@madpilot makes

I must admit, I’m not actually a Pandora user, but many of my friends have been complaining about the recent close of service to the rest of the world. Well you can get around it quite easily is you have a US hosting account with SSH access, a program that can SSL tunnel (Putty on Windows, OSX/Linux has one built in) and one small change to your host file.

If you don’t have a US server and you don’t mind paying a small amount, there are plenty of cheap hosting plans over in the US just Google then and find one – bandwidth is so cheap over there you can probably get an account for a couple of bucks a month.

The only other caveat for this hack is that you won’t be able to have any other application listening to port 80 or port 443 on you computer. For most people with won’t be a problem – the most likely culprit will be skype.

For Windows

Step 1: Open you hosts file – this is located in the C:WindowsSystem32DriversEtc directory

Add the following line:

127.0.0.1 www.pandora.com

Step 2: Open Putty. Enter the URL of you US SSH account in to the Host Name field:

Select Tunnels from the SSH men on the right hand side – you will need to add two entries, one for HTTP and one for HTTPS. To do this enter 80 in the source port field, then enter www.pandora.com:80 into the Destination field and finally click Add. Repeat substituting 443 instead of 80.

Click open, enter your SSH username and password. Finally, open your browser of choice, browse to http://www.pandora.com and you should be in!

Linux (and probably OSX)

1. Open you hosts file – this is located in the /etc directory. Add the following line:

127.0.0.1 www.pandora.com

2. In a terminal (or terminal.app) type:

ssh -L 80:www.pandora.com:80 -L 443:www.pandora.com:443 www.your-us-server.com -l username

Enter your password and finally open your browser of choice, browse to http://www.pandora.com and you should be in!

How this hack works

SSH allows us to “port forward” which means it will open a port on your computer and feed all data through it to the remote computer, then make the request on your behalf. What we do is pass the pandora data traffic through the US server. So why the hosts file modification? The hosts file allows you to override the IP address that your DNS server returns – computers like to speak in IP addresses (such as 127.0.0.1) rather than nice human names, so they need to ask a DNS server to what IP address www.pandora.com is. We override it and return 127.0.0.1 – which means “this computer”. This forces the browser (and the Padora flash player) to route all traffic through our tunnel, so the Pandora servers think we are in the US. Simple!

Please note, I don’t recommend you use this to leech music off Pandora. If you like an artist – buy the CD or the MP3 or whatever, and support the Pandora guys by upgrading your account.

The wait is over folks, the hex colour t-shirt shop is ready and rumbling! Price is $30 + postage and handling.

Go on. What are you waiting for?

After the huge Digg fiasco today, the twitterati, after seeing my hex colour representation of the HD-DVD crack code, thought it to be a good idea for shirts to be made up. Well, I though it was a pretty good idea too!

I’ve created a site where you can pre-order your t-shirt. Once the price is finalised (probably around $AU35 + p/h) I’ll email you a discount code (probably a $5 discount) and you can get your hands on one of these pieces of history!

The shirts will have the colour swatches on the front, will be black (what good geek tee isn’t?), but more details will become available as I get them.

Once the shopping cart goes live, you won’t be able to get discounts any more.

Don’t miss out! All the cool kids will be wearing them!

It is with a mixture of jubilation and sadness that I announce I am moving on from my current position at Bam Creative to take up a contract position at with Norg Media. Jubilation because of the opportunity to work on an exciting Web 2.0 startup over here in Perth, whilst still being able to pursue my own projects – sadness because I will be leaving a great bunch of workmates over at Bam.

By the time I leave at the end of June, it will be just over a year since I made the move from freelancing to full time work. The past twelve months has taught me more about teamwork and running a business than I could have garnered in a lifetime of freelance work, and for that opportunity I would like to offer my sincerest thanks to Miles and the rest of the team. I’m going to miss the crazy shenanigans that have gone on within the Bam walls.

I am really looking forward to taking the development position at PerthNorg – having the opportunity to work with a site that is young, growing and showing it’s potential is one that is hard to pass up. The fact that Bronwen has allowed me to work four days, giving me to have a MadPilot day has made the deal even sweeter, so now I can spend more time on 88 Miles, Twitteresce, AWIA and the WAWAs as well as pursue some of the other projects that I have in my head.

All in all an exciting time to be in the industry really!

I just released version 0.7 of twitteresce. This release fixes a couple of bugs with the automatic updating system, displays how long ago tweets and direct messages were posted and it now remembers what tweet you were looking at when flicking between the tweet view and read tweet view – trust me this makes catching up out the twitterverse much easier!

As always, get it from the MadPilot website.

Thankfully the goings on of the WA Web Industry Association and the WA Web Awards is a little more exciting than this blog post title.

The April mini-talk podcasts and slides are up – unfortunately, the podcast gods decided to send Nick’s recording to the Bahamas on a junket, leaving Bronwen’s talk to fend for it’s self. Thankfully, he supplied his talk notes, which should give you a fair idea of what is going on.

This month’s talks will be Richard Giles from Scouta with his talk “Digital Social Networking, For Fun and Profit” and Stephen Carrol on “Government grants and assistance”. For those of you who want get in to the wonderful world of Web 2.0 social startups, and want some advice the talks are on Wednesday 2 May 2007 at the Velvet Lounge behind the Flying Scotsman in Mt Lawley from about 6 o’clock. Talks will start at 6:30.

We (we being the WA Web Awards sub-committee) have quietly launched the new WA Web Awards website for 2007. We will loudly announce it in a couple of weeks once tickets and entries are open to the public. I would suggest heading over and subscribing to the RSS feed and newsletter, so you can receive the loud announcement.

We are looking for sponsors for said awards at the moment, so if you think your company would benefit exposure to a couple of hundred web developers and designers, drop me a line and I can hook you up with a proposal.

A list apart is conducting an online survey of the web industry. If you are in the industry I would recommend you take 10 minutes out of your day – the more responses, the better the data.

Have you done it yet? It’s ok, I’ll wait.

Twitteresce 0.5 has been released! This update includes:

1. direct messaging support: you can now read you direct messages
2. the ability to “Close” Twitteresce rather than exiting – this means you can leave Twitteresce in the background. It will then popup and alert if you are running in automatic mode and you have a new tweet.
3. a fix for the annoying bug where the the post screen would disappear if new tweets arrived.

You can download here.

Enjoy!

Edit: Had to release 0.6 to fix a regression bug – Sorry!

I’ve got the Twitter-bug bad. Real bad. So much so that I’ve spend a large chunk of my leave this week learning J2ME (Java for mobile phones) by writing Twitteresce. Twitteresce is a small app that runs on you Java-enabled mobile phone – currently it allows you to download both public and private tweets and post updates.

I think it is so much more convenient than trying to use the twitter web page on your phone, or receiving SMSs because you can receive your tweets when you want (The API also seems more stable than the SMS alert system).

There is a list of compatible phones of the twitteresce web page, but I know the list is no where near complete. If you download the app on a phone that isn’t listed and it works, please let me know and I’ll add it to the list.

You can go to the official webpage the app here or type in http://tinyurl.com/2de636 into your phone browser and download it directly.

Any bugs, let me know.

Enjoy!

Warning: The following post is an usability rant aimed squarely at the incompetent software developers contracted to Citibank. Please enjoy the ride.

When I went to the UK about 4 years ago, I opened a Citibank UK bank account so that I could get paid whilst I was working. The actual account is really great – much better than any account you can get over here in Australia. There are no fees at all – none, nada, zip. At they time they also provided some great overdraft facilities. As I still occasionally do work for UK clients, and as it costs me nothing, it remains opened.

Significant point #1: I can’t go to a branch, and I need to call international to talk to a customer support officer – I rely on internet banking heavily.

Unfortunately, the online banking experience does not reflect the quality of the account. There are so many usability issues, the developers should be brought before some sort of tribunal.

Javascript Keyboard: This is a favourite amoungst banks as they believe it provides security from key logging software. BOLLOCKS! Javascript is a very dynamic language, it would be extremely simple to write a Javascript function that could be injected onto a page which would reveal the password. All a Javascript keyboard does is increase the chance of me getting my password wrong and slows me down. in fact, if someone was shoulder surfing, they would be able able to read my “keypresses” much easier than if I typed them on a normal keyboard. JavaScript keyboards are stupid.

Secret Question and Answers: Next, Citibank requires you to answer one of five pre-defined question/answer pairs. In a previous session, I was required to spend twenty minutes picking and answering questions. Why twenty minutes? Because you need to enter your username, password twice (both times using the previously labeled stupid Javascript keyboard), then finally pick five out of twenty questions, type in answers, then type in answers AGAIN to confirm them. After you enter an answer, they are automatically starred out, so you can’t see them.

Challenge Questions are not secure. A small amount of digging will allow you to get most of these details about someone. Heck, if you can get hold of someones bank statement, you can work out at least a couple of answers. All they do is make it frustrating for legitimate users. I couldn’t remember if I used capitals (To this day, I’m still not sure if they are case sensitive) or whether I used abbreviations. And what happens if my favourite colour changes? I’m screwed. Challenge questions are stupid!

Guess what, I couldn’t remember the specific format of the challenge question I was asked, so I was locked out, which meant I needed to go through the above procedure again. This time, I took too long, so the session timed out.

I click the login link once more, enter my username and password (again, stupid Javascript keyboard) but it confirms that my username is locked. I need to click the “unlock username” link. I click said link, and it tells me I NEED TO ENTER A USERNAME AND PASSWORD. Two problems here:

1. Generally people do not expect text links to be associated with text boxes. if you want the data in a text box to relate to an action, make that action a button.
2. There is no indication that I need to fill in this information until AFTER I have tried.

Finally, I have navigated to the “unlock username” page. Only to be presented with another stupid form. This time, I need to fill in my username, card number, e-Pin (welcome back stupid Javascript keyboard) and account number. Now, I don’t know about you, but as far as I’m concerned, my credit card number is probably more valuable to a thief than my e-Pin, yet the former is in full view of everyone and isn’t protected by stupid virtual keyboards.

Now, after attempting this frustrating process a number of times, I am completely locked out from my online account and I will need to call the UK to get it sorted out. Go team Citibank.

So what can they do about this to make the process simpler? I think BankWest has got it right:

1. They issue a Personal Access Number (PAN) – The number is short, so it is easy to remember, but it is not easily derivable from the account number of any user details.
2. they politely remind users that they haven’t changed they password in a while. Which is much nicer then forcing me to do it. If I’m stupid enough to not change my password regularly, even when warned, well that is my tough luck.

Other things worth trying:

1. Limit the amount of money that can be transferred in a day, especially for person-to-person transfers – having access to online banking accounts is not much use unless you can transfer the money out.
2. Give users the choice of blocking person-to-person transfers and BPay – I only ever check my balance through this system so I have no need for transfer facilities.

The bottom line is these “security” measures aren’t that much more secure that a standard username/password conbination yet they are infinately more annoying and frustrating.

So banks: PLEASE STOP USING THEM.