those who don't care as long as you pay your green fees.

I hope that helps - if I have left anything out, just ask. There is lots of info on the FFgolf site too for those who read French.

English Weather

2009-04-12T16:31:00.003+02:00

For several years now we have been very smug about the fact that, although it can rain here (and I mean RAIN, with a capital R-A-I-N), it usually only lasts for a day or two and then returns to beautiful blue skies. And although we can get the odd cold snap in the winter, the temperatures are usually high enough to go out in a light coat - and, of course, it is always sunny, even when cold.

And the rest of the time... well, it's just sunny, with a capital S-U.... well, you get the idea.

So it has been a bit of a shock this winter to have long periods of wet weather with leaden grey skies. Damp, horrible, feel-it-in-your-bones type weather. And every time it looks like clearing up and you think "spring has arrived", it just turns to crap again.

And so it is this week. Only last weekend we were playing golf all day in t-shirts and contemplating how many more days before we go the whole hog and switch from long pants to shorts. And now, here we are again, huddled indoors, staring wistfully through the windows at the leaden skies and rapidly flooding garden.

Even though the English are born to this sort of weather, you get used to the other stuff once you have been here a few years and the crap stuff just seems to hit you harder, for some reason.

Not helped by the fact that the rain gives us an excuse to do the cleaning. How the hell that dog can lose so much bloody hair and not be bald is beyond me. I'm going to clingfilm him....

Golf Overdose

2009-04-06T19:11:00.003+02:00

Getting too old to play 54 holes of golf in 2 days.

Yesterday we played 18 holes at Vacquerolles first thing in the morning with Harry, which at least meant we didn't have to walk him separately. Then in the afternoon we went to the Cleveland Golf demo day at la Grande Motte.

The intention was to mooch around the new range of clubs and drool for a while, but the Cleveland guy had other ideas to sucker us in. He determined which range of clubs interested us, then gave us a full set on loan to go and play the course. Well, how could we refuse? One small point regarding the way the French do business here. In England, we would have had to leave a passport, driving license, cheque to cover the amount of the clubs borrowed and a small child as security for the clubs. Here, the guy just took down my name, didn't ask for any ID, and wished us a "bon parcours". Amazing!

And so we found ourselves playing another 18 holes. Given that I already own a lot of the Cleveland driver/wood/hybrid clubs that I need, it was really only the new irons in which I was interested. So much to the dismay of the guy behind us, I was hitting multiple iron shots up the fairway instead of driver/hybrid + small iron. Par 4's were becoming par 8's for me - but at least it was deliberate this time. The guy behind was terribly unimpressed, however...

Today was our regular weekly threesome with myself, Hans and Stuart round Vacquerolles - and very nice it was too. A big part of this weekly event is the time spent at the 19th afterwards, and so it's a jolly good job Lynne was driving...

Vacation

2009-03-30T19:35:00.008+02:00

For those of you not following on Facebook or FriendFeed while I was away, you will have missed the pictures I posted.

Here they are again, plus a few additional ones.

I didn't manage to take the Canon DSLR with me on any trips out, since I was taking more video than stills this year. For that, I am using the new Toshiba Camileo P30, which has the distinction of fitting in your pocket (so great for skiing), and yet taking full wide-screen 1080p HD video at 30 frames per second and 5 megapixel stills.

With a 5x optical zoom and macro, low light and backlight modes, it can cope with most situations, and it made a great job of the snowscapes, as you can see. Everything is recorded to SDHC cards (stick to Class 2, it can't handle anything higher), and a 4GB Class 2 SD card (which cost me $1 plus shipping on eBay!) will hold over an hour of 1080p video and several hundred 5MP stills. All this for 180 Euros! Check it out on Amazon. The only problem I found was that it is slow to refocus when zooming (especially in movies), but at that price you can't have everything!

So most of the pics were taken on this camera, but if you notice some in the slide show with poor resolution, they were taken on the iPhone (2MP). Here's hoping Apple give us a significant boost to the camera capabilities (5MP please! Plus video!) when the new iPhone is released in the summer.

Fab vacation with some great weather and skiing for the first couple of days. After that it snowed quite heavily, which only kept us off the slopes for a day, but the high temperatures (it was 25 deg C at the top of the mountain some days!) meant the pistes stayed soft and slow after that.

Still, we all had a great time, especially Harry (his first holiday without Benson) who adores the snow and went potty once we had the heavy snow fall. Now I just have to lose the weight gained from all that melted cheese!

Where Am I?

2009-03-29T09:56:00.006+02:00

Just got back from a wonderful week skiing in the Alps, as any of you who follow me on Facebook will know.

This vacation has seen a shift in the way I record my personal comings and goings for posterity. In the past, I would usually take a laptop with me to enable me to offload pictures and videos from my cameras and do the odd bit of blogging while I am away.

Now I take a Belkin card reader with an old 20GB iPod to offload pictures (plus with 4GB SD cards costing $1 on eBay why not just take a whole bunch of them with you and swap them out as needed?) and my iPhone gives me all the on-line access I need while I am away. The laptop stays at home these days.

But whilst the iPhone is great for ad hoc browsing and keeping up with e-mails and social networks, it leaves a lot to be desired on the blogging front due to the lack of normal keyboard (I WISH Apple would let us use Bluetooth keyboards on these things, but that's not even going to be an easy option in the new 3.0 software).

Hence my switch to "micro-blogging" technology such as Twitter and Facebook. For those of you not up to speed with Twitter, it provides the ability to make short 140 character posts for when a full-blown blog entry is simply overkill. I use Twitter extensively to post quick tips, interesting links and short rants and opinions. Although it is easy enough to sign up for Twitter, you don't need an account to follow me on there - you can see the 10 most recent posts on my blog page in the sidebar, or just point your web browser to @bwalder and you can see everything I have posted.

As you can see, I tend to use Twitter for "serious" or "techie" stuff in the main (though not always). Personal stuff will usually go on Facebook, which provides the same micro-blogging capabilities via its status updates. Once again, you can point your browser to my Facebook profile here, but this time, unfortunately, you DO need an account to view it. Bummer, huh?

If only there was a way for you to view all of this stuff in one place. Hey, there is! It's called FriendFeed.

FreindFeed is an "aggregator", which means it can pull together lots of different stuff such as blog entries, status updates, micro-blogs, picture uploads, etc, etc and present it in a single place. No account or special software needed - just go here to view my FriendFeed feed.

There you will see my Twitter posts, Facebook status updates, LinkedIn updates, Goodreads book recommendations, picture uploads to Flickr and Picasa, links to interesting news stories, YouTube videos, and even my blog entries (like this one) will make it over there.

The list can look daunting at first, but you can click on any one of the service icons at the top of the page (next to where it says "Filter:") in order to view only posts from that service. So clicking on the little"F" will show you all my Facebook updates, and nothing else. Clicking on the "Feed" tab at the top of the page will clear the filter and show you everything again.

If you only visit one place to see what I am up to, FriendFeed should probably be the one. But if you want to continue dropping by my blog, all my other social network links are in the sidebar on the right. If you don't see a blog update for a few days but you notice recent Twitter posts, then it is always worth popping over to Facebook or FriendFeed to see what I am up to.

I would encourage you to take a look at these sites (take a trip through all of those Social Network links in my blog sidebar), not only to keep up with what I am doing (yawn!) but to get a feel for what they are about and have a think about how you could use them yourself. They can be fun, and a lot less onerous than keeping up with a full-blown blog - especially when you are on vacation and have better things to do!

Harry Plays Golf

2009-03-20T18:16:00.004+01:00

It has been a long time since we took Harry with us when playing golf.

We used to do it when we first started but some people behind us once complained that we were spending more time walking the dog than playing golf. We didn't, it's just that we were so crap at golf at the time that we took forever to get past the par 5's and Harry got the blame. Rather than risk the ire of other members of the club, we stopped taking him.

Problem is, if we don't take him, we have to walk him before we go play (1+ hours), then we play golf (3-4 hours), then we have to calm him down when we get home and walk him again - the last thing we feel like doing after 18 holes.

If, however, we take him with us, he gets a 4 hour walk around a beautiful golf course, and we get one tired puppy when we get back home - everyone wins. That, plus the picture above is how he looks at us as we leave the house dressed for golf - there is only so much of that you can take really...

So we decide to take advantage of the lighter mornings and good weather to get to the golf course for 7.30 and we set off with the mutt in tow. Well, not so much "in tow" as hurtling around the first tee and then dashing between us up and down the first fairway.... thank goodness there is no one else around to see. He soon calms down and restricts his mischief to standing on Lynne's ball when she is trying to putt. By the 10th hole he is knackered and the rest of the round he traipses behind us doing the doggy equivalent of "are we there yet?" every 10 seconds.

We are finished by 11.30 and stop by the 19th hole for a bite to eat. On the way out, Harry spots a large female pooch of indeterminate race, but who probably weighs around 50KG. As Harry passes by, said pooch shows an interest, and promptly pulls the poor lady holding him over the back of her chair and drags her along the ground in her haste to make Harry's acquaintance.

Probably be a while before we dare take him again.....

iPhone 3.0

2009-03-17T20:03:00.005+01:00

The long-awaited Apple event today was all about the new iPhone OS 3.0, but no news on new hardware :o(

Notable new features include:

* Cut & paste across all apps (really well-implemented - might even have been worth the wait). Can even copy pictures from album and paste into e-mails

* Push notification - at last! Still no background tasks, but maybe that's not such a bad thing given the quality of many of the apps in the App Store - I can see battery life draining to 20 minutes with the wrong app in the background!

* Extended Bluetooth support for new accessories and also P2P (i.e. swap contacts directly with other iPhone users nearby). P2P is via Bonjour - no Bluetooth pairing is required - and can also occur over WiFi. A2Dp support allows use of stereo Bluetooth headphones, but there is STILL no Bluetooth keyboard capability! Why not?

* MMS - new Message app to cover SMS and MMS - send photos, contacts, audio files, and location via MMS

* Embeddable maps - Core Location will finally make turn-by-turn apps possible

* Landscape mode for all Apple apps

* Ability to send multiple photos in mail

* New Spotlight search capability across all apps and content (contacts, calendars, music, etc.)

* Voice recording app vie internal or external microphone

* Extended Stocks app (WTF?)

* Notes will now be synchronised via iTunes (at last!!!)

* Ability to sell additional content from within apps via App Store - for example, if you have a city guide app, you can sell the app once and additional "city packs" as extensions. Or for a game, the base game could include 10 levels, and you can provide the option to buy additional levels only via the App Store. Free apps will not be able to sell content, however - free apps must remain totally free (fair enough)

* Laptop tethering is supported in 3.0 but will remain at the discretion of the individual cell operator (probably no chance in France then!)

Still no video support - bum and poo :o(

And still no way to manage apps properly via iTunes, i.e. grouping in categories or on "virtual screens" in iTunes ready for synchronisation - once you get past more then a screenful of apps you really do need more advanced app management capabilities (especially when you have multiple devices too)

The new OS will be available in the summer as a free download for all current iPhone owners ($9.95 upgrade for iPod touch users)

English Invasion

2009-03-16T19:03:00.001+01:00

Since Lynne is off golfing with her girlie buddies today, I decide to have a Men's Golf Day (which is denoted by the requirement of spending as much time drinking as golfing), and am joined by Stuart and Hans.

The first time we have played together, and the first time they have played at Vacquerolles, and a most agreeable day it turns out to be. We are all around the same handicap and skill level, and end up shooting similar scores, although Stuart wins the back 9 match play competition (I note it was also Stuart who suggested it...hmmmmm). Stuart takes 4 holes, I take 3 and Hans 2.

Overall, I shoot exactly to my course handicap, turning in an OK score of 97 in an otherwise unremarkable game. Only 8 fairways hit, 1 green in regulation, 2 pars (though one of them was on the par 5 17th - my first on that hole) and an appalling putting average of 2.1 putts per hole.

Then it is down to the important part - the drinking. Unfortunately, I can't remember much about that bit....

Day At The Beach

2009-03-14T18:53:00.000+01:00

After a day of household chores yesterday (see how I spared you a blog post of that?), we decide to take advantage of the glorious weather and pop down to the beach for the day.

We opt for Grand Motte, since it is one of the most dog-friendly resorts around here. Many resorts simply will not allow dogs on the beach at any time of the year, whilst others restrict access to certain months. Although you can safely ignore these prohibitions in the winter months when the beaches are largely deserted, once the good weather comes along and you have kids building sand castles, a 40KG moron who ploughs through the middle of said kids and/or castles whilst peeing on your picnic usually brings out the Villagers-With-Pitchforks mentality of the local population.

Grand Motte is nice because, along with Les Saintes Maries de la Mer, it maintains specific beaches or stretches of beaches where dogs are allowed. Anyone stupid enough to build sand castles or attempt picnics on these stretches of beach deserves everything coming to them, in my opinion...

Harry is not as big a fan of the sea as Benson was, but he does like to cool his goolies after a long walk in the sun, and there is not much you can do to stop him once he gets the scent of the sea in his nostrils.

Other than wave a donut at him, of course....

The Sacrifice Worked

2009-03-13T18:41:00.001+01:00

Well, it was a bugger smuggling a goat onto the 18th green, but it was probably a lot quieter than a virgin, and the end result seems to be about the same - the Gods are appeased!

Today I manage a perfect bogey round on the first 9 holes (45), followed by 47 on the back 9 for a total of 92. Ninety bloody two! Plus 20, and a full 5 strokes under my course handicap. OK, so Tiger Woods wouldn't be impressed (and I am sure, dear reader, neither are you) but....well, it's ninety-bloody-two! And on Friday the 13th as well! Probably the only day of the year I will ever manage such a score.

9 fairways hit, 4 greens in regulation, average drive of 192 metres (with two drives over 230 metres), 5 pars (!) and, most telling statistic of all, average putts per hole, 1.7

I'm happy, even if you did click away from this page two minutes ago...

The Gods Of golf Are Angry

2009-03-08T18:30:00.003+01:00

Yeah verily, should any golfer have the temerity to assume that just because he didn't suck totally in a game that he might actually be making progress, the gods will smite and smite and bend his putter. And then smite some more.

And they smote today, and yeah I am repentant and vow never again to let myself believe that I might actually be able to hit a ball in a straight line or clear that hazard looming across the fairway. Amen.

A terrible score (50) on the front 9 today, made to look better than it could have been by the par 4 ninth: a 250 yard drive, soaring second shot landing on the green and a 30 foot putt for a birdie. Sweet!

Back 9 was not quite as disastrous, with a 48. When I look at the score card, it wasn't actually that bad. Most of the holes were bogeys (which is good for me, don't forget!), with the odd double-bogey which can't be helped when you are as crap as I am. But it was the three triple bogeys which wrecked things for me - 6 extra strokes in those 3 holes are not easy to recover from.

Gotta get my putting under control, and next time a sacrifice at the altar of the great god Titleist, I think.

Farewell to Siegfried & Roy?

2009-03-07T20:59:00.003+01:00

Anyone who ever saw Siegfried & Roy live could not have failed to have been impressed by the showmanship and sheer spectacle.

That their career - long as it was - was cut short by such a tragedy was terrible. Given that many were convinced he would never survive the attack by one of his beloved tigers, to see him recover to the point where he can once again perform on stage, even in such a limited fashion, is truly amazing. That he should share the stage with the same tiger which cut short his career is heartwarming.

I hope he continues to improve and we see more of them in years to come

Il y a du monde

2009-03-05T22:06:00.008+01:00

That's what Marie says to me on the phone when I try to book a depart for lunch time today.

The earliest she can fit us in is 3pm - a bit of a shock given I was aiming for 11am! No good reason for this sudden influx of people, other than - presumably- a strong desire to get out there and play after all the crappy weather we have been having.

Anyhow, 3pm is not much use to us, not really giving us time to do more than 9 holes, so we decide to divide and conquer. Lynne has something else to do this morning, so I try for a slot on my own. Success.

Except, when I arrive around 11am, I find 20 people waiting at the first tee. This is going to be painful. Jean-Marc the starter works his magic, juggling parties and tee times to get everyone grouped into foursomes and tee'd off as smoothly as possible. I end up playing with Morgan Freeman, Three-Fingered Man and Lionel.

It's not the real Morgan Freeman, of course, but he has a very Morgan Freeman-ish thing going on - Morgan Freeman if he was a foot shorter and French. Three-fingered man has three fingers on one hand. Lionel is....well....Lionel, and was the only name I caught during the introductions. Very nice men, none of whom snigger as I screw up my first tee shot.

Naturally, with 16 people standing behind me watching I manage to hook the first tee shot out of bounds on the left. As I hang my head in shame, Jean-Marc suggests I re-take it - probably more to do with the fact that if I can manage a decent second shot it will aid in getting our party off the first fairway as quickly as possible rather than leaving me hacking out of the vicious rough.

While on the first tee I am chatting with the guys who I played behind on Tuesday, where I get to find out why we progressed so slowly. One of them tells me about the party in front of them on the par 3 7th hole - the best of the group shot 8, the worst was on her 15th stroke when she gave up. There was nobody in front of them and a whole queue of groups behind them, and yet they refused to let anyone past. Pretty poor show, and one of the failings of our club that they don't have someone patrolling the course and shooting people who cannot hit a ball past the ladies tee.

Amazingly, given the numbers waiting today, every party plays well and we don't have to wait at any tee. Just shows how smoothly things could run even with a crowded course as long as people keep it moving along.

My best game for weeks as I shoot 97 (first time I have played under my course handicap in ages), including a couple of pars, couple of greens in regulation, average drive of 190 and average putts of 1.8. Big confidence booster. Given that I bogey most of the holes, it just goes to show how two bad holes can wreck your score card - in my case a couple of triple bogeys (one of them on the aforementioned par 3 - d'oh!) spoil an otherwise excellent round.

Quick question for other amateur golfers. When it comes to recording your greens in regulation, do you count them with or without your handicap? For example, on a typical par 4, GIR is 2, but if you have an 18 handicap your par for that same hole would be 5. So now, is your personal GIR 2 or 3?

Lynne manages 9 holes with her friends in the afternoon, so we both finish about the same time. We are so tired, we ditch dance class and opt for pizza and wine instead. I know, I know....

We also watch "In Bruges" for the third time (Colin Farrell, Brendan Gleeson and Ralph Fiennes). Farrell and Gleeson play hit men sent to Bruges to lie low after a botched assassination attempt. Ralph Fiennes plays a superbly over the top gangster, with a performance ripped off from Ben Kingsley's in "Sexy Beast", but that's no bad thing. There is lots of dark humour and violence, though none of it gratuitous, and a glorious ending.

I might only be able to watch this another three times before I have to wait a while before watching it some more. If you have not seen it yet, I highly recommend you give it a go. If you don't like it, let me know on ihavenotasteinfilms@loser.com

Golf and Sunshine

2009-03-04T11:49:00.005+01:00

Feeling very sorry for those of you on the east coast of the US shoveling snow from the greens and having to wear 5 layers of clothing just to go out and practice.

Not wanting to rub it in, but it is t-shirt weather here today, and perilously close to shorts-wearing temperatures (at least for the British ex-pats down here - the French will continue to wear 5 layers of clothing until the temperatures hit 30 degrees!)

Decent first 9 today with a couple of pars and greens in regulation for a respectable 48. The back 9 went to pot, however, with too many three puts and triple bogeys, resulting in an abysmal 52! Driving and long irons are reasonably consistent, but I really gotta work on the approach play and putting.

However, and not to rub it in... no, really.... it was so nice to relax at the 19th hole afterwards in the beautiful sunshine, quaffing a cold beer and watching the following parties make a hash of the 18th.

New episode of Joss Whedon's Dollhouse tonight - this one is shaping up very nicely.

Too Much Golf

2009-03-01T14:27:00.005+01:00

WAY too much golf, in fact. Or just way too much TV. Either way, my butt is numb....

The Accenture World Golf Championship started last Wednesday and heralded the long awaited return of one Tiger Woods. With Sky coverage amounting to 4 hours per day on Wednesday, Thursday and Friday, and then 8 hours+ per day over the weekend, this required some serious commitment to watch.

There was a lot of disappointment as Tiger was dispatched unceremoniously in the second round (this is a match play format), denying us the spectacle of a McIlroy v Woods match-up on the Friday. This disappointment was tempered for those of us on this side of the Atlantic by the number of Brits in the final rounds, only to see our hopes dashed as both Poulter and McIlroy were sent packing in the quarter finals.

This did set up a very exciting all-British semi-final, however, between Paul Casey and Ross Fisher.

Still, Rory didn't lose his match, but was beaten by a very in-form Geoff Ogilvy, who went on to make Paul Casey look very ordinary indeed in the final.

Again, you can't say that Casey played badly (though he did fail to capitalise on the few chances he had), but Ogilvy was just relentless, and in outstanding form. A worthy winner.

And a sad end for poor Ross Fisher, beaten into fourth place by Cink - but if you have to lose, you do want to lose against a bunker shot of that quality!

Golf

2009-02-27T14:02:00.004+01:00

Back on the golf course today, even though I swore I would never play again after the last game....

Funny sort of game really. Last time out I shot 97 but felt like I had played really badly. My ball striking was poor, yet I got lucky with a few errant tee shots on the par 3's which rolled onto the green and salvaged something out of what could have been a terrible score.

Today, I shot a truly abysmal 102 (52 out, 50 back), and yet felt I played much, much better and was dealt a few really harsh blows by the very blustery conditions. I had way too many double and triple bogeys, and much of my wedge and short iron play still sucked, yet I hit 8 fairways (despite the treacherous winds), averaged 200 metres on my drives (had 3 over 220 metres, which is getting on for the longest I have ever hit), and averaged 1.8 putts per hole.

I had two great up-and-downs to save par on a couple of par 3's, and played some great 150 metre hybrid shots out of fairway bunkers, so there were lots of positives. Unfortunately I hit only one green in regulation (and even that one I went on to 3 putt!)

Like I say, it's a funny sort of game, because the score card really isn't everything. 50% of golf is in the head. And the other 50%.... well, that's in the head too!

Tiger's Back!

2009-02-24T11:34:00.001+01:00

Yes, Tiger Woods makes his eagerly-anticipated return tomorrow. I thought this Nike video was funny...

Twitter Spoilers

2009-02-23T16:20:00.004+01:00

I was forced to unfollow someone on Twitter today.

This was nothing to do with the depressingly regular instance of blocking someone who only wants to garner followers or spam me with some get-rich-quick scheme, but was necessitated by a difference in philosophy - what I wanted from Twitter was not what he wanted to give.

Social networks can be a boon or bane, and Twitter can be both at the same time, unfortunately. The small posts make for a neat medium for transmitting news items and regular updates. Twitter is how I get a lot of my tech news right now, since it is full of people who have more time, inclination or professional need to scour the internet for interesting tidbits.

If, however, I want more details, I have RSS readers for that and I can go get my sports results, for example, at my leisure.

And herein lies the rub. Twice in the last week I have taped a sporting event to watch later. Twice in the last week some bright spark has announced the result on Twitter. No.... "cover your eyes, here it comes" announcement - Twitter, after all, does not lend itself to that.

It's no big deal, but it highlights the need to carefully assess what each Twitterer is offering. I followed @putt3r because he had some useful golf-related insights in general. But now I have had to unfollow him because he announces tournament results as soon as they finish, and he is in a time zone which usually means I will see the results before I even get a chance to record the program, let alone watch it.

I have also unfollowed a couple of people who insist on giving me a blow-by-blow account of their particular favourite sporting event as it happens. WTF? This is like radio commentary but without all the excitement....

The "always on" nature of Twitter can be one of its greatest strengths - it can also make it one of the biggest pains in the ass.

Golf Disaster

2009-02-22T17:45:00.005+01:00

Attempted to play golf today - complete disaster.

Played like a monkey. No - played like a right-handed monkey using left-handed golf clubs. Actually - played like a right handed monkey using left-handed golf clubs and suffering from a severe, debilitating twitch during the downswing. And one eye. And a wooden leg.

And monkeys can't even play golf (this is a fact - they are too short to drive the golf carts)

That's how bad I was.

When Buffalo Attack!

2009-02-21T10:07:00.001+01:00

This is the most amazing wildlife video I have ever seen...

Don't be tempted to stop watching before the end

Death Of The Language?

2009-02-20T16:16:00.002+01:00

I was shocked to read this today.

I'm not sure what disturbs me the most. Are those in charge so out of touch that they believe that encouraging the use of unreadable slang in class will help kids learn? Or do they think that it is a good thing that they are promoting illiteracy when they should be teaching those kids how to construct a grammatically correct sentence with minimal spelling errors?

I am not sure where all this will lead, but it can't be good.

Lunch today with Clive and Fabi who introduced us to a new place (for us at least) in the heart of Nimes. Le Chapitre, 2a, place du Chapitre (Tel 04 66 84 93 15) serves excellent French/Italian food at reasonable (though not cheap) prices. We all chose from the 20 Euro menu, and my tarte fine (goats cheese and serrano ham), followed by risotto with pesto, tomatoes and dried serrano ham was superb. The tiramisu was nothing to write home about, but we will definitely be going back.

Doubt

2009-02-19T16:09:00.003+01:00

Saw Doubt at the Semaphore tonight, starring Meryl Streep, Philip Seymour Hoffman and Amy Adams.

Streep and Hoffman are superb as usual, Streep putting in a performance that even had me forgiving her for that abysmal Mama Mia fiasco. This film is not nearly as heavy as you might think from viewing the trailers, relying often on moments of real humour to move it along at a brisk pace. 90 minutes flew by, and I heartily recommend this one

Golf At Last

2009-02-17T13:36:00.003+01:00

Yes, after what seems likes months of bad weather (it's weeks really, which is still pretty unusual in these parts) we finally get back out on the golf course.

The last time we played the greens were solid as concrete and several of them were still partly obscured by snow. Not that that affected my game at all - I can play crappily under all conditions...

Today is no exception. After a promising practice session where everything I hit soared straight and true, it quickly becomes apparent that I have peaked before even teeing off. Shot after crappy shot turns into a dismal 51 on the first 9 holes, and it is only the warm sunshine and empty fairways ahead of us that persuade me to keep going.

With a 23 handicap (26 course handicap at Vacquerolles) I need to shoot 98 or under to play to my index. Amazingly I turn in a 46 on the back 9 to give me a respectable total, but this is one of those times when the score flatters. I hit several appalling tee shots which somehow keep rolling - in the case of both par 3's on the back 9 they roll right onto the greens allowing me to get par. In all, I manage 4 pars and a few bogeys to get that score, to balance the seemingly endless double and triple bogeys on the first 9, but I still didn't feel I played well - more that I got lucky.

For some reason, for example, I cannot hit a wedge shot to save my life right now - I think it is time to go back for lessons.

Curry And Sand

2009-02-15T11:40:00.002+01:00

Not together, you understand, but one after the other.

We meet up with Axel & Wendy and Sarah & Steven (and associated offspring) at the curry restaurant in Lunel, which turns out to be excellent once again. I have the korma and Lynne the karahi and they are both very tasty - certainly the best we have had in this region of France.

After catching up on S&S' adventures in Oz and misadventures with their builders, Lynne and I carry on with Harry to the beach at Grandes Mottes. Surprisingly for such a cold day, the beach is packed (well, as packed as they get round here) - maybe it is enough that it is sunny after all the rain we have had recently, 'cos the French (at least in the south) are not normally renowned for trekking around in the cold, preferring to wait for temperatures in excess of 30 degrees Celcius before they take their winter coats off!

Polite Society

2009-02-14T20:46:00.003+01:00

Over a very nice curry dinner at Jan & Alex' tonight, we are reminded of one of the strongest reasons we had for moving to France several years ago.

The other dinner guests are William (the mayor of Cannes-et-Clairans) and Christine, and their daughter, Paloma. In England, we would have run a mile on seeing that dinner guests had brought young children (I would guess she is about 8 or 9). The usual reason for dragging kids to a dinner party would be for the parents to abrogate all responsibility for their brats for the rest of the evening while they get steadily pissed, said brats getting louder and more obnoxious (and frequently getting pissed themselves having located the booze store in the garage when no one was looking)

Initially, of course, they would completely ignore you, not even looking up from their Nintendo DS to acknowledge your existence. As the evening wears on, they might deign to move from in front of the TV to demand food different to that which everyone else is eating - definitely to include chips - before returning to the TV to eat it on their laps.

French children are different. Paloma immediately stops what she is doing as we arrive to greet us with a polite hello and the traditional three kisses on the cheeks. She participates in conversation when spoken to by the rest of us, always at a very adult level. She sits down with the adults for the meal during which she is a model of restraint, speaking when spoken to, as she eats the same food as the rest of us (despite the fact that the chances of her having tasted such spicy food at home is pretty much nil). Once everyone has finished their food, she excuses herself to watch TV quietly in the other room while the adults chat, and at the end of the evening we receive three more kisses and a polite "good night".

In short, she is a pleasure to have around, and this, we find, is typical of French children.

I realise generalisations are dangerous - that there are a few English children who are raised correctly and there may even be a few obnoxious French children around (though we have yet to come across them).

But the other thing about generalisations is that they are generally true, and this particular one will ensure that French society continues to be one in which politeness, respect for elders and the importance of family life is drummed into children from an early age, and which will - long after English (and American) society, having long since eschewed the aforementioned qualities, has continued its inexorable decline into the depths of hell - ensure that France remains a country in which it is a pleasure to live.

Death of a Diplodocus

2009-02-13T18:18:00.000+01:00

Death of a diplodocus
Originally uploaded by bobwalder

Harry's willpower finally deserts him and the result is diplodocus guts all over the sitting room.

Thing is, it's never HIM who has to clean this mess up, is it?

New Videos Of Harry On YouTube

2009-02-13T14:28:00.002+01:00

New videos of Harry available on my YouTube page (click here to view).

Whatever Happened To Free Speech?

2009-02-13T12:41:00.003+01:00

This article in the Telegraph just reinforces my post from last Thursday, and makes me even more glad I moved out of the UK if this is where it is heading.

"Free speech is about understanding that some people hold a different view from you, whether you like it or not. When we start to alert the "authorities" to thought crimes we really are one step away from the dystopian world that Orwell invented as a warning, not a prophecy.

Is Britain now adopting a position where people who support suicide bombers and jihad are able to make known their opinions without legal challenge, whereas those who oppose them cannot?"

Everyone's An Expert

2009-02-12T17:07:00.009+01:00

I am increasingly amazed at the number of people Tweeting and Blogging who claim to be experts in the field of new media, internet marketing, and so on.

In my day (hello... sounds like a lecture from my dad coming up...) you would probably expect to spend a few years specialising in something before your peers might reluctantly grant that you might possibly be considered something of an expert in the field.

These days, any spotty oik with a PC seems to think that posting a few grammatically incorrect irrelevancies on a blog entitles them to claim the aforementioned titles of "Internet Marketing Expert" or "New Media Consultant".

I was followed on Twitter by someone of whom I had never heard yesterday, so I did a little digging. His Twitter biography states

"Well I'm a internet marketer,infopreneur, enterprenurer,and a sports fanatic...and love to help people with there problems."

and alongside it is a headshot of an individual wearing a hoody. No, really!

OK... where to start....

Quite apart from the obviously bogus claims (more on that in a minute), it's hard to take seriously anyone who (a) wears a hoody in a pic designed to promote his professional services, and (b) cannot be bothered to spell check his main biography entry. Of course, even if he had managed to catch "enterprenurer", my guess is he would still not have realised "there" should be "their"... ah well....

So this guy - who doesn't actually have a web site of his own - is offering his professional services as a PR/media consultant to help promote other people's sites. I am not sure how anyone could resist his sales pitch:

"hey havent talked to you in a while....but remenber when we talk over email,i offered to promote your website with all kinds of differnet ways to promote your website.......well I'm gonna do us both a fab....and I'll do it for free....if any one eles out there wants website to be promoted talk to me and I'll do it for free all i ask is when you start making sales give me 5% of it"

Sounds tempting, huh? He even claims to have a team of people "wot he has trained" ready to help out (probably the other teenies in his skateboard gang).

But then he goes and spoils the professional pitch by revealing less-than-impressive technical credentials such as (a) he is in his final year of school (so plenty of business experience then?) and (b) by asking basic web-related questions of others, like:

thanks....hey how do i creat a website like you....telling the world all about me...like you do

Awwwwww... I was so close to offering him a job, too. Thing is, I am not picking on this kid (I have not named him, and will not), and if this was a solitary incident I would be more inclined to offer him a few pointers. But it is not - there are hundreds of examples of this nature which I can actually find, which means there are probably thousands of these guys peddling their (there) sub-standard wares to an unsuspecting public.

Hopefully, not even those new to this "new media" gobbledegook will be suckered into employing one of these yahoos - surely spelling and basic presentation skills still count for something, even if we no longer require you to have several years of experience in a subject before deeming yourself an expert.

With every man and his dog claiming to be an internet marketing "expert" these days, we should all remember that classic definition of the word: "X" = the unknown quantity, and "spurt" = a drip under pressure....

(PS. Before the arrival of the inevitable caustic comments regarding my own spelling, I should point out that (a) I am aware that "hoody" can also be spelled "hoodie" - both seem acceptable (in terms of spelling, if not in terms of fashion sense) - and (b) I am British, so all those words you are going to complain about do in fact end in "ise" in the Queen's English, and not "ize" as you might believe)

Sinsans Walk

2009-02-11T20:27:00.006+01:00

Another month has passed and it's time once again for Bryan's monthly walk in the rain.... except that today it's not raining!

It is, however, ankle deep in mud at the beginning of the walk around Sinsans, which just means that the numerous dogs which have joined us on today's walk get the chance to jump up at everyone with muddy paws and knock them over.... oh the joy!

With 6 dogs in evidence it is quite a pack event at the front, with some jostling for position and supremacy, interspersed with some attempted shagging of Minnie by Harry - much to the annoyance of Max (Minnie's boyfriend/life companion). Boo and Scruffy, meanwhile, eschew mingling with other dogs in favour of much more interesting stuff like chasing passing cyclists - much to the annoyance of the passing cyclist!

The weather is superb, the walk is well researched, and a good time is had by all, but particularly Harry who turns up in the back of the car at the end covered in mud!

Forgive the quality of the photos - I only had my iPhone with me. Roll on summer for the new iPhone and let's hope they beef up the camera to 5 mega-pixels rather than the speculated 3.2.

Living Will

2009-02-10T17:37:00.001+01:00

Last night, the two of us were sitting in the living room and I said to her, "I never want to live in a vegetative state, dependent on some machine and fluids from a bottle. If that ever happens, just pull the plug."

She got up, unplugged the TV, and threw out my wine.

She can be such a bitch!

Why People Just Don't GET The Kindle

2009-02-10T13:32:00.005+01:00

The Kindle 2 was launched yesterday to huge fanfares from Amazon and underwhelming responses from journalists. Why is it that some people just don't GET the Kindle, and similar eReader devices?

Of course, it all depends on your physical reading preferences. In our house, my wife (Lynne) and I are diametrically opposed in our views of eReaders. I like them a lot, she hates them and the horse they rode in on. She loves reading books - I think the physical handling and smell and feel of books has a lot to do with it, but she will also point to the fact that she finds computer (and eReader) screens hard to read for long periods of time (true) and the battery will always run out halfway through a gripping chapter (also true - and particularly inconvenient if your choses eReader device is also your mobile phone, as in my case).

Now me, I LOVE eReaders, and genuinely think they are the future, and that all forms of paper-based publications will eventually die a death. I don't have any difficulty in reading books even on my relatively small iPhone screen (I use the eReader app) and I love the fact I can pick up from where I left off with my latest novel while I am stuck in a doctor's waiting room.

But the biggest advantage of the electronic book to me is choice. When Lynne and I go on holiday, at least one suitcase is usually stuffed with books - a carefully chosen selection that has to see us through the entire holiday ('cos there are never any English language bookshops where we go!) However, half way through the holiday I will often have a hankering for some other reading material - a book which is still at home on the shelf. Or maybe I just want to look something up - a bit of quick research for an idea I just had.

This is where the eReader really scores. Loading 1500 books onto a single device is not useful from the point of view of providing 1500 books to read before the battery runs out, but it IS useful in providing choice. Today I can read a thriller, tomorrow sci-fi, the day after, comedy. And so on. I can select form my entire library at any point in time, depending on my mood. And, of course, with the Kindle, I could also browse newspaper and magazine subscriptions.

So for me, the Kindle is a no-brainer. I want one. At least I would if it weren't for a couple of minor obstacles:

1. Price - It is just way over-priced. Amazon needs to sell it dirt cheap and make money from the content. Given the way people will use a device like this, it has to be cheap enough (and easy enough to restore from scratch and re-populate with content) so that leaving it on a bus or train (or dropping it in the sea) is not a big deal. This means a $50 price point, not $360

2. No European release - here we are on the second major release of this device and you STILL cannot get one in Europe. What gives?

3. I would prefer WiFi over 3G (or give us both, at least) - clearly this is also the biggest stumbling block for a world-wide roll out, so why not add WiFi and make it a non-issue?

There is also talk about the Kindle content making it to the iPhone, which would be nice, since then you only have to buy once and can choose your reading platform and switch between the two as required - Kindle if I know I am going to be doing a lot of reading, or iPhone when I find myself stuck on the underground unexpectedly (how unexpected could THAT be?)

Social (Network) Niceties

2009-02-08T17:25:00.003+01:00

I have been using Twitter for a while now, and have quickly passed from the "what do you do with it?" phase to the "what would you do without it?" phase. But there is a side of Twitter which irks me greatly.

On the upside, it is an extremely useful medium for acquiring snippets of information, links, pointers or "the mood" of a group of people, although it can sometimes take a bit of work to sift through the dross. As with anything to do with the Internet, the signal to noise ratio can be high, and you have to experiment with who you want to follow to make sure you don't get swamped with irrelevancies.

I use it for personal and professional stuff, and have Profile Peeks, searches and filters set up in my Twitter clients (I use Tweetie on my iPhone and EventBox on my Mac desktop) to try and streamline the information-gathering process. At the same time, the dynamic nature of the relationship each user has with Twitter means that you can reach many people in a single stroke with your Tweets and Re-Tweets, allowing you the opportunity to broadcast your own snippets of information or links to other sites.

But what about the downside? Well, it is not something I have had to deal with personally, since I do not have thousands of followers, but I have noticed a nasty side to Twitter when reading through the time line of someone like Stephen Fry (@stephenfry).

Just last night, for example, the wonderful @danspring wrote directly to Fry: "Stephen Fry has been removed - I'm no longer a follower. The man updates shit 24/7! Bye, bye @stephenfry".

This from a man whose Twitter content seems to consist almost entirely of football results and the price of plums in Sainsbury's... See, if you don't like Stephen Fry, why follow him in the first place? If it turns out that his Tweets are not as interesting as you thought, why not just quietly unfollow him? Why resort to calling him out publicly?

Then you have the idiot @stephen_fry who tries to scam Twitter users by passing himself off as Fry, and blaming Fry for being too touchy when he gets caught out. He now claims that he should be able to do whatever he likes because - in his words - he has a comprehensive education and he is dyslexic and, anyway, it was supposed to be a parody not an impersonation... yeeeeeahhhh right....

There are a number of fakers on Twitter, unfortunately, grabbing celebrity names as Twitter IDs and then passing themselves off as said celebrity? Why?

Of course, you have the opposite too - top quality Twittering from the genuine article whose identity is called into question. Take @harry_winston, for example. There are those who don't believe that a Labrador can post to Twitter.... clearly a misconception since, who else could be bothered to post on behalf of a 40KG mutt with a penchant for dead things?

The Day After Tomorrow

2009-02-08T16:00:00.003+01:00

No, this is not another Movie night review (though I did quite enjoy that film).

I was just thinking about the movie as I read through the news stories from the UK over the past week or so. Schools closed, workers not (working, that is), buses and trains cancelled (probably more from the drivers staying at home than any serious snow-related blockages), motorways at a standstill, people abandoning cars and scurrying for council-run emergency shelters, wild animals on the loose eating small children (Ok.... I made that last one up....)

And whilst it did look like a bit more snow fell than usual, one has to ask the question "would our parents have stayed at home?" No, and our grandparents not only wouldn't have stayed home, they would have cleared the roads and paths with their own bare hands before work. Britain is getting soft.... (actually, I think we passed "getting" a long time ago.)

The Federation of Small Businesses said the cost to Britain's economy through lost productivity could be as high as $4.3 billion. So much for global warming ;o)

Movie Night

2009-02-07T22:47:00.002+01:00

After a dull day doing chores (well we have to remove half a ton of Labrador hair from the house at some point...) a nice pasta, glass of red wine (Chateau Langlade oak aged Prestige) and a good movie are the order of the day.

We settle on "Burn After Reading" directed by the Coen brothers. Pitt, Malkovich and Clooney in outstanding form - absolutely hilarious and highly recommended.

Weather Woes in Haiku

2009-02-06T13:24:00.006+01:00

Cold grey leaden skies

Winter clouds bring too much rain

When will I play golf?

:o)

No Explanation Should Be Necessary

2009-02-05T12:44:00.006+01:00

Given the concept of free speech and the inalienable right of the blogger to spout crap, I should never have to justify anything I say here. This is MY soap box, and if you don't like what I have to say then you can always.... well, I guess you know what you can always do.... ;o)

However, following some "feedback" I received via Twitter following yesterday's post I thought I would clarify something.

I am not a racist. I am not a bigot. Anyone who knows me well knows that. Anyone who THINKS they know me via a few 140 character Tweets or the odd blog post here should probably put their brain into gear before attacking me. Read yesterday's post again....carefully this time....

I am NOT anti-gay. I am NOT anti-muslim. I am NOT even anti-Milton Keynes.

What I AM is anti-PC. This wave of "political correctness" which has swept the UK will be the death of British culture, if such a thing exists any more. Positive discrimination never works, and yet we see it practised time and time again in Britain now as "minorities" (often not that minor, in reality!) are given preferential treatment over the masses, and the authorities cave in left and right in an attempt not to offend them - rewriting laws, rewriting books, even rewriting history wherever it is deemed "offensive" or too "pro-British". THAT was the point of yesterday's post.

It upsets me that we have to watch what we say at every turn. It upsets me that certain groups can appropriate words that once were perfectly innocent - to have aspirations to be a "gay batchelor" these days has very different connotations to when our parents were young. And apparently we can no longer sing about "baa baa black sheep" or tell stories about "three little pigs" for fear of upsetting some ethnic group or another. I will leave you to figure out which....

What is being forgotten these days is that tolerance is supposed to work both ways. The great "multicultural society" experiment which has consumed governments for the past few decades has proved, like communism, to be a total failure. MULTI-culturism will never work - the old ideal of the "melting pot" only works if everything in the pot does indeed melt, infusing the separate ingredients with elements of each other to achieve a harmonious whole - a tasty stew, if you will, rather than a hodge-podge of separate ingredients which nobody likes.

And this means that we cannot simply subvert or jettison our heritage for the convenience of others. Songs and stories should be allowed to survive, but put into some sort of historical context for the children of today in order to highlight WHY such things became offensive over time and why it might no longer be appropriate to use them. Classics which have survived generations should not suddenly be re-written to eliminate non-PC words or phrases - but people should be educated as to why they must no longer be used in polite society.

Is that naive of me? Maybe - children in the school yard will always discover something they think is offensive and use it, but they will get that from the internet these days, not from reading Enid Blyton. So is it really necessary to butcher or ban Enid Blyton in order to satisfy the cravings of a few PC-Nazis (oh, damn, am I still allowed to talk about Nazis?)

At the end of the day, it is my firm belief that (a) the vast majority of "normal" people never actually recognise the offensive nature of these things, and (b) the vast majority of those people who are SUPPOSED to be offended by them never actually are.

It is down to that smallest minority of all, the PC-censors, to tell the rest of us what we should be ashamed of, and then go about imposing the most ridiculous of changes in response.

And you know what I have also noticed? That those shouting the loudest about the scandalous slur against Milton Keynes residents never actually live in Milton Keynes....

END RANT

And whilst on the topic of discrimination and tolerance, how about this story. Only 116 years to integrate the sexes.

Those uppity women. What next - the vote?

Sex, Politics and Religion

2009-02-04T13:41:00.007+01:00

The three things you should never discuss at the dinner table...

Well we don't have sex, but politics and religion we got in spades. Firstly, how we we be so complacent as to allow significant historical monuments rot away, especially when they have contributed so much to our nation's security in the past.

I am talking, of course, about Bletchley Park, which appears to be ineligible for any sort of government funding (well, they have no money left, of course) or lottery funding. Wot, no lottery money? How come?

Not gay enough? No single black lesbian mothers involved? Not muslim enough? Too close to Milton Keynes? After all, who wants to remember one of the birthplaces of achievements which helped win the second World War?

Well, I would like to - I have been a few times, and it makes for a fascinating day out. And if you would to help, you might try banging your head against this particular brick wall by going to the Online petition - Save Bletchley Park.

Onto my second rant of the day.

Peter Hitchens is very outspoken, and very rarely errs on the side of political correctness, and these two qualities endear him to me greatly, even if I do not always agree with his opinions. Of course, he has it wrong in his latest blog entry.

The police were not scared and were probably not lacking leadership - quite the opposite, in fact. My guess is they had been given very clear instructions not to antagonise the muslims, 'cos that's what we have to do, these days, isn't it? Not antagonise them. Grovel. Basically let them do what they want.

In stark contrast, the police were allowed to behave normally when confronted with a single, unarmed, gobby journalist, and he was probably lucky to walk away with all his teeth.

Breakfast for Kestrel

2009-02-04T12:59:00.002+01:00

This slide show is pretty self explanatory.

Little did we suspect when we put out the bread and seeds under the olive tree that we would be setting up this unsuspecting starling in quite such a spectacular way.

Don't get too squeamish if I tell you that it was the screaming which alerted me to the goings on, but I didn't feel empowered to interfere given that this same scene will be played out several times a day outside our garden.

If I had succeeded in chasing off the kestrel I would have been left with a starling with a huge hole in its chest which I would then have had to put out of its misery (and the kestrel would have had to go kill another bird for its breakfast!). Nature in all its savage glory...

Risque d'Inondation

2009-02-03T14:56:00.003+01:00

That's what it says on our weather forecast right now, and friends of ours in Salinelles have been warned to vacate their house tonight as the Vidourle continues to rise.

It is no joke when it gets to this stage, and all of us round here can still remember the last time Sommieres suffered in 2002 (see pic).

Here's hoping the rain passes and we get a day or two respite.

On another topic, in being informed of the new development plans for the outskirts of our little village, I find to my delight that we have a web site devoted to the village (and the plans). Fascinating (at least for those of us who live here....) with some lovely old pics. The thing that fascinates me is that when you study those old pics - some of them VERY old indeed - the heart of the village has changed very little since they were taken (right down to the same old lady sitting outside the front door in one of them).

Rory Breaks His Duck

2009-02-01T21:55:00.004+01:00

After two near misses recently it was nice to finally see Rory McIlroy lift his first major trophy since turning pro only two years ago, at the same time becoming the youngest winner - at just 19 - of the Dubai Desert Classic.

He kept us on the edge of our seats though! After playing some outstanding golf and leading for the first three days he seemed on the verge of running away with it as he sunk five straight birdies on the back 9 on the final day to garner a 6 shot lead over Justin rose with only four holes remaining. Rose ploughed on regardless and McIlroy's nerves started to get the better of him as he dropped three shots on the next three holes.

McIlroy and rose went to the 18th with just a stroke separating them, and with Rose on the green and McIlroy in the bunker things were looking bleak. You could hear the chomping of fingernails from the crowd as Rose two-putted and McIlroy made what he described as "one of the best up-and-downs of my career" to win the tournament by a single stroke.

Nail-biting stuff that kept me on the edge of me seat this afternoon, and a great antidote to the terrible wet weather which persists (yes, it's persisting it down right now in fact!) in making it impossible to play golf ourselves.

Head Down

2009-01-30T18:12:00.003+01:00

Lynne is out at her book club today so me and the mobile trash can are out for walkies stag.

I decide that it has been a while since we tried to climb the oppidum (we have been driving up to the top and then walking because of the bad weather) so we give it a go today. Whilst it doesn't bother the 4-paw drive, maximum traction Labrador in the least, I find the paths covered in two inches of water and ankle-deep mud to be more than a little treacherous after this week's rains. Back to driving up tomorrow...

Having worked my way through the new Doctor Who series (and Torchwood) recently, I am now watching some of the classic Dr Who episodes featuring the Daleks and Cybermen. Many of these I have never seen because I lost the faith once Tom Baker took over, and it only went downhill from there, IMHO.

However, having got used to the more lighthearted portrayal of the Doctor by Tennant and Ecclestone, and having warmed to Baker in other roles in recent years, I find the early episodes much easier to watch. Incredibly, despite the low budget and limited special effects (you can actually see the feet under the Daleks as they try to cross rough terrain in one episode!) the quality of the writing and story-telling stands the test of time, and these 30-year old episodes are very watchable. I kick off with Genesis of the Daleks (one of the best Dr Who stories ever bar none) and Destiny of the Daleks (the follow-up) and am mightily impressed. The extras are well worth watching too.

The rest of the day it is head down over my C programming book (or rather, C Programming PDF file...) ... ahhhhh, it's all coming back to me.... the long hours... the stiff neck... the dodgy Pointy-Haired Bosses.... the irate users... the crappy salaries....

Who wouldn't enjoy being a programmer?

Harry Goes All Webby

2009-01-29T15:25:00.004+01:00

Harry is going mad with this new technology stuff. Don't know how he got my credit card but he has registered himself some domains and got himself a blog.

He posts under his official French name, Arri, so you can find him at:

http://www.arrithelabrador.com

Right now his blog is a straight feed from his Twitter posts - lazy sod. He reckons it's because it's hard enough to type 140 character Tweets when you don't have opposable thumbs.

Any excuse...

Cooking Stuff

2009-01-28T21:48:00.003+01:00

Here is a quick and easy recipe for those of you too lazy to go out for takeaway:

Take some ingredients out of the fridge. Try to choose some ingredients from each of the four main food groups: animal, mineral, vegetable and chocolate. Try to include as many colours as possible

Anything round, you should dice finely. This is nothing to do with board games, but involves chopping up into very small pieces, each one looking like a very small die. This is an opportunity to show off all those cool knife skills you learned in Chef School.

Put blue plaster on thumb. Put blue plaster in index finger. Did you know I can reproduce? I will send you some baby pictures once you finish this

Anything which is green, shred using very fast knife action.

Put blue plaster on little finger. Consider wearing gloves.

Saute green stuff with some onions and spices until gently aromatic and fruity.

Mix water and animal bones and vegetables in a pan and boil slowly to make a delicious stock. This is the base of all your classic dishes so make sure you make it like chef told you. I find that adding a small pinch of salt at exactly five munute intervals will make the finished stock glossy and sleek.

In another pan (assuming you have more than one of those hot things on top of your stove - if not you will have to wait until the stock is finished) you make a burr-blank. This should be made with the finest of your ingredients. Make sure you melt the butter in the cream slowly like chef taught you and not like that idiot in chef school has been trying to tell you.

Rub some butter on the burn on your thumb. Consider buying an iPhone 2 years after everyone else had one. Spend a few hours deciding how you will split your Abba collection between your iPod and iPhone.

Add some of the animal ingredients to the stock - after several minutes this will turn into a nourishing stew.

Sieve the stew onto a plate.

Pour over the burr-blank. Make sure you wipe any splashes off the edge of the plate using some toilet roll

The shredded green things should be arranged in a pleasing pattern around the stew

Serve with a good wine - some red is best, from France probably. Burgundy, I think, to complement the colour of the greens.

With apologies to Chris, who probably cooks much better stuff than this really...

Techie Day

2009-01-27T18:04:00.002+01:00

Futzing around (sorry for the technical term!) today refining backup strategy (Time Machine and Mac Backup are pretty darn good for "freebies", as long as you have plenty of spare Terabyte hard drives lying around to handle the huge amounts of data you can accumulate on a Drobo - CDs and DVDs are just not gonna cut it any more...) and trying to get to grips with various social network sites, figuring out how best to handle to sometimes overwhelming amount of information that can hit your PC/phone in the average day.

Finally knuckle down to some programming work around 6pm!

Sucky Weather

2009-01-26T16:04:00.004+01:00

Truncated dog walk this morning due to the crappy weather (again!). You would think Harry would be pissed off by this, wouldn't you? Benson would have been - Benson loved water in all its forms, and a bit (or a LOT) of rain would never have affected his desire to go out for a walk.

Harry, on the other hand, is a fair-weather Labrador. He has been known to sit in the doorway when it is particularly rainy with a look that says "OK, you go, and on your way back please fetch me a litter box so I can make with the pee-pee indoors. Thanks awoofully".

The rest of the day is spent investigating Twitter clients and RSS readers for the Mac, and forging ahead with the bone-up-on-C-fest.

As far as RSS readers are concerned, you could do a lot worse than try Google reader - it is a lot easier to track entries from the blogs you follow by using a single reader than by going from site to site via bookmarks. The other advantage of using Google Reader is that I can import all of those feeds directly into my preferred iPhone RSS reader - Pro RSS.

For Twitter, the obvious choice is Twitteriffic. This is a great client for both iPhone and Mac desktop, but although very easy to use, it is somewhat light on features. Tweetie is my current choice for the iPhone, a client which makes it much easier to follow/unfollow, reply, search, and so on. For the desktop, however, there is something of a dearth of good clients. Forget TweetDeck - anything that runs on Adobe Air is doomed to fail IMHO. Adobe Air is another one of those bloated lipstick-wearing-pigs - much like Java - which deserves to die at the earliest opportunity.

Enter EventBox (currently in Beta, from http://thecosmicmachine.com/), which not only provides a very nice Twitter client (very similar to Tweetie), but also RSS reader, Google Reader, Facebook and Flickr support. All my social networking stuff in one place - finally - even at $15 that can't be bad.

Intellectual Challenge

2009-01-25T13:29:00.006+01:00

I've decided to try and prevent total atrophy of brain cells by (a) reducing the amount of wine consumed, and (b) brushing up on my programming skills.

OK, so (a) is a non-starter - we all know that. This means I will have to rely on (b). In my dim and distant past, I started my computer career as a programmer, writing very dull programs for large companies to do stock control, payroll, WIP tracking, order processing, and so on. Although this will date me terribly, I will admit that I just missed the PC revolution - although I have always used them (and purchased one of the very first IBM PC clones to hit the UK), I have never programmed for them.

Realising that I have just got myself a kick-ass software development environment (the new iMac) and that Apple actually makes all its developer software and documentation available for free (how cool is that?) I have decided to bone up on my C programming skills so that I can get to grips with Objective-C and Cocoa to write apps for the Mac. Once I have mastered that I will start messing with the iPhone SDK (also free!) so that I can write apps for the iPhone.

Knowing that it will bore some of you to death, but also aware that it will interest others, and exercising the inalienable right of all bloggers to fill the Internet with self-indulgent garbage that will ultimately interest only themselves (and even that is questionable at times) I will be keeping you updated on my progress :o)

Great walk today up to the oppidum for the first time in weeks. Not the first time that we have walked on the top - we have been driving up - but the first time we have attempted the long climb since the rains started. The path up has been treacherous, with fallen trees from the high winds and too much mud from all the rain, but it has just about started to dry out again. So we give it a go.

On the way up we meet Pooka, the boxer bitch who lives just down the road from us and seems to make her own entertainment by buggering off round the village whenever she feels like it. We have never once seen her being walked by her owners, but she does join us frequently on our walks (and we suspect she participates in many other walks with many other packs too!)

Anyway, she loves to run and play with Harry, but all Harry is interested in is sniffing her back end and trying to mount her. Looks like she may be coming into season shortly judging by the amount of drool Harry is producing, but Harry doesn't appear to know what he is doing in the sex stakes so not too much to worry about right now. Need to keep an eye on those two kids, though....

Don't forget to check out Harry's adventures in his own words in the sidebar on the right or at Twitter, and please consider clicking the "Follow Blog" link down there on the right too.

Sir PukeAlot

2009-01-24T14:07:00.005+01:00

Bad night. VERY bad night.

Woken at 3am by the sound of a 40KG Labrador hurling his guts up outside the bedroom door. Try to get back off to sleep - maybe it's a bad dream, maybe it's real, but either way it can be dealt with in the morning. However, images of shattered pork chop bones floating in pools of yellow bile keep insinuating themselves into my consciousness and in the end I am so wide awake that I figure I might as well deal with it now rather than wait for it to congeal and dry into a horrid mess.

As I get dressed I ruminate on what a bad idea it was to give Harry the pork chop bones right before we all went to bed - but you try refusing a Labrador when he puts his chin on your lap and looks up at you from under his lids (remember that look Princess Di used to give to get everyone to fall in love with her?) with those huge brown eyes. OK, so we're weak, but we often forget that Harry has missed out on a lot of the treats that Benson used to get at his age just because he grew up in a time when Benson was having trouble holding his poo and so any treats liable to induce something of a jet-propelled nature were withheld from both dogs. The result now is that Harry is not used to these occasional rich treats, and I guess we all pay the price.

So I step out of the bedroom door to find the first pool of mess. Passing my study I see the next one just inside the doorway, and the smaller one right under my desk - has he been laying traps in revenge for the fact that I spent all say playing Spore instead of playing with him? Downstairs there are another four pools spread around the sitting room - I know that (thankfully) dog vomit does not smell anything like as bad as human vomit (why IS that?) but, regardless of that minor mercy, I do wish they would stay in one place until they finish chucking up.

I come down to find Harry lying on his bed, managing to cram both a "I'm SOOO sorry" look and a "Who me?" look on his face at the same time, and never quite making up his mind which one to go with. Dogs are always so upset when they throw up - to them it equates to crapping indoors, it would seem - and yet of course you cannot be remotely angry with them for being ill. Problem is, Harry seems to take the lack of admonishment to mean "OK, everything is cool, let's play" and starts to bound around through pools of vomit chucking his freshly laundered cuddly diplodocus in the air.

So NOW I get mad at him....

Long story short - I mop up the pools of sick and shattered pig bones with kitchen towels, Lynne follows behind with mop and bucket, and Harry goes back to sleep. It is 5am before I get off to sleep.... now I feel like crap.

Joke

2009-01-24T08:38:00.000+01:00

Lawyers should never ask a Mississippi grandma a question if they aren't prepared for the answer.

In a trial, a Southern small-town prosecuting attorney called his first witness, a grandmotherly, elderly woman to the stand. He approached her and asked, 'Mrs. Jones, do you know me?'

She responded, 'Why, yes, I do know you, Mr. Williams. I've known you since you were a boy, and frankly, you've been a big disappointment to me. You lie, you cheat on your wife, and you manipulate people and talk about them behind their backs. You think you're a big shot when you haven't the brains to realize you'll never amount to anything more than a two-bit paper pusher. Yes, I know you.'

The lawyer was stunned. Not knowing what else to do, he pointed across the room and asked, 'Mrs. Jones, do you know the defense attorney?'

She again replied, 'Why yes, I do. I've known Mr. Bradley since he was a youngster, too. He's lazy, bigoted, and he has a drinking problem. He can't build a normal relationship with anyone, and his law practice is one of the worst in the entire state. Not to mention he cheated on his wife with three different women. One of them was your wife. Yes, I know him.'

The defense attorney nearly died.

The judge asked both counselors to approach the bench and, in a very quiet voice, said, 'If either of you idiots asks her if she knows me, I'll send you both to the electric chair.'

Geek Heaven

2009-01-23T18:51:00.004+01:00

My new iMac arrived yesterday, so since then my butt has been glued firmly to my seat and I have been in geek heaven as I mess around with it.

It has a 3.06GHz Intel Core 2 Duo processor, 4GB of RAM, 750GB hard drive, a hardware-accelerated NVIDIA GeForce 8800GS graphics card with 512MB of VRAM (1920x1200 resolution with 32 bit colour) 5 USB ports (3 on the back of the screen and 2 on the keyboard), a FireWire 800 port and a FireWire 400 port. The screen is 24" of digital wonderfulness - I love it.

For those of you who are only used to Windows, I can make you green with envy by telling you that it takes a matter of 5 minutes of user interaction to set up a new Mac, followed by a few hours of disk activity depending on how much data needs copying from your old machine.

I connected my old MacBook to the iMac via FireWire and booted both. The iMac asked me a couple of simple questions and then I went for breakfast and to watch some classic Doctor Who episodes as the iMac copied over all my data, mail, account settings, preferences - literally everything which personalises your machine. Less than 3 hours later the new machine is ready to use and is indistinguishable in operation to the old one- seamless. Also - the OS itself is full updated in one hit so no need for the usual Windows Four-Days-Of-Downloads-And-Updates rubbish.

Spore - a Christmas present from Lynne - proves more difficult to install and requires that I unplug all external drives and close down all processes before it will update itself successfully. Why is games software still so flaky? I can see why dedicated consoles such as the PS3 are so popular!

However, Spore is not available on a console, so I persevere - and what a spectacular game it is. You control a single-celled organism from the moment it arrives in the tidal pool through all its stage of evolution from simple organism through to space travel, having a hand in designing the look and capabilities of your creature as it evolves. Very engrossing.

Pardon me while I get back to it - we just invented fire.....

Harry Winston Speaks

2009-01-21T08:39:00.003+01:00

I don't know how he managed it - no opposable thumbs and all - but Harry seems to have got himself a Twitter account.

Now we're gonna have to stop beating him and leaving him out in the snow....

Harry's latest Tweets will appear automatically in the sidebar on the right, or you can follow him in full at www.twitter.com/harry_winston or @harry_winston in your Twitter client.

You will also notice a new widget at the bottom of the sidebar, called "Followers". This looks like it could be interesting or embarrassing, so please consider clicking on the "Follow" link so I don't feel all Billy No-Mates.

You Need To Be So Careful

2009-01-20T12:12:00.001+01:00

This is just one of the many reasons I don't have kids.....

Drizzly

2009-01-19T11:57:00.002+01:00

Supposed to be playing golf today but what do we see when we look out of the window? Dreary, grey, leaden skies. Drizzle. DRIZZLE! In the south of France?

So I spend the day watching movies and sorting out my backup and data storage issues. I bought a Drobo recently (expensive, but well worth the cost given the level of data security and flexibility it offers) and just invested in a fourth Terabyte hard drive for it, so I have a total of 3TB of on-line storage attached to my Mac now (plus whatever the Mac's hard drive gives me).

With almost 600GB of MP3s, movies and TV shows in iTunes alone, plus video footage, eBooks, photos, etc. I need a different means of backing this up other than DVDs. Yes, I KNOW Drobo will protect me from drive failures, but "Just In Case" I need to make sure I am not going to lose this stuff if ever Drobo goes up in smoke (let's face it, those digital photos are irreplaceable, and there is a lot of money invested in the iTunes stuff).

My local computer store which has just opened in Calvisson is a great source of cheap accessories - WD 1TB hard drives, for example, for just 120 Euros! And he came to the rescue with a neat external hard drive docking station for just 32 Euros. This is a small plastic box which attaches to your Mac or PC via USB and allows you to insert any old SATA drive (2.5" or 3.5"), which then appears as an external USB hard drive on your PC. So I bought one of those, and now I can just buy a cheap SATA drive whenever I need to add some backup storage to my system - pop it in the dock, backup, pull it out the dock, and stick it in a drawer: voila!

I use the Mac Backup utility to do those big off-line backups, but anyone who uses a Mac should also take a look at Time Machine. By sticking a spare drive in that docking station, Time Machine will perform automatic incremental backups at hourly intervals, then daily, then weekly. TM also integrates tightly with certain applications such as Mail and iPhoto, so you don't have to go hunting around a backup disk to figure out directory structures looking for a particular e-mail message or photo. Instead, you fire up the application, and TM will let you step back in time WITHIN that app to restore a single mailbox, e-mail or picture. Pretty impressive. Microsoft users eat your heart out.....

Wedding Dance

2009-01-15T21:55:00.003+01:00

Cheesy? Dunno - given how much we all hate going to weddings, I think I would rather see the happy couple doing something like this than a boring waltz or "English Shuffle" around the dance floor.

One thing is for sure: when they started working on this routine they probably hadn't even fallen in love yet....

Impressive Goal

2009-01-15T19:30:00.002+01:00

This is an impressive goal, to be sure. But even more impressive are the almost superhuman, cat-like efforts of the goalkeeper.

Watch carefully, otherwise you might miss his save....

Hard Golf

2009-01-14T19:24:00.002+01:00

Yes golf is hard. But it's even harder when the ground is hard - or in this case, pretty much solid. It's amazing that where we are the snow lasted less than 24 hours and our garden is back to normal, yet just a few miles up the road there are parts to the golf course which are still covered in a layer of snow, and other parts which are frozen solid.

It's no fun trying to bash your tee into concrete, and it's even less fun watching your perfect pitch shot rebound off the solid green and carry on for another 50 yards rather than nestle next to the pin. Pitching back onto that same green is no fun either - if your ball doesn't get stuck in the snow then it ricochets off the solid surface to shoot off down the other side of the green - 2 or 3 shots like that and you might as well give up.

So under the circumstances, 49 out and 50 back is a pretty good score, I think! At least I hit 11 fairways and 2 greens, so my battle against the dreaded slice continues to move in a positive direction.

Experimentation

2009-01-10T17:55:00.009+01:00

When we were looking for artwork for our walls after we finished the renovation, we decided to try and use some of our own in the form of photos we have taken. One idea was for a gallery of very personal - family, friends, dogs and us - pictures given a sepia tint and mounted in a very geometric way in 24 8x8 frames. It worked well on one of the big walls in our living room (you can see it in the photos I took on Christmas day).

To fill smaller places in other rooms we went for more colour. I didn't have time to mess around with Photoshop so I tried a shortcut. I have an application for my iPhone called Camerabag, which gives you a number of pre-defined settings with which to process your pictures. It is designed mainly to add some "oomph" to the rather feeble 2 megapixel pics taken by the iPhone itself, but I imported a bunch of my own pics (taken on a 10 megapixel Canon SLR) into the iPhone, processed them using the "Lolo" setting of Camerabag and them put them back on my Mac for printing.

With just a single click required for each photo, the result is a hugely over-processed look with loss of resolution, increased grain, increased sharpness, incredible colour saturation and high contrast - pretty much the result I was after. However, it does not give you any control over the border or cropping, which did make some of my photos unusable, unfortunately, due to the severe crop to square format.

Printed up to 5x5 and matted into an 8x8 frame and grouped together in similar colour schemes they work quite well on the walls. The computer screen does not do them justice, but see what you think....

BTW - see if you can spot the joke with the photo of the abandoned truck....

First Snow

2009-01-09T17:39:00.002+01:00

We had our first snow fall of the year here - in fact the first serious snow fall I can remember since moving from the frozen north of the Cevennes!

It lasted all of 24 hours before the snow melted and disappeared, but this was long enough for the true Labrador to come out in Harry. It is the most animated we see him on his walk - he clearly loves the snow.

Hopefully we will get to take him on a ski holiday again this year.

Watching What?

2009-01-08T13:50:00.002+01:00

I have to say, I am with Alex on this one. I thought the idea was sound, but was ruined by Hollywood's insistence on casting big names - names who, unfortunately, cannot sing or dance. The only one worth listening to was the (unknown) daughter of the Meryl Streep character, who was the only one with a singing voice. Had they cast this with people who could actually sing and dance, I am sure they would have still drawn the viewers, and they could have always given cameo roles to the "big" names. Anyhow, ultimately unsatisfying and in many places deeply cringeworthy. Don't buy it - rent it at your peril.

In contrast, I hugely enjoyed "Wanted", starring Angelina Jolie, James McAvoy and Morgan Freeman. Based on the cult comic book (aren't they all these days?) it borrowed heavily from The Matrix, but that's no bad thing. Amazing effects and a good story - anyone who liked The Matrix will love this.

Another derivative work which is no less entertaining for that is the new TV series from the creator of Lost, called "Fringe". This one is a huge X-Files rip-off, which also borrows from Lost, Alias, CSI, Bones - you name it..... Anyhow, the jury is still out on this one, but I am liking it right now 'cos I am a big X-files fan - if you are then you will too.

Finally, iTunes/AppleTV makes it so easy to dip in and out of series and sample before you commit to a full series that I am starting to go back and revisit older titles. It has taken me a long time - mainly because Tom Baker put me off for life - but I have got into the new Doctor Who in a big way. Jon Pertwee was to Doctor Who what Sean Connery was to James Bond, so when Tom Baker made a mockery of the whole thing (only to be followed by "actors" who made him look good, including the likes of Colin Baker and Sylvester McCoy) I gave up on it.

Despite taking most of the first series to warm to Christopher Ecclestone (which was unfortunately the length of his tenure as the Doctor!) I did start to enjoy his performance, and Billie Piper was a revelation. David Tennant has been excellent, and the writing is streets ahead of the earlier series - for the first time we have loose story arcs that last en entire series or more and the whole thing can be incredibly dark on occasion. Added to that the most incredible score I have ever heard on a TV series performed wonderfully by the Welsh BBC Orchestra and you have a series well worth watching.

It is unfortunate that Tennant has decided to leave, and I am not at all sure about the new guy they have cast - could be another Tom Baker moment coming. We shall see.

Apple Scores Again

2009-01-07T18:44:00.001+01:00

I want one....

Apple Introduces Revolutionary New Laptop With No Keyboard

Christmas Day

2008-12-25T20:09:00.002+01:00

After much work putting the finishing touches to the house over the last few weeks, we finally get to christen it by having friends over for Christmas dinner. Jan & Alex, Brian & Gill and Peter & Martine grace us with their presence. My job is to try to keep Harry from sweeping champagne glasses from the tables with his perpetually wagging tail, keep said glasses topped up, select and open the wine, and flame the Christmas pud - Lynne does everything else.

Following an amazing amount of preparation she turns out a dozen incredibly delicious canapes, including quails eggs and capers in pastry cases, bloody mary jello shots, marinated prawns, prawn and scallop cevice, chile scones with cream cheese, parma ham and parmesan pastry things..... too many to remember, but none of which would disgrace a top restaurant. Brina and Gill kindly bring all the ingredients for various champagne cocktails.... pretty smashed by the time we sit down to eat.

Starter is a medley of salmon dishes. Main course is boeuf en croute with baby potatoes roasted in duck fat and various veggies. Dessert is a choice of christmas pud (of course), mini chocolate mousses, orange segments in something sweet and alcoholic... probably forgotten something but WAY too smashed to remember much by this time. So smashed, in fact, that I overdo the brandy on the pud and nearly set fire to the curtains. Ho hum....

Wonderful day - thank you to you guys for coming and making it so great, and to everyone else, a very Merry Christmas!

Spent Up

2008-11-30T22:02:00.005+01:00

Busy day today, since there is a close-up show, lectures and also a dealer day. Luckily none of the dealers take credit cards, so since I can only be bothered to make one trip to the cash machine I don't spend nearly as much as I might have otherwise! Got some great DVDs and a couple of nice old tricks. Missed out on a wonderful German-engineered rising card mechanism from the 1920's which worked by clockwork - it's a wonder they ever got away with the trick given the noise this thing made but I would have loved to have it for historical interest.

The Close Up Gala kicked off with John Lovick. We saw him on Friday as his alter ego "Handsome Jack", but today was plain Lovick, and his routine was excellent. He worked a prediction routine with an audience member where he pretended they were estranged lovers and the patter was based around him "quietly" trying to work through his issues with her on stage, ending with the predictions being part of a break-up song lyric in the sealed envelope. Hilariously done.He also did the best ring vanish I have ever seen anywhere, which was way too complicated to describe, but involved two rings, and two spectators, with one spectator ending up with the other's ring before everything was resolved. Despite knowing exactly how the "standard" version of this trick is performed, this version had me baffled for a while. Extremely clever routine.

Peter Samelson did more of his wonderful story-based magic, the highlight for me being the production of coins in a glass from cigarette smoke.

Denis Behr form Germany did some clever stuff with cards which left me cold, personally, though I can appreciate the skill involved.

Andrew Goldenhersh did some more of his wonderfully controlled slow-motion magic, turning an origami butterly into a real one and a wonderful coin matrix. The only trick of his I was not keen on was the terminally boring and repetitive needles-on-thread-from-mouth trick.

Goldenhersh also did an excellent lecture which involved no magic at all, but was all about character development and training unused muscles in hands and fingers. Check out www.handhealth.com - it is pretty amazing stuff if you stick at it! Peter Samelson's lecture was also excellent. Denis Behr's was, predictably (for me at least) boring, given his total concentration on card work.

The close of the event is traditionally the award of the Berglas Foundation Services to Magic Award. This year, chairman David Berglas informed an astonished audience that the award was going to none other than "magician's favourite" (not!) Uri Geller. Despite coming across as very confident and charming, Geller continues to contradict himself at every turn.

He hints that his early work was indeed trickery, that he has no real powers, and yet he claims to have made his money not from magic, but from payment from South American oil and gas companies for finding new drilling sites for them simply by flying overhead in a helicopter and "feeling" them.

Then went on to say that because he does not claim genuine talents he would never offer his services to the police and families searching for missing children. This despite the fact that in the next breath he claims to have helped in such cases early in his career. Fortunately the person asking the question persisted and pressed him on why, if he believes he genuinely helped before, he would not offer to help now, even on the slight off-chance he could do something useful.

"Interesting question", replied Geller. "I have no answer to that"....

Magic Weekend

2008-11-29T20:38:00.004+01:00

The first full day of the conference kicks off with the 25th annual close-up competition.

I sat in the wrong place for this, obviously, wanting to get a decent view of the proceedings. Unfortunately, my excellent seat meant I was picked on four times to "assist" - mom, I'm nearly famous. You have to feel sorry for these guys - up close and personal you can see just how nervous they are. Shaking hands, shaking voices, fluffed moves flashing things they would rather you didn't see. Some of them pulled it off better than others, and I did pick the eventual winner from his outstanding, and very confident and amusing, performance. Congratulations to Canada's Shawn Farquhar - well worth seeing should you ever have the chance.

The afternoon lectures were fascinating, Richard Turner kicking off with an hour expanding on his one-man show from yesterday, showing us exactly how he did all of his moves. Once again, even as he slows it down and tries to make it obvious, I still cannot see him actually false deal any of the cards. Amazing. David Kaplan and John Lovick also give us a number of excellent insights into their acts from the previous evening - an amazing afternoon.

Saturday night is the one we picked for the evening gala show. Compered by the very funny Noel Britten, it kicked off with Soma, from Hungary. A complex series of manipulations of mobile phones and coins to a driving musical accompaniment was interesting to watch for a while, but quickly got old, despite the technical skill in evidence. Just like those interminable card manipulation acts where fan after fan of cards are produced from thin air before being deposited in the top hat, there are only so many times you can watch the production of a fistful of mobile phones before you are willing the next act to appear.

Next up was David Kaplan from the US. This was more of a traditional "variety show" act, with some comedy magic and juggling, and was not Lynne's cup of tea. Whilst I prefer the "serious stuff" myself too, I could appreciate the skill in this act and the light relief was welcome after the very serious Soma.

Peter Samelson, from the US, did a wonderful performance. Very skillful, and with each trick presented as a story there was nothing quick-fire about this one, but it held interest right to the end.

Rafael, from Belguim, was up next. His act had left me a little cold the previous evening, and this one - the first of three appearances tonight, was worse. I hate quick change acts unless they are done VERY well, and this one was not done well, or even that quickly, at all. Glad to get that one out of the way.

The second half opened with another act that left me a little cold - but for a very different reason. Robert & Emiel (Netherlands) present a ’second sight’ act which portrays Robert as a ‘boy trapped in a mans body, having a special gift to see.’. The on-stage portrayal of the mentally challenged young man was disturbing for all the wrong reasons and made it hard to appreciate the content of the act.

This sort of act - with objects in the audience selected by the associate and named by the blindfolded person on-stage - I find very dull. They obviously rely on some form of hidden communication or code, and it is not something I find particularly clever. However, even I had to admire the skill of this pair as the pace picked up to an unbelievable level and still almost all the objects were named correctly, finishing with a driving licence description and correctly naming the serial number on a audience members £20 note. Shame about the "mentally challenged" angle, which made me uncomfortable throughout.

The organisers juxtaposed the acts superbly tonight, and after the unsettling mentalism act we were treated to an hilarious comedy juggling routine from the UK's Rob Lavar. Five ping pong balls from the mouth playing tunes on empty gin bottles - say no more.....

Andrew Goldenhersh (US) presented an extremely polished routine of some truly excellent magic. He produced a live butterfly from a tattoo on his arm, worked a wonderful misers dream routine with a very small and dangerously curious boy from the audience, and finished with an extremely slow and controlled straight jacket escape, producing unbroken eggs and a live chicken from the jacket as the finale.

Rafael appeared twice more, and completely redeemed himself. With the only "big stage" magic in evidence (i.e big props and multiple assistants) he had a lot resting on his shoulders, but his first routine - the animated woman - was amazing, After producing himself from a large box, he animated a body-less head, which then apparently floated over to a headless body on the other side of the stage before the body was then animated and walked around the stage.

Red Hat was a late addition to the show, performing a reasonably skillful, if somewhat tedious, mask manipulation act. Like Soma's mobile phones, there are only so many times you can produce a fist full of face masks before the audience (or at least this particular audience member) starts yawning. This has been done - and done better - by Jeff McBride, and I would not rush to see this guy again.

The third appearance from Rafael closed the show, and was a fitting finale. An assistant was placed in a clear box, and swords were pushed through slots trapping her in place. An almost instantaneous switch behind a cloth revealed he had apparently changed places with his assistant in the box, but as the swords were removed and he was released, it turned out to be the MC Noel Britten, Rafael eventually appearing in the audience.

A truly excellent show, and a great first day, made even better with the finding - and trying - of a really excellent (and cheap!) sushi restaurant right around the corner from our hotel.

Welsh Wales

2008-11-28T16:10:00.000+01:00

After such a long day traveling yesterday I sleep the sleep of the dead, waking up to a wet Welsh morning.

Over breakfast we watch the local speed cop setting up outside my parents home trying to catch the people speeding up the hill, not knowing that my dad has erected a big sign "Warning! Pigs R Here!" on his roof. Mum takes him a cup of tea on the off-chance that the guy will let my dad off next time he gets caught speeding. My dad gets more speeding tickets than I do!

Tania and Jon - my youngest sister and her hubby - pop round for lunch on the pretext of seeing me, but it probably has more to do with a home cooked lunch. Unfortunately, nieces and nephews are at school today, which is a real shame since I will have to head off without getting to see them.

After lunch I have to catch the train back to London to attend the first night of the magic convention. It's my first time, and I have no idea what to expect, but I am not prepared for the amazing quality of the acts we get to see.

It kicks off with a one man show by Richard Turner, billed as the "Card Cheat". I am no fan of card magic, but this guy is amazing. He can control the deck completely no matter how many times he shuffles, dealing cards seamlessly and invisibly from the top, bottom or middle of the deck to allow him to deal any hand he likes to any one of the players around the table.

An hour whizzes by, and at the end of it, we realise that not only can he do all of this stuff without us seeing, but he is actually blind! He gets a well deserved standing ovation. During the interview which follows, he demonstrates some of his techniques, and yet even when he places a card face up on top of the deck and then proceeds to deal five hands from different parts of the deck without ever disturbing the top card and you STILL can't see him do it, I realise that there is not much point in ever taking up card magic, 'cos I'll never be that good in a million years. Even so, I splash out of his DVDs afterwards, just so I can remind myself of the brilliance of his work later.

The evening closes with a comedy show, hosted by Phil Butler, and featuring some very funny performance by Rafael, Handsome Jack (AKA John Lovick) and David Kaplan. A wide variety of magic is on show and all of the acts are very funny to boot.

Phil Butler is an excellent host, and if you ever get the chance to see him on the comedy circuit I recommend you take it. He closes with an outrageous routine whereby he makes speaking Fisher Price kiddie learning toys say some pretty disgusting things by manipulating the keys - extremely childish and very vulgar, and totally hilarious!

Bodes well for the rest of the weekend.

To London We Go

2008-11-27T10:28:00.005+01:00

Hating England as much as I do - and London in particular - it has to be something special which drags me up there to the frozen north these days.

The prospect of visiting my parents followed by 3 days of the International Magic Convention just about fits the bill, so we pack our biggest winter woollies, brush up on basic eastern European vocabulary so we can at least make basic conversation with the natives, and off we go. Not before dropping Harry off at kennels, however. This will be his first time in kennels on his own, now Benson has gone, and when we arrive he is the only one in the place. Hope he will be OK.

The decision to take the later train is the first bad one of the trip. Normally we go for one around 7am, but we decide to have a lie in and go for the one an hour later. Big mistake, as we arrive just in time for the train only to find the station car park is full. We have to make a mad dash to the Arenes, followed by an even madder dash down to the station dragging our luggage. We make the train - puffing and panting - with only 2 minutes to spare.

We decided to go via Lille rather than Paris, since we intend to do lots of shopping and are anticipating heavy cases on the return journey. The problem is that the winter schedule makes the connections a little tighter than we would like. We make the Lille connection and check in with only 5 minutes to spare.

As usual, the contrast between the luxury of the TGV and the spartan prison van atmosphere of the Eurostar is marked, and the journey from Lille to London is not much fun.

We are staying in the Travel Inn at Euston, chosen for being just around the corner from St Pancras, and right opposite the Shaw Theatre where the convention is being held. Chosen for convenience alone, then, this one is a bit of a gamble. This is our first time staying in this part of London, and we are expecting to have to fight our way through drug dealers and prostitutes on the way to the hotel.

We are amazed to find nothing of the sort - Pizza Express, Pret a Manger, Starbucks and Costa Coffee are all in evidence, the sure sign of an area about to undergo massive redevelopment and increase in house prices. There is a huge, rather posh looking, Novotel, the British Library, Indian, Chinese and sushi restaurants, and the hotel itself is pretty good (as good as a Travel Inn is ever likely to be, anyway) and a bargain at 90 quid a night.

The bane of the Travel Inn - the check-in process - is as slow as ever, and it leaves me with only 15 minutes to catch my train from Paddington to Swansea. Hailing a cab and fighting through the afternoon traffic, I make the train at a run with only 2 minutes to go. This has been a day of near misses for the trains, and I shudder to think what would have been the results of missing any one of them.

The journey to Swansea is uneventful, despite the border tax of two sheep and a leek being somewhat extortionate, though is still amazes me that it can take longer to get from London to Swansea than it does from Nimes to Paris! Mum and dad are there to meet me at the station - it has been an absolute age since I have seen them and we have lots to catch up on on the way home and over a wonderful home cooked meal. Great to see them again, though I slip right back into bad habits by eating most of the lemon cheesecake on offer!

No More Slice?

2008-11-23T13:46:00.003+01:00

I just cured my slice!

That phrase should drive more traffic to my blog than any other I have written to date. Apart from "Angelina Jolie ballet dances naked before steamy sex session with Olla Jordan". There, that should wrap up most of the internet traffic for this week.....

Anyway, back to the slice thing. Those of you who know me and have put up with my endless moaning about my terrible incurable golf slice over the last few months - or even worse, have had to play a round with me and spent half of it looking for my ball in the right rough! - will be pleased and amazed that I have finally got to grips with it (no pun intended). When I use phrases like "got to grips" and "cured", of course, I use these in the loosest golf-related sense. In that whatever we do this week to cure the ills of our golf swing seems to manage to miraculously reverse itself the week after. Right now, however, I will take a week of decent golf and solve the next problem when it appears.

Today I shoot 95 and go from hitting 5 fairways/greens in total last week to hitting 9 out of 14 fairways and 3 out of four of the par-3 greens. Shame my putting has gone to hell at the same time otherwise I could have broken 90, but you can't have everything at the same time in golf, can you? Otherwise it wouldn't be golf.

For those of you remotely interested in my amateur musings over my golf swing, I reckon that the "epiphany" came about by suddenly realising that as I moved my weight from left to right leg on the downswing, I also shifted my entire upper body to the left at the same time. Head, hands - hell, everything - was ahead of the ball at impact and there was only one way the ball was ever going to go.

By keeping my head and upper spine fixed as close as I can just behind the ball throughout the downswing I seem to be able to hit much straighter. I have also cut my backswing in half in order to try and keep more control. Ironically, although my swing is shortened, I am getting more distance off the tee, thanks to the straighter ball flight. I hit 230 metres today, which is pretty good for me. Once I can get some consistency in this new swing I can probably start to dial back up the power with a bigger backswing - right now I'm just happy to keep more than half my tee shots on the short stuff!

And there you have it. Next week I will probably be bemoaning some new, suddenly-appeared, bad aspect of my new swing, but right now I am happy as a pig in shit.

Vatel

2008-11-21T10:33:00.000+01:00

Wonderful lunch today with Ian, Sylvia, Clive and Fabienne at the Vatel in Nimes. This is the local cookery school, and thus you have to be prepared to take the rough with the smooth in terms of both service and food quality given that it is students who are doing the cooking and serving. In addition, it is often a challenge placing an order since French is the first language of neither the customer nor the waiter/waitress in many cases!

Lynne and I have eaten a few times at the Vatel and never been particularly impressed, to be honest, so we weren't looking forward to the meal, although the company was certainly worth the trip under any circumstances. And in the end we were more than pleasantly surprised. The cold buffet of entrees is always good, the poached salmon being consistently excellent, but this time the main courses were superb too. Definitely the best meal we have had there, and good enough that we will be going again!

Berfday Boy

2008-11-20T22:38:00.001+01:00

It's my birthday today - more grey hairs, more sagging flesh, more aches and pains. You know you are getting old when all these things no longer wait a year to appear, but rather accumulate on a weekly basis.

I don't even get a lie in! WIth dance classes on a Thursday night, we need to get up at oh-dark-thirty in order to fit in 18 holes of golf and give us enough time to recover before dancing. In fact, it is SO dark when we get up that we can't even see where the balls are going on the practice range. Complete waste of time that is! Because the practice is a wash-out, we are freezing by the time we get to the first tee and it takes us 4-5 holes to warm up. I shoot an abysmal 51 on the front 9, but make up for it partially with a back 9 of 47. For some reason my putting has gone to hell in a hand-basket.

At least the ridiculously early start sees us back home before lunch time, just in time to take Harry for a proper walk (way too dark for him to walk this morning - his decision, not ours!). Golf then dog walk - now I am really knackered. DId I mention I was getting old?

Dance lessons tonight focus on the tango again - my favourite - and afterwards we dine in style at le Cheval Blanc, overlooking les Arenes in Nimes. This is rapidly becoming our favourite haunt - the wine list is great, they sell it by the glass, and now we discover the food is fantastic as well. Best steak I have ever eaten in France, and the seafood is superb. Well worth a visit - even Alex should be able to find this one (right opposite that huge place where they used to feed gladiators to lions, Alex....)

Berfday Girl

2008-11-17T19:00:00.000+01:00

It's Lynne's birthday today and we decide a trip to the beach with Harry is in order. We decide on Grande Mottes because it has dog friendly beaches and it is so close, and we have a wonderful long walk along the nearly deserted beach.

It is a strange experience because we tend to still compare Harry with Benson at certain points, and a trip to the beach is one such obvious comparison point. Whereas Benson would have gone hurtling up and down, in and out (but mainly in) the water fetching everything in sight, Harry is content to plod along beside us, or occasionally ahead of us if another dog comes over to investigate, and will only go in the sea if he gets particularly hot. Anything we throw for him is usually met with a very gallic shrug and an expression that clearly says "you threw it, YOU fetch it!". As a retriever, Harry makes a good door stop.....

We decide there is no point continuing to compare the two of them - Harry is a completely different dog. The very traits which occasionally frustrate us - his unwillingness to get excited about a trip to the beach, for example - are also those which we often find the most appealing. Benson, for example, would get SO excited about a trip out that he would stand in the back of the car panting all the way, would not sit quietly in a restaurant, and would usually crap in the most embarrassing places in his excitement.

Harry, on the other hand, is simply happy to be out and about with us. The car trip itself is wonderful, the walk is wonderful (as long as he gets to walk with us) and time spent with us in a restaurant is wonderful. If he is not home alone, then it is a massive treat for him, and this makes him extremely easy to take out and about with us.

The short of it is - Harry is not Benson.

We have the most wonderful meal in a restaurant directly opposite the marina, which appears to have some complex name like "When The Lighthouse Flashes Over Something Or Other". Sorry Alex - I know you like names, addresses and phone numbers but I am usually too pissed to remember.....

AGF Competition

2008-11-16T19:01:00.002+01:00

It's the AGF-sponsored competition today and I am in a 3-some with Lauren and Michel. The weather is fantastic and the game is great.

Just shows how nervous I must have been yesterday. Despite the fact that this is a competition I feel much more relaxed having got the championship stuff out of the way, and I shoot 45 out and 47 back for a total of 92. This is enough to win today's competition both brut and net - yay!

There are prizes to be had, but the biggest thing is that my handicap falls from 27.4 to 23.2, and this is enough to move me from the 3me serie to the 2me serie. This is the biggest division, and of course in one fell swoop I have gone from having one of the lowest handicaps in a small division to one of the biggest handicaps in a large division. Methinks the prizes will be few and far between next year!

Final

2008-11-15T21:51:00.003+01:00

Today is the final of the golf club championship, and this means yet another ridiculously early rise to get there in time to practice before my tee time. Another 18 holes of match play, this time against Andel, one of the guys who I played with in my qualifying group last Saturday. A week ago I went round in more than 10 under his score - I am not expecting him to make life so easy for me today.

And he doesn't disappoint! This is another extremely tight game, with neither of us ever managing to pull more than two holes ahead before the other claws back the difference, and most of the game there is only one hole in it.

I start to pull ahead again on the back 9 and Andel gets slightly rattled. I am thinking "this is it", but then nerves get the better of me. Last week was easy because I never expected to progress past the qualifiers, never mind the final stages. Today things are different, and I start to make stupid mistakes with my short putts. I throw a couple of holes away missing the simplest of putts and we go to the 18th all square.

I have a great drive, and then fluff my second shot. We both get on the green in 3, but each with a 30 foot putt. We both miss our fourth shot, leaving around 3ft to go. He keeps his nerve better than me and drops it in the hole for 5 - I take 6. It is disappointing, but it was a great game - very exciting.

And I take comfort in the fact that I have come a long way in less than a year since I got my license - promotion from 4th to 3rd division, finals of the club championships, top 3 finish in 3 of the four summer competitions I entered, and halving my handicap from 54 to 27.

Tomorrow is another day - literally - I am signed up for the AGF competition!

Paso Doble

2008-11-13T17:36:00.002+01:00

I am sure it is not coincidence that if you say "Paso Doble" real fast it can sound a lot like "Dance So Poorly"

I have trouble getting my head round the new steps tonight, especially as it switches between 6 counts and 8 counts depending on what part of the dance you are at. I have huge new respect for the participants in Strictly Come Dancing - even John Sergeant! In fact, I have even higher respect for the men because I am beginning to realise just how hard it is not only to remember your own steps, but also LEAD the woman. Apparently women are incapable of remembering which way to go on a dance floor and need to be steered around by the man - a bit like life, really... Only kidding... honest!

Anyhow, seems grossly unfair that I should not only be expected to remember where to put my own feet and which direction to turn, but also to push and pull my partner around at the appropriate moments. In fact it is so unfair that I decide not to do it for most of the night. That's my story, anyway.

Switching partners during the dance adds another level of stress, although one lady makes a bee-line for me for a second dance telling me that she much prefers dancing with me because her husband is useless. I sneak a look around the dance floor trying to spot the only guy in the room who must obviously be a double amputee, on crutches or in a wheel chair, but he must have stepped out for a while.

Semi Finals

2008-11-11T16:35:00.005+01:00

I play Joseph in the semi finals of the club championship today, another 18 holes of match play.

Having had a REALLY bad practice game yesterday, I am not too confident, in addition to being really tired having now played Saturday, Sunday, Monday and faced with another game today. This was not helped by the fact that tee times are really early and I had forgotten to set my alarm clock back an hour last month (duh!), so I ended up dragging myself out of bed at 6am this morning - early enough by any standards - and was half way showered before Lynne told me it was actually 5am and I was an idiot!

Today, however, it all came together. At least it did after the first few holes. I have played Joseph before, and we are very equal in terms of our golfing prowess (if, indeed, prowess is a word which can be used to describe what I do with a golf ball), so this developed into a really tough game, nip and tuck. As we rounded the front 9 I had battled back from my early troubles to snatch a 1 hole lead, and I took the next 3 holes to make life a little more comfortable. I lost the 13th and we drew the next 3 leaving me 3 holes up with only 2 to play. Game over.

A nice par on the 18th rounded off a great game (51 out, 49 back for a total of 100), and Joseph was a very gracious loser. Indeed, the whole game was characterised by a very relaxed attitude, fair play, laughing and joking, and genuine cheering on of one another's better shots and dismay at some of the terrible misses, making it a real pleasure. Completely the opposite to the game I played the other day where the guy was severely stressed out and seemed to think it was unfair that I should win some of the holes to which he was clearly entitled.

I get to play Andel, one of the guys who was in my qualifying group on Saturday, in the finals on Saturday morning. WIsh me luck!

Quarter Finals

2008-11-09T18:53:00.006+01:00

So it's up at the crack of dawn today to get to the club early enough to practice before my 8.30 tee time.

Today it is 18 holes of match play between myself and one of the other 7 who made it through from yesterday - no handicap is taken into account - this is mano a mano. Match play (where your total score is not recorded, but only used to determine the winner of each hole) is a new format for me, and I love it.

Although my instructor told me to ignore what the other player is doing and just play my own game, this ignores the strategy component of match play. For example, if your opponent is in the hole in 4 and you are on the green in 3 then you know there is no point in lagging the putt - you gotta go for it. If, however, your opponent takes 5 to get on the green and you are on in 3, then you know you can lag the putt and take 2 and still win the hole. It is tremendously liberating to know that you have no choice but to go for a risky shot or a long putt, and it is amazing how often these shots come off!

My opponent has a similar handicap to myself and, to be honest, I am not expecting to progress any further than today - I was happy to just get through the qualifiers. As if to underline this, I play like a complete muppet for the first 9 holes, recording a dreadful 56. However, miraculously, I score when it counts and go into the back 9 with a 6 hole to 2 lead, sharing only one hole between us,

This seems to rattle my opponent, but not as much as the fact that he plays perfect approach shots for the next hole while I end up in the rough. He puts his third shot on the green, and I put my third 2 feet from the pin. Another hole to me.

The next hole is a long par 5, and he is on the green in 3. I spend the first three shots languishing in the rough and hacking my way back onto the fairway and he is feeling pretty confident. This is where the strategy thing comes in - I have nothing to lose at this point. I am 120 yards from the green with a downhill lie, and I stick the ball three feet from the pin. We end up halving the hole and my opponent has a fit! "How am I supposed to win?" he asks, in all seriousness. "I play perfect approach shots and you stick it next to the pin from back there! How am I supposed to win a hole if you keep doing that?"

At first I laugh, but then realise he is not joking. He was not too unhappy about losing holes where he played badly, but clearly believes that when he plays a good hole I m not allowed to upset the apple cart. I don't really know how to respond to this one - as far as I am aware, golf is about sticking the ball in the hole in the fewest shots possible. Isn't it?

Two holes later and it is all over - he cannot win, and the rest of the game we are playing for fun. At least I am. He is still complaining that he is fed up with golf and is going to give it up. If it gets him this heated, perhaps he should.

Anyhow, having played out all the holes I win 11.5 to 6.5 and I am through to the semi-finals on Tuesday! Yay me! Just as important is the fact I manage to record a 47 on the back 9 to go some way towards balancing out the abysmal 56 I scored on the way out, only barely shooting to my new handicap.

Qualifying Round

2008-11-08T18:28:00.000+01:00

The Vacquerolles golf club championship starts today. There are three mens divisions, one ladies and one mixed/beginners division, and your assignment to a division is determined by your current handicap. Right now, I am languishing in division 3 following promotion from the mixed in August, with a handicap of 30.

There is no championship for the mixed division, leaving three for the mens and one for the ladies. The qualifying round is today, with everyone playing a round of stroke play and the best 8 going through to the quarter finals tomorrow. This is pretty scary stuff for me, golf-wise, but I have a great day, recording a 47 out and 51 back, for a total of 98.

Amazingly, this puts me top of the table for division 3, so I get to come back tomorrow! My handicap also drops to 27 - only another 3 to go and I get bumped up to division 2 (where life suddenly gets a whole lot more difficult!)