Thoughts on Whatever

The OpenSSL heartbleed bug was a heavy wake up call. This video provides a quick overview if you want the details. In summary, an attacker could craft a payload with a fake size (up to 64k) and trick openssl into sending a random chunk of server memory. WTF?! To understand how bad this was I spent a minute hacking on this script that was going around. I pointed it at login.yahoo.com (which is no longer vulnerable) and tried to see if I could catch a username and password flying by. I had one within 30 seconds. That's how bad it was; you could read random parts of the server's memory which may contain passwords, private keys, or whatever else OpenSSL was processing for current site visitors. I had stolen someone's credentials. Game over, right? How do you protect yourself against something as bad as this? ...

Oh, hey! I almost forgot I have a blog. I wanted to write a quick note about where you can find stuff I write. Short and frequent updates! @kumar303 On the Mozilla Hacks blog: https://hacks.mozilla.org/author/kmcmillanmozilla-com/ On the Mozilla WebDev blog: https://blog...

CHIRP Radio in Chicago is looking for someone to help us build a custom Android application so that our listeners can have a better experience on their Android phone. There are already a few Android apps for radio but they are clunky. Also, we have some plans to better engage listeners on phone apps with currently playing tracks, click-to-request-a-song, and other ideas like that. We already have a pretty slick iPhone application created by volunteer John Carlin and after only a few months it already has 1,000+ downloads...

Dropbox has nailed a use case that I've struggled with for a long time. I have a computer at work. I have a computer at home. Generally I keep files in sync via version control (Subversion, Mercurial, etc) but this is cumbersome for large files, specifically mp3 files. I consume a lot of music, digital and otherwise. How do I keep my music in sync between computers? ...

Now that it's -5 F in Chicago with a windchill of -25 F I thought it was an appropriate time to share one of the secrets to surviving a Chicago winter: Glögg! If you live in the old Swedish neighborhood (Andersonville) like I do then you can sip Glögg at most local bars but with weather like this, why even leave your house? Here's my recipe...

Telemarketing is one of the most ineffective forms of advertising. Hello? Yes? I'm cooking dinner, why would I want to buy something? How do you know I'm even remotely interested in your product? Online advertisements like text ads and banner ads are slightly different. I usually buy things online out of convenience so the venue is good for advertising. There is also a lot of information about me online ...

Someone passed me a link to this really nice article, Annals of Science: The Eureka Hunt, which talks about how neuroscientists have been studying what goes on in the brain when we get those amazing ideas that seem to come from nowhere. In my own life I can think of several times where I've experienced a sudden "burst" of thought like this. Sometimes it seems like...

There is a puzzle used in game shows known as The Monty Hall Problem. It's been around for a while but over lunch yesterday someone explained it to me for the first time and 3 out of 4 of us argued convincingly the same answer. And it was wrong. Here's the problem: Suppo...

...that's right, it's not molded or prefabbed, it's not made on a production line or in a lab. Are we insane??! Here is a hilarious probe into the darker side of this art we call programming.

So ... I have a blog now. Dunno about Bonde but I always kinda told myself I'd never have a blog because I don't read them much and think the whole phenomenon is a little weird and self-indulgent. On the flipside, I find myself googling a lot for things like "make...