Custom search googlet

Transforming Google CSEs into OpenSearch descriptions is simple, even when Firefox needs some proprietary <moz:SearchForm> magic to get it right.

For older browsers not supporting OpenSearch each CSE has its own default gadget for uses on iGoogle, blogger, and elsewhere. I created a smaller configurable tiny CSE variant, to use it edit the cx-number, e.g., 001904119753490578822%25:zvsejdqm-pw for the xyzzy-CSE.

CSEs hosted by Google have one issue, creators cannot easily publish the source for users wanting to know what the CSE really does. Here's a snapshot of the sites currently covered by the xyzzy-CSE:

alvestrand.no, arkko.com, ecma-international.org, gmane.org/gmane.ietf.* (ditto org.w3c.*), iab.org, iana.org, icann.org, icir.org, iesg.org, ietf.org (excl. lists), imc.org, irtf.org, isc.org, isi.edu, isoc.org, itscj.ipsj.or.jp/ISO-IR, jabber.org, langtag.net, omniplex.blogspot.com (this blog), openspf.org, postel.org, rfc-editor.org, rfc-ignorant.org, rsa.com/rsalabs, standardstrack.com, unicode.org, w3.org, xml.resource.org, xmpp.org, and my own xyzzy mirrors (plus googlets).

MD5 1.6: POP3 and UUID

Version 1.6 of the MD5 test suite covers RFC 5034 (Digest-MD5 for POP3), RFC 4122 (UUID version 3), and an old RFC 1910 example. The POP3 example belongs to the MD5-sess series.

The UUID example is apparently wrong, it swaps the byte order unnecessarily. Examples published by python.org and ossp.org agree with that theory, I'll submit it as erratum.

MD5-sess and RFC 5090

RFC 5090 was published, it fixes some problems with the MD5 examples in RFC 4590. Version 1.5 of the MD5 test suite now contains the new RFC 5090 RADIUS examples.

The updated test suite contains a new procedure AUTHTTP for the RFC 2617 idea of MD5-sess noted in the errata. The old DIGEST procedure uses the RFC 2831 MD5-sess algorithm. Six new test cases cover MD5-sess examples published in RFC 2831 and 4643 using the RFC 2617 algorithm. Hopefully this will be documented in an RFC moving RFC 2831 to HISTORIC.

Hamburg's vote on ooXML

Microsoft's quest to forge the one ring will soon reach a critical stage. In the BRM on OfficeOpen XML a so-called German delegation will have six votes, one of them the tax authorities of the city of Hamburg. In 2007 DIN supported ooXML in a controversial procedure, with Hamburg's fiscal authority under the yes votes.

Historical background, Hamburg was once the home of StarOffice, a name still used for Sun's OpenOffice version, closely related to what later became ODF, an ISO standard roughly covering what MS Office 2007 as so far only potential ooXML implementation offers. Of course MS Office isn't free like OpenOffice, and with about 6000 pages the ooXML draft is considerably more elaborated than ODF.

It is not obvious why Hamburg's fiscal authority supported a draft allegedly identifying 1900 as leap year, where dates before 1900 don't work. As Excel simplification that is funny or even acceptable, but Excel is a commercial product and no international standard. Just one of many ooXML issues, maybe addressed in the additional 2293 pages submitted for the BRM.

It fits that the citizens of Hamburg get a chance to elect a new parliament one day before the BRM. Related, Google doesn't like ooXML, their German HQ is in Hamburg, and they got no vote in the relevant DIN committee.

Patch that zeppelin

XML is ten years old, good to know, waiting for the monthly W2K patch orgy to finish I used the time for my education. The worst update this month are 36 MB for Adobe Reader 8.1.2.

Also ten years old is RFC 2277, the IETF Policy on Character Sets and Languages. This is a nice piece of RFC number magic, RFC 2278 used to be the IANA Charset Registration Procedures, now 2978, and RFC 2279 used to be UTF-8, now 3629 (STD 63). The magic also works backwards, the predecessor of 2279 was 2044, and RFC 2045...2049 is MIME. The MIME type registration procedures used to be 1590 next to RFC 1591, i.e. what is today ICANN. After ten years they are now getting serious with I18N for domain names and other missing pieces in this puzzle.

RealPlayer BadWare

RealPlayer 10.5 and 11 were identified as BadWare. The unofficial Real Alternative 1.75 claims to use 6.0.12.1662 components, apparently not affected by various 10.5 vulnerabilities.

STD 68: ABNF (RFC 5234)

The IETF created the sixth Internet Standard (STD) in about 50 months, STD 68 specifies the ABNF used in many RFCs:

• STD 68, RFC 5234, 2008-01: ABNF
• STD 67, RFC 4506, 2006-06: XDR
• STD 66, RFC 3986, 2005-01: URIs
• STD 65, RFC 3551, 2003-07: RTP/AVP
• STD 64, RFC 3550, 2003-07: RTP
• STD 63, RFC 3629, 2003-11: UTF-8

The jump in the publication dates (2003-11 vs. 2003-07) is an effect of promoting RFCs 3550 and 3551 to STD without modification. STD 62 about SNMP version 2 published 2002-12 is a set of eight related RFCs.

QuickTime security flaws

In a SANS Diary entry they forgot to mention that there is no secure version for W2K, affected users should uninstall QuickTime, well, quickly. Products depending on QuickTime and claiming to be W2K-compatible could be considered to be broken, IANAL.

Having said this it is already rather tricky to find the 2007-11-12 QT Lite 1.1.2 for W2K with the 7.2.0.245 components, the download for this link is a damaged file, and an apparently working file was removed from where I found it. QT Lite 1.1.1 and QuickTime Alternative 1.90 still use the 7.2.0.240 components, and all these unofficial variants likely inherited the security flaws of the corresponding official versions.

Hunting W2K tools can be a pain, I try to stay on Microsoft's sites for security reasons. Check out the Petri IT Knowledgebase if you're looking for say a W2K-version of NTrights.

ICANN Ombudsman

After stumbling over a DomainTools Blog (1) entry discussing a new low in NetSol's (2) business practises, I tried to send an inquiry to the ICANN Ombudsman. That's a Web form with six required fields, but it won't let me submit it for no obvious reason. Fine, I can post it here:

Incident date	2008-01-08
Registrar	Network Solutions, LLC
Description of act, omission or decision	Please take a look into (1) and (2)