It’s very easy to switch around the keys on Apple’s current generation of wireless bluetooth keyboard. The first time doing this hack I only had one “close call”, but know that I know how to get the keys off safely it’s simple, fast and easy. I used a couple razor blades to pop off the keys, but a very small screwdriver would work just as well and be much safer.
The keys are best removed by lifting the cap key from the top left or top right corners. The plastic mechanics beneath the key move analogously to a cherry picker, and you interfere with them less by lifting the top corners of the key.
Once you’re done, the only drawback to your new sleek Dvorak keyboard is the lack of nubs on the U and H keys. Very carefully dab a small drop of superglue on them to address the issue, and enjoy!
Yes, I know, so you can withhold your scorn in the satisfaction that I’ve been promptly punished by the powers that be.
Upon initial assembly of my new $25 *Deluxe* propane grill, I assumed that the small Chinese boy manning the “‘L’ washer” machine at the grill factory simply hadn’t received adequate training from HR during the sweatshop orientation process. Or maybe he’s a union kid and was on a smoke break.. Or perhaps felt like leaving out the sixteenth washer in the knowledge that some American chump would eventually rifle though every inch of packaging looking for the part that never existed.
Approximately 2/3rds through assembly, I came to the realization that the shrink-wrapped parts smell funny: a contagious-like biological odor that I imagine a despair machine must smell like. While thinking about koala bears was much more fun than trying to remember what SARS stands for, I was brought back to sadness when I realized that Mr. NoPaidOvertime Jr. also left out a ‘C’ washer. GREAT. This wan’t going well and I still had a handful of parts left on the table.
Assembly completed. Wait… Nevermind, back to step six to add the metal thing to the other metal thing.
Assembly completed? Yes! And then, suddenly… EXISTENTIAL CLARITY.
This is, without a doubt, the worst grill I have ever bought, used, fondled and, possibly, ever set my eyes upon. It is not merely a poor devise, but in strong contention for *poorest* device. It is as if an investor found an abandoned warehouse of unrelated parts and had to decide between making radiators, fire extinguishers, or grills. The feet that are supposed to fold the damn thing into a tidy ball of grill were bent in six different ways out of the box, and the handle clearly didn’t come out of the sadness-injection machine correctly.
The whole supply chain here is crap. It’s not just the factory, but design, delivery, retail, economics, ethics.. Everything about this product and the devil spawn it came from is horrible for America. Is this news? No. But we all need a periodic reminder that the crap we habitually clamor for isn’t doing us any favors.
The Translational Genomics Research Institute (TGen) is a non-profit 501(c)(3) organization focused on developing clinically relevant medical diagnostics and smarter treatments related to genomic profiling. I’ve had the pleasure of working with the institute for over a year on a project related to breast cancer, and thought I’d share a widget I wrote keep you up to date on TGen’s latest news items.
The TGen News: Dashboard Widget for Mac OS X v1.1 gives you an always up-to-date set of headlines, pulled straight from the TGen news feed.
At TGen, investigators are pushing the limits of cutting-edge research and technology to discover the genetic cause of disease. Experiments that were impossible and impractical only a few years ago are now conducted every day.
Discovery fuels TGen’s translational research and lies at the heart of our scientific investigations. TGen’s research divisions are designed to foster a wide range of genetic discoveries. These divisions draw heavily upon TGen’s scientific platforms to expedite findings. TGen’s labs are staffed by teams of researchers focused on making genomic discoveries in common diseases and disorders in the areas of oncology, neurogenomics and metabolic disease.
Note: This free product is provided by Preston Lee, and is neither officially endorsed nor supported by TGen.
Textbook publishers in 2011 still aren’t fully appreciating the impact the Internet will have on their industry. A reasonably forward-thinking individual might optimistically assume the industry is self-correcting towards the wants and needs of consumers, but that doesn’t seem to be the case. Let’s explore:
Electronic typesetting.
Physical textbooks obviously can’t be reissued every time a typo is corrected. That’s fine, so we can keep making large textbook changes via en-mass “editions” to save typesetting efforts.
But electronic textbooks have many not-so-obvious differences.
Screen sizes of reader hardware/software vary dramatically.
Even if screen sizes were the same, it is of tremendous value to allow the user to change font and text size.
Some screens support color, while other don’t. A wonderful color graphic may appear a blobby mess on a monochrome reader.
The concept of a “page” no longer exists, due to #1 and #2, above. Content cannot simply say “See page 32.” References must be dynamic links, instead.
Content can (and should be) linkable. Obvious examples are tables of contents and figure references. External links need to be supported, as well as more sophisticated “interactive” embedded content items. (A mathematics textbook with an exercise that asks, “Y = 3X + 2. Calculate Y for the following X values: 0, 4, 5.7.” should also grade the assignment as well. Why do I need a completely different book for this?)
Searching, highlighting, note taking, and content sharing are all critical “must have” features for electronic texts.
Open data interchange is probably the biggest techno-political challenge. Retailers aren’t yet jumping on the opportunity to exchange data with the competition. (But they will need to conceed because it’s what the consumers and publishers will want.)
Adobe's portable document format is a dying beast, as is Adobe itself. PDFs just doesn't work well for textbooks.
For all these reasons, please stop calling your PDF renderings “eBooks” and then calling it a day. PDF documents cannot “reflow” the way a web page does, and make reading extremely awkward because of reasons #1 and #2, above. In short, direct PDF conversions–such as those used by the University of Phoenix–don’t have any of the typesetting considerations or functional niceties of modern electron book formats, and should be avoided. Schools need to stop accepting cheap “Print To PDF”-style textbooks, as well as “eBooks” that can only be read through a web browser using special software that doesn’t support any of the above features. If your eBook implementation is less powerful than a physical book, you’re doing it wrong. Please improve!
Separation of form and content.
Typesetting concerns do not mean all is lost. If anything, it’s a wonderful opportunity to make revolutionary steps in improving the way written knowledge in transferred. As we’ve learned from the web, it’s entirely possible to design for dynamic layouts given you can make at least a few constraints.
Physical textbook typesetting needs to be optimized for a specific target. Electronic typesetting needs to optimize for overall good layout within a range of constraints. Web applications can generate multiple document types for the same content, and with such nimble requirements for electronic media, we can do the same with updated forms of typesetting languages like LaTeX.
eBooks don’t require a local sales representative.
It’s nice, I suppose, to have a rep on call to overnight you a textbook on a moments notice, but that’s not necessary when I can click a button on my iPad. The issue here is misaligned incentives in the payment of distributors.
Doesn't get where this whole Internet thing is headed.
To use a real-world example, my local Pearson rep seems to earn commissions on physical textbook sales to my classes, but not electronic copies sold through Pearson affiliate (or subsidiary?) CourseSmart. She’s always happy to help when I’m interested in buying paper, but suddenly goes unresponsive when I have a tangential question about an electronic book.
It’s not her job to help with online sales. That’s an entirely different business unit or whatever, so who cares about that, right? Here are some great properties of CourseSmart, Pearson’s chosen eBook sales system:
You can only access your electronic textbook for about 6 months. That’s right, you don’t own it. You’re essentially renting it for the semester.
The pricing is pretty high, especially considering you can often sell back physical books after the semester. You always get $0 after the rental period. Savings? Please.
You can’t really do anything neat with the electronic version, like download a simple effing PDF, even if you’re a legitimate, verified instructor that can already download content such as instructor solutions manuals and slides. (They don’t trust us. Trust me on that.)
Pearson and college sales/support infrastructure and personal incentives aren’t (yet) set up to fluidly handle electronic texts.
In short, CourseSmart sucks. I thought it was going to be cheaper, simpler and generally better for students to use the electronic versions, but given the high cost “rent”-like nature and lack of features, it’s not great. Personally I’m looking to switch to publishers that understand ebook-oriented use cases and build their product to fully take advantage of the Internet, rather than just go through the motions. PragProg is a great example of a technical publisher that’s moving us in the right direction. (I send them a lot of business and highly recommend you check them out, too!)
I have to believe that the profit margins on selling an 800-page textbook as a $60 “online view only for 6 months only” product are greater than a $100 hunk of tree, especially considering the expenses of transporting, retailing, and commissioning (or marking up) every step. I suppose many of those people don’t want to go electronic due to fear of job loss, even though the jobs may simply change, instead.
Fast release cycles.
With properly designed exchange formats, textbooks and metadata can be pushed and pulled between publisher, retailer and consumer in under a second. The concept of “this years edition” starts to lose meaning if the publisher can fix a typo and push out a new revision with no more effort than updating a wiki page. This posses serious technological challenges with ISBNs, Library of Congress records etc., but all these things all fixable, and none of the solutions have anything to do with building a new PDF that gets emailed to me. (Even Amazon doesn’t do this right yet, even with their .azw format. When you agree to receive an optional update of a book you’ve purchased from Amazon, you lose all your notes and highlights from the original version. Lame.)
We need to embrace this idea of rapid content change, rather than cling to the idea of annual product releases. We can do it. Really.
Closing thoughts.
All the players in the textbook industry have different incentive systems, but all have much to gain. Rather than using the friendly neighborhood college bookstore as a primary retail outlet, the supply chain process… no, the entire industry, needs a comprehensive dose of cold water to the face. All is not lost, but in 2011? They still don’t get it.
I’ve purchased four Roku devices so far: an XDS and XD for personal use, and several XDs as gifts. Given the relative affordability of Netflix and Hulu Plus services–as opposed to a cable or satellite television subscription–the XDS provides the missing link in the web-based television ecosystem, streaming solid commericial content across your existing broadband internet connection to your existing HDTV.
Roku XDS (and similar XD) are impressively tiny, low power, inexpensive devices that ship with a simple yet functional remote. To make best use of a unit, you must have all the following:
Broadband internet connection.
HDTV w/HDMI. (Not required as both XD and XDS also provides RCA connectors, but the quality would be seriously old school.)
Netflix and/or Hulu Premium subscription. (If you have neither, I’d recommend starting with a minimal Netflix plan.)
I’ve tried the HTPC approach using PlayOn/Connect360 + XBox 360, AppleTV, PS3, laptop connection, Elgato EyeTV, MythTV, and gobs of other options, but Roku is currently my most frequently used set-top content solution. All the other streaming options are either constantly plagued by quirks (such as PlayOn’s fast-forward/rewind/resume bugs), or too vendor biased (such as the lack of streaming content sources on AppleTV and XBox 360).
Roku Pros:
Inexpensive.
Just works.
Netflix, Hulu Plus (free accounts won’t work), Amazon VOD, Pandora, and lots of other channels. (Some are free, other not.)
Remote works well.
Fast-forward/Rewind, pause, resume etc. all work fine.
Roku Cons:
Wireless goodness of the XDS is worthless if you’re using a wired ethernet connection.
Hulu Plus still has stupid ads. 🙁
Doesn’t connect to Media Center etc.
Very limited decoder options for media read off the USB disk.
Roku’s biggest current drawback is the lack of real-world support for your own media: either files manually attached via USB drive, or even better, streamed your my home media server. Hopefully this will be added in the future with either a new channel option or firmware update. Regardless, purchase either an XDS or XD immediately if you’re currently plugging a laptop into a TV forNetflix/Hulu Plus support. Ditch the jankyness and go for a Roku.
The Makerbot Thing-o-Matic, fully assembled and ready to print.
[Update: Welcome back, Slashdot! 🙂 This site is in full lockdown mode, so comments may take a little while to appear, but please leave them anyway! You may also want to check out the previous assembly photos also featured on Slashdot.]
Overview
3D printing has attracted notable attention in recent years, capturing interests of both geeks and laymen due to the obvious potential of a machine that fabricates three-dimensional shapes at will. While clearly far from the visionary “replicator” technology of Star Trek: The Next Generation–which could recycle almost any object–the Thing-o-Matic (and the like) have already begun branching out from the 3mm ABS plastic spools used build the objects in the following pictures. (I’ve also included picture from a another project that requires custom mounting widgets for solar cells.)
I’ve had my Makerbot Thing-o-Matic working for about a month, and I have to assume it only gets cooler from here. If you’re a hardcore DIY’er, or your technical dablings tend to involve small, intricate parts required of custom robotics, circuitry, metal/woodworking etc., read on, and seriously consider a 3D printer investment in the future.
The Unboxening & Assembly
Unboxing of the Thing-o-Matic kit. (See links for assembly pictures.)
After a couple months of girlish waiting, my DIY Makerbot Thing-o-Matic kit arrived in December 2010. Pictures of the laborious assembly process went up several days after, and have been viewed by tens of thousands of people in the last few weeks alone. Makerboot does not ship a printed manual with the machinery kit, instead option for an online-only “Thing-o-Matic Assembly Instruction/Users Manual”: a living collection of wiki pages that is continually updated. A good thing, indeed! Take a look at the assembly pictures if you haven’t already gotten a feel for the level of assembly effort. (If you’re good with your hands, allocate about 16 hours.)
Software Installation
My 3D model of an identical pair of custom solar cell brackets, done in Google SketchUp.
Once the machine is assembled, you’re ready to install the software, connect the machine via USB, and calibrate the system. Rough high-level steps are as follows:
Install the Arduino driver, if not already installed. (Easy)
Download and run ReplicatorG, and try making a software connection to the machine. (Easy. You’ll spend a lot of time in ReplicatorG.)
Use ReplicatorG to manually control all the machines widgets, and test each one for proper function. (Medium.)
Measure the the Z-axis height and change an obscure config file in your ReplicatorG software that you won’t understand for a few more days. (Medium.)
Load up some plastic filament. (Easy.)
Skeinforge interaction can be a frustrating chore.
Within ReplicatorG, launch the embedded Skeinforge configuration application, which is used to take 3D design files in .STL and “slice” them in tooling paths that a machine can follow. This is necessary since 3D printers usually print in layers, starting with the lowest. Skeinforge is an extremely configurable system with an extremely shitty GUI. It is not immediately clear what most of the hundreds of settings do, and you’ll spend many trial iterations configuring options to dial in the best general settings. Even after calibration, you will need to periodically revisit Skeinforge to address build-specific issues. (Hard.)
ReplicatorG build platform positional and orientation. Perfect!
Use ReplicatorG to either upload a compiled .S3G files to the on-board SD card for disconnected printing, or stream the commands on the fly. (Easy.)
Run the test job! (Medium.)
Go to #6. (Daunting.)
The workflow is initially very daunting and cumbersome. It starts to make more sense after a while, but needs major work. This is technically not Makerbot’s issue, but given that it’s a necessary component of the overall system I would suggest major effort be placed in unsuckifying the interaction before ReplicatorG and Skeinforge.
ReplicatorG
Once many initial configuration jobs are complete, your time in software will generally be spent across two applications:
3D design software package such as Google SketchUp (free), which is used to design your own objects. Once you’ve designed an object, you export an STL file that is imported into ReplicatorG, which is then sliced by Skeinforge into .gcode files and then by ReplicatorG into .s3g files that the Thing-o-Matics onboard Arduino understands.
ReplicatorG (and included Skeinforge application), tweaking, compiling, and babysitting.
Materials
The Makerbot MK5 plastruder turns 3mm filament into hot, sticky plastic goo.
The mechanism that feeds, melts, and dispenses plastic on the Thing-o-Matic, Cupcake, RepRap and other 3D printers is called the “extruder”: often referred to as a “plastruder” for those designed to extrude plastic. Thing-o-Matic ships with the “Makerbot MK5 Plastruder“, designed to feed solid 3mm spool of plastic filament into a heating element that melts and dispenses a thin stream of melted plastic. ABS is essentially Lego plastic, and solid at room temperature. (Grab a handful of Lego bricks to get a feel for the weight, texture, color of ABS.) At the melting point slightly above 220 degrees Celcius, ABS turns into a half-solid, half-liquid ooze that is melty enough to extrude into the shape of your choice, while remaining solid enough to hold form long enough to cool back into a solid.
Many different colors of ABS filament are available. These 1 lbs. packages of red, yellow and green plastic were purchased for $15 each as part of a larger order.
In my area (Phoenix, Arizona, apparently the 5th largest city in the United States by population), I’ve yet to find a local source of the stuff. I’ve called sales departments of several local plastics suppliers, and none have even known where to find it. I’ve also failed in contacting several other online suppliers; my requests for quotes have all gone unanswered. While happy with the two ABS shipments I’ve received from Makerbot, but it would be nice to have competitive options in the low-volume market. Makerbot sells 5-pound spools of “natural” (off-white) colored ABS for $45 (USD), and a variety of colors for $65 (USD) plus applicable taxes and shipping. And shipping is not free.
Assessment
Revisions 1, 2 and 3 of the solar cell bracket, from left to right.
Given the complexity of the machinery, you have a lot to consider before making the investment.
Thing-o-Matic Pros
Extremely cool. You will almost definitely be the only kid on the block with this toy.
Makerbot maintains the Thingiverse: a user-driven database of open source 3D objects.
Semi-automated batch jobs via the included Automated Build Platform.
All needed parts and come with the kit. (BYO tools.)
Supplies (such as ABS) are also available from Makerbot.
Some parts, such as this pair of brackets printed simultaneously, need trimming and/or sanding.
Documentation is 4 of 5. The 5 is for comprehensiveness and getting me through the process, but -1 for ocassionally erronous images, ambiguous text, or omission of step.
Minimal soldiering, and much less than I’d anticipated.
Minimal number of “only one chance” assembly instructions such as cutting and gluing,
Open Source hardware design. You can print many of your own replacement parts if some break.
Science!
Thing-o-Matic Cons
Four solar cell bracket are shown partially assembled into a larger structure.
Generally not robust enough to run unattended.
Post assembly calibration gets fuzzy, as there is no 100% Right Way to do things.
I’m 90% sure that something about the Arduino driver is unstable. I regularly make my entire Mac greyscreen (the OSX equivalent of a Windows BSOD or a Linux kernel panic) during plug/unplug process of connecting/disconnecting the USB from the Makerbot to my computer. Something, somewhere, is dying a horrible death and taking my whole operating system with it.
Skeinforge–the software that converts your 3D models to tool paths–has an absolutely atrocious (and ofter unstable) user interface. Few of the 100+ configuration options are clearly documents within the app, which is buggy to start with.
The machine can be somewhat loud and obvoxious. In my case, the XY axes aren’t bad, but the Z axis stepper motor can be very irritating.
If you do this, you are making a very big time commitment.
Questionable electronic sub-component failure rates, and one of my biggest complaints. The motor on my MK5 Plastruder was dead on arrival, and my power supply went out after less than a dozen prints. I could just be unluckly, though.
Costs & Competition
Lots of small custom components.
Many small pre-fab printer shops have materialized in the last couple years, ranging from laser-cut wood frames (such as Makerbot), to clear acrylics, metals, and, of course, printed plastics. Regardless of your chosen path, the electronic components are currently not printable in any high-quality manner, are best purchased from a vendor. This includes mainboard microcontroller (the Thing-o-Matic uses as Arduino MEGA), stepper motor controllers, stepper motors, power supply, end stop sensors, extruder controller, cables etc. You can, of course, build these yourself, but in the case of highly available parts such as the Open Source Arduino, it’s far more cost effective to buy the $30 part than spend a day manually fabrication a PCB and hand soldier $20 of mail-order components.
Four iterations of the 20mm test cube: A, B, C and D.
Makerbot’s pricing ($1K-2K per machine) targets the small power user. Competition is available, but thin and very fragmented. A RepRap kit from one company may not be 100% compatible with the electronics kit from another. That’s just the nature of Open Source hardware. I love the idea of Open Source standards implemented and supported by commercial vendors, and Makerbot’s staff has done a great job so far. (Special thanks to Ethan H. for being the unfortunately soul responsible for handling both of my failure reports as well as one incorrect shipment. You’re awesome, dude!) You can also grab an older model at significant discount.
Another 20mm test cube being printed.
In short, unless you have a Richard Stallman-level of commitment to F/OSS, try to buy all your components from only a few vendors. Makerbot is a good choice for U.S. buyers as though they only sell their own designs–a good thing, IMHO–but then, they don’t sell RepRap parts. If you want a RepRap, the choice is more difficult. I have not built a RepRap, but suspect that even with a larger vendor ecosystem it would be difficult to bring the total price tag for a laser cut or milled non-clone machine to under $1K for quality parts, electronics and components.
Closing Thoughts & Recommendations
The biggest barrier to entry is not price, but difficulty. No fabrication, assembly, software, design, calibration, of troubleshooting process is theoretically undoable by any able-bodied person, but the same can be said for rocket science.
You need a decent understanding of robotics, hardware, software, electronics and mechanics, need a little hand dexterity and a ton of patience. (Without these skills, you’ll definitely get frustrated.) You can do it, but if you can’t sit at your workbench in 2-hour stretches assembling (and occasionally reassembling) a part, going through many print iterations (over the course of days) to get it just right, you may want to consider having a shop print parts for you, or looking into a commercial laser cutter or milling machine instead.
Consumer 3D printing is still in its infancy, but the Makerbot Thing-o-Matic (and ancestry) are clear and decisive steps towards a day when all forms of matter can be assimilated from raw materials as easy as loading a coffee maker. Despite a few questionable design choices of electronics components, I give the Thing-o-Matic an overall 4-of-5 star rating and highly recommend either a fully compiled kit (like I did here), or pre-assembled kit for a few hundred USD more, assuming you’re comfortable with the prerequisite knowledge, time and money commitments.
Score Breakdown
Documentation: 4 of 5
Ease of Use: 3 of 5
Coolness: 5 of 5
Price Competitiveness: 4 of 5
Support: 5 of 5
Quality: 3 of 5
—————-
Overall: 4 of 5
Recommended for: Hardcore geeks looking for a ton of fun in a challenging meta-project.
Additional Media
Thing-o-Matic First Prints
Blurry Thing-o-Matic Up Close
My power supply has an fatal failure after a handful of prints. Makerbot has sent a replacement free of charge.The blow-out seems to be a capacitor. I believe that the power supply may not have enough kung-fu to power all the components.I hacked in a new power supply with higher specs, but it didn't fit perfectly. 🙂
After an estimated 16 man-hour assembly effort, my brand new MakerBotThing-o-Matic is fully assembled. The extruder motor is bad so I can’t print quite yet, but assembly is complete and the MakerBot support folks have been cool about shipping the replacement part. The new motor should arrive early next week.
The Thing-o-Matic is an Open Source 3D printer very similar to MakerBot’s earlier models (such as the Cupcake) as well as the RepRap, though MakerBot’s designs clearly depart from their RepRap origins. This is an extremely abbreviated set of high-level assembly pictures for those curious about the process. Assuming you already have a healthy assortment of common hand tools, the Thing-o-Matic “kit” version will set you back about $1,300 (USD).
The assembly process is intense, to put it lightly. Instructions are generally correct and straightforward 90% of the time, but given the intimidating complexity of the project, insane number of parts and dexterity required for some of the assemblies, simply locating the correct widget can sometimes be challenging. As the online assembly guide progresses, the instructions increasingly rely on your prior knowledge of repetitious concepts. We’re talking sanding, soldering, cutting, punching, scrubbing, gluing, and screwing hundreds of bolt/nut combinations. Only attempt this project if you’re the type of person that wakes up with ideas on the order of, “I think I’ll build an air conditioner this weekend.”, and actually completes the task. Like I said: intense.
For all you web application developers, I’d like to briefly note the following stack trace I received from the American Express website while clicking around:
And here is the same trace in plain-text format:
JSPG0036E: Failed to find resource /cardcenter/common/interstitial.jsp
Root Cause:
java.io.FileNotFoundException: JSPG0036E: Failed to find resource /cardcenter/common/interstitial.jsp
at com.ibm.ws.jsp.webcontainerext.AbstractJSPExtensionProcessor.findWrapper(AbstractJSPExtensionProcessor.java:322)
at com.ibm.ws.jsp.webcontainerext.AbstractJSPExtensionProcessor.handleRequest(AbstractJSPExtensionProcessor.java:284)
at com.ibm.ws.webcontainer.webapp.WebApp.handleRequest(WebApp.java:3548)
at com.ibm.ws.webcontainer.webapp.WebGroup.handleRequest(WebGroup.java:269)
at com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.java:818)
at com.ibm.ws.wswebcontainer.WebContainer.handleRequest(WebContainer.java:1478)
at com.ibm.ws.webcontainer.channel.WCChannelLink.ready(WCChannelLink.java:126)
at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleDiscrimination(HttpInboundLink.java:458)
at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleNewInformation(HttpInboundLink.java:387)
at com.ibm.ws.http.channel.inbound.impl.HttpICLReadCallback.complete(HttpICLReadCallback.java:102)
at com.ibm.ws.tcp.channel.impl.AioReadCompletionListener.futureCompleted(AioReadCompletionListener.java:165)
at com.ibm.io.async.AbstractAsyncFuture.invokeCallback(AbstractAsyncFuture.java:217)
at com.ibm.io.async.AsyncChannelFuture.fireCompletionActions(AsyncChannelFuture.java:161)
at com.ibm.io.async.AsyncFuture.completed(AsyncFuture.java:136)
at com.ibm.io.async.ResultHandler.complete(ResultHandler.java:196)
at com.ibm.io.async.ResultHandler.runEventProcessingLoop(ResultHandler.java:751)
at com.ibm.io.async.ResultHandler$2.run(ResultHandler.java:881)
at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1497)
Most developers might say, “So what? You just clicked on a broken link somewhere. Go back and go about your business.”
And that’s exactly what I did, since I just wanted to pay a credit card bill. But what if “my business” had been to gather forensic information about potential American Express website vulnerabilities? A stack trace may look innocuous, but we can be almost certain that this HTTP request was handled by a Java servlet. It uses Java Server Pages (JSPs) for view templating, and the application appears to be running on IBM WebSphere. Not only this, but we have line numbers for each stack frame, and the CSS appears to be some form of default styling.
Large institutions such as AmEx tend to not upgrade to the latest versions of development libraries until a future interal release cycle where the new version(s) can be internally vetted, tested, QA’d and put through a due diligence process. (Or for older apps, dependencies might not be upgraded at all.) This makes stack traces extremely valuable to an attacker. Why? Because I can obtain all historical versions of technologies such as WebSphere, and map every specific call in the stack trace back to the code until I find the software versions where the line numbers match up. The attacker should at least be able to narrow down the software version numbers to a range, if not the specific release version. After gathering this information, the attacker may choose to fixate on the older packages, and consult databases of vulnerabilities in legacy software until a vulnerability is discovered.
Long story short: turn off the rendering of stack traces in public-facing production applications. They’re convenient for validation of production errors, yes, but you don’t know what they may reveal.
I just released the first production version of the RailRoady gem about 5 minutes ago. If you’re a developer on Rail 3, you’ll definitely want to check it out. No more Vizio class diagrams! (RubyFlow announcement.)
