« Posts under Rants

Adventures in Craigslist

Recently, after a friend of mine showed off his nice new HP Touchpad (running an early alpha of CyanogenMOD) I decided it was time to make the jump and get a tablet as well. The only problem was, being a broke bloke, it was hard to justify the purchase of one when I really didn’t need it. To solve this dilemma, I decided to sell my laptop, a Late 2009 Unibody Macbook (the 6,1 model) and purchase an Asus Eee Pad Transformer (and the dock).

After checking with friends (who laughed at the prospect of owning a Mac), and spamming the global distribution list at work (no bites there), I restored to posting ads on Craigslist and Kijiji (the latter of which brought in zero perspective buyers). The Craigslist ad, though, prompted a number of replies.

The problem, however, was out of all of the replies I received, only four of them were people who were genuinely interested. I won’t post those replies, but instead, the ones that were almost certainly scams.

So a little background information – when I posted the ad, under all of the specs I very clearly wrote “Cash only – must agree to meet me in person, in a public place that we both agree on”. The ensures that not only do I not have to worry about shipping the thing, but it assures me that I won’t get any fraudulent cheques, money orders, etc…. Unfortunately, the people who tend to perpetrate these scams tend to ignore these warns, as outlined below:

This first example was actually “Sarah”‘s second email to me – the first one was a generic “Do you still have the item for sale?” inquiry.

Hello,

Thanks for getting back to me on time,i will like to buy this item and

Am quite comfortable with the condition of the item since i wont be

making any repairs on it,and i will be very more than happy if you can

help me get this item shipped, and am willing to offer $770 to include

the shipping fees through the USPS Express mail service,and i will be

paying you through my PayPal account so send me your PayPal email

address so i can make instant payment get back to me

…….ASAP….Thanks and GOD bless

Note the “GOD bless” at the bottom – I would imagine they were thinking “If I put that in, they’ll think I’m a god-fearing Christian and they’ll be sure to make the deal!”.

  1. So what was wrong with this offer? Several things:
  2. They ignored my Cash Only – Local Only warning. Never a good sign when they don’t even say “Hey, could you make an exception?”
  3. The sentence structure/grammar are…well…horrible and far too formal. Definitely someone trying to sound on the up-and-up a little too hard.
  4. Offering to pay more than the listed price. I listed the laptop for less than that. All four of the legit, local enquiries first offered less (in one case, far less) than my asking price. By offering to pay more, the scammer is hoping that you’ll be greedy and jump on the offer.

So why wouldn’t I try, take the money, and send it anyway? Well, the problem is that most of these involve stolen Paypal accounts. The person will get the account, not use it, and wait for something like this to come along (a relatively high-value item). They’ll then use that account to pay for it take the item, which they’ll then sell themselves. Meanwhile, the rightful owner of the Paypal account discovers the new unauthorized charge and files a dispute with Paypal. The money gets pulled from my account, and now I’m short both the money and the laptop. Pretty sneaky.

Another “Sarah” (which seems to be a commonly used name for the scammers) contacted me, asking a few more questions (“Do you still have the box”, and “What condition is it in”), before inevitably asking for my Paypal details to send the Payment. I politely replied that as the ad stated, I would only deal in cash and locally because of the chance of a stolen account being used. To this, she replied (in full):

my account is not stolen

Really? Well in that case, sure! I mean, I wasn’t positive, but you’ve managed to convince me!…Not.

Another one (again, the second email after the first “Is it available, what condition, etc…”):

Hello, thanks for your reply. I’m glad you still have the item for sale. Your asking price sounds OK to me. Payment will be make via money order with the shipping fee included. Payment will be deliver to you within 3 to 5 working days. Then pick up will commence immediate by my shipping agent once you have clear the payment in your bank. I will add extra 50$ to your last asking price if you agree to sell this item and hold it for me till you receive my payment. Kindly fill the below data for payment to be mail out tomorrow morning.

FULL NAME :
PHYSICAL ADDRESS :
CITY, PROVINCE :
ZIP/POSTAL CODE :
PHONE/MOBILE NUMBER :
ITEM AGREED PRICE :

I hope to hearing from you soon with the payment information in order to complete the sales asap. Thanks.

Regards,
Edward Parker.

Nope. Sorry.

There were a bunch more, but all were basically the same. In each instance, my typical reply is this:

As you appear to be illiterate, I well try to phrase my payment requirements in a simpler manner – a haiku:

Cash. Only. I mean it.
Must. Meet. In. Person. Okay?
No Exceptions. Thanks.

So that’s about it. I ended up getting a little less than I asked for it, and now I’m the proud owner of an Asus Eee Pad Transformer. Hopefully it’ll be a long time before I decide to sell anything online again.

Followup: Staples.ca and Plain Text Passwords

I posted an article the other day when I discovered that Staples.ca stores customer passwords in plain text. After a lot of prodding through email, I finally received a reply with some technical detail about how Staples actually stores the passwords:

We do take this issue very seriously.  I contacted another department for a technical explanation of the issue.

Staples.ca stores user profile information in a commerce Binary large object that cannot be selected using SQL and cannot be queried without knowing the actual hash key to parse the XML object. When a password is being requested using the ?Forgot password? feature, the email address and the security question is asked to validate the user and then a backend processing is performed on the request to retrieve the password and send it to the email address on file. The site is on a monthly schedule to be scanned by Qualys (a third party security provider that provides on demand vulnerability management and policy compliance solutions to Staples) which scans for SQL injections, security vulnerabilities, firewall issues etc. We are 100% compliant by Qualys and from the RSA PCI standard institute. In no way you can SQL inject to this website and get any data from the database that is not authorized. The underlying architecture is very secured and strict procedures are in place to not compromise PII information.

Please do not hesitate to contact us if you require further assistance.

Joan, E-commerce Communication Specialist
e-mail: bd.support@orders.staples.com
phone : 1-877-360-8500
fax   : 1-800-567-2260
url   : www.staples.ca/contactus

So there you have it. They are completely convinced that it is impossible for someone to get your plain-text password.

…That is, unless your email account is compromised. Or their server is exploited (Staples.ca runs IIS5 on Windows 2000, according to Netcraft) and someone gains higher-privilege access. Or a staff members rages, dumps the db, then quits.

Unfortunately, I can’t find a way to delete my account, so I’ve nuked all of my personal data (replaced with fake stuff), and then entered a random password. I didn’t bother writing it down, because if I ever do want to get back in to my account, they’ll be more than happy to send it right to me. I don’t even have to choose a new one!

Apple Offers Re-Download Feature, But Only to Americans

Being a Canadian citizen, I’m used to getting the short end of the stick when it comes to companies holding give-aways and the like. Apple is, of course, no exception.

I was excited to hear that, starting with iTunes 10.3.1, Apple would be allowing customers to download music that they had perviously purchased (before, if you bought a track/album and lost it, you would have to buy it again). In case it changes, the feature is described as:

Now you can download music you’ve previously purchased to all your devices. When you buy music from iTunes, iCloud stores your purchase history. So you can see the music you’ve bought — no matter which device you bought it on. You can access your purchase history from the iTunes Store on your Mac, PC, iPhone, iPad, or iPod touch. And since you already own that music, you can tap to download your songs or albums to any of your devices.1

Note the (1) footnote indicator. That footnote reads as follows:

Available in beta now in the U.S. only and requires iOS 4.3.3 on iPhone 3GS, iPhone 4 (GSM model), iPod touch (3rd and 4th generation), iPad, or iPad 2, or a Mac or PC with iTunes 10.3. Previous purchases may be unavailable if they are no longer in the iTunes Store.

Emphasis mine. With any luck, once “iCloud” leaves “beta” (why are you push Beta software through the official update channel, Apple? Google should sue.) the functionality will be expanded to beyond the U.S. and let the rest of us poor suckers get back our copies of ‘Plastic Beach – Deluxe Edition’.

Rant: Gawker Shows Us How Not To Do It

Update (6/07/2011): Gawker has apparently corrected the problem for both the desktop Canadian sites and the mobile sites! You can now get the link you wanted without having to resort to workarounds!

Update (4/20/2011): See the bottom of the post for Gawker’s response to my inquiry.

When Gawker launched a new layout for their various sites, I said ‘Meh’. When their database was hacked and account details stolen, I said ‘Meh’ again, as I wasn’t an avid reader and didn’t have an account. I’d open the occasional link to an article on Life Hacker, or Gizmondo, but that was it.

Now, I won’t even go that far, mainly because most of the time, the links don’t work.

Let me explain – if you live in the U.S. and/or don’t own a mobile device, you probably won’t notice an issue. However, being from the Great White North and owning an Android phone, getting to a specific article on a Gawker-run site is next to impossible without employing workarounds.

When someone from the U.S. links something from, say Life Hacker, the link will look like this:

http://lifehacker.com/#!5757510/feednu-makes-an-android-app-for-your-blog

However, if you’re in Canada and click on that link, it will take you to this instead:

http://ca.lifehacker.com/

Yes, that’s right. Instead of taking you to the article that you want to read, it says “Oh, hey! You’re Canadian! Look at our other layout. What do you mean you wanted to read a specific article?” (Sometimes it will leave the full URL intact, but still bring you directly to the front page instead of the article you wanted).

And if you use a smart phone, or any other device Gawker things deserves the mobile site, you’ll get this:

http://m.lifehacker.com/#!5757510/feednu-makes-an-android-app-for-your-blog

Which, depending on how the site feels, will either give you their mobile homepage, or just a 404 error.

Kind of reminds me of this XKCD strip. Either way, bye bye Gawker Media. You won’t be missed.

Addendum: After emailing Gawker’s support team a few times, I finally got this reply:

The tech team is still trying to figure out how integrate the hashtags with the redirect– they’re making some progress,but not enough to roll out with the fix just yet. All we can ask is that you continue to be patient until that fix is ready. Sorry for the inconvenience this is causing, but I promise, a fix is coming.

–Steve Climaco

Gawker Media Help Desk

So basically, they’ve over-engineered their post system and have no idea where the screw-up is. Given their overall history, this isn’t surprising.

Rant: WordPress.com Stats Broken, Makes Me Sad

Update: WordPress.com finally fixed the Stats issue, however Jetpack (despite the version bump to 1.1.1) still errors out, this time with “register_http_request_failed“.The issue appears to be with LigHTTPD, as if I switch back to Apache everything works. Might finally break down and switch to NGINX, as Apache is too big of a memory hog for my liking.

The other day, the WordPress.com Stats plugin I use to spy on you monitor this blog stopped working. Then I started getting this error from Stats:

Your WordPress.com account [Redacted] is not authorized to view the stats of this blog. Currently access to stats is broken for some users and we are working on fixing this. Your stats are still being counted and will be visible once we restore access for your account.

Fair enough. I waited. And waited. And waited some more. When it became apparent that this wasn’t a temporary problem, I removed and re-added the plugin, and was then greeted with this new, more exciting error:

“The owner of that API Key ([Redacted]) is not on the access list for this blog ([Redacted]). Stats was installed using a different API key. The owner of the original key can add users to the access list, or you can contact WordPress.com support.”

Huh. Well, since that didn’t do it, I did some Google’ing and found out that Automattic just released Jetpack, a collection of plugins that replaces a good chunk of the standalone plugins out there that work with WordPress.com services. People who were getting the above errors reported that the Stats plugin provided with Jetpack worked, so I switched. And immediately received yet another error:

Your Jetpack has a glitch. Connecting this site with WordPress.com is not possible. This usually means your site is not publicly accessible (localhost).

Fantastic. Google once again helped me to find a bunch of other users with the same problem, but sadly, none of the fixes (most of them found in this thread) worked for me. I broke down and contacted Automattic support, and their reply was the following:

It might be the SSL cert that is preventing Jetpack from connecting. Is the site also behind any sort of firewall?

Which, of course, the site is. However, that was the first thing I checked, as my IPTABLES rules are just north of Insanely Restrictive. Sadly, disabling IPTABLES did nothing to help. Additionally, I was able to confirm that outbound SSL access was working by using CURL from an SSH session to grab pages from https://wordpress.com, so that’s not the issue either. I replied back to let him know this, and I’m waiting on a response. Through all of this, the normal WordPress.com Stats Plugin still doesn’t work. So,

WORDPRESS! Y U NO FIX STATS API?

My new favourite meme.

Windows Desktop Twitter Clients Suck (And Here’s Why)

I use Twitter semi-frequently. I’m more of a reader than a poster (in the 2+ years I’ve used the service I’ve only tweeted around 8,100 times), so it’s always struck me as odd that while mobile Twitter clients (such as Plume) do an amazing job working with the Twitter API, desktop clients never seem to live up to expectations.

Timeline Position

Mobile clients reign supreme in this, the seemingly hardest-to-master part of Twitter. I follow upwards of 170 people, and when they’re all actively tweeting my timeline fills up with sometimes ungodly numbers of tweets. These days, most mobile clients remember where you left off reading, and add new tweets above that point. Then, when you refresh the timeline, you just need to start scrolling up and you haven’t missed a thing.

Sadly, though, desktop Twitter clients still haven’t figured out that this is an important feature. I really love the look of MetroTwit, Seesmic Desktop 2, Blu, et al…, however it and every other desktop client I’ve tried will either scroll you up to the top of the timeline on refresh or do the same when you quit and reopen the application. This leaves a huge mess, and you need to remember the approximate time you stopped reading so you can scroll back through the mass of tweets that have collected since.

As a side note, a large number of desktop clients will scroll on refresh as you’re reading (I’m looking at you, MetroTwit). If I’ve just refreshed and scrolled back over 50 tweets, it really sucks to be scrolling up as I’m reading only to have the client force-scroll down as another 20 tweets come in.

View Conversation

A great feature in Twitter’s new website redesign is the ability to click on a tweet, and a tab will open up beside the timeline showing you the contents of the tweet, other tweets by the person, and most importantly, if the tweet was an @ reply to another tweet or series of tweets, it will show those as well. Mobile clients typically allow you to tab on a tweet and have the conversation show up inline, or in another view, but once again desktop clients have missed the boat on this one. MetroTwit requires you to right-click on the tweet and go through a few levels of context menus before you get to an option to show the conversation, and most lack this feature entirely, making it difficult, if not impossible, to find out what each of the 15 new @ replies are referencing. So far, Blu appears to be the only client to provide a quick-view of conversations similar to mobile clients.

Image Previews

Another feature of New Twitter is ability to click and tweet and Twitter will show you, in the pop-out tab, a preview of images linked to popular sharing sites like TwitPic. Mobile clients will typically add a small thumbnail (and some, like Plume, will allow you to view the image without leaving the client, as below).

Once again, the only desktop Twitter client to do this is Blu. The others still require you to click the link, switch to your browser, and then switch back to the client. Why not just use the Twitter website, then?

Your Retweets

Ever want to see which of your tweets have been natively retweeted? Unless you’re on twitter.com (or using Blu) you aren’t likely to find out. Even mobile clients fail at this one, despite the fact that native retweets have been around for over a year.

The Takeaway

So it might seem like Blu is the ultimate desktop Twitter client, seeing as it actually does most of the things listed here, right? Of course not! Much like other desktop clients, Blu lacks the option to configure most of it’s settings (there are exactly three options on its Settings page, and one is font size). Don’t want toast notifications? Screw you! Want to make the mouse scroll wheel scroll fewer than a page at a time? Up yours! Adjust the colour scheme? We’re blu(e)! Have more than one column, change the auto-refresh options, or tweak the font size (alright, they can do the last one)? Go to hell!

The TL;DR of the matter is, if you want a good desktop Twitter client, stick with http://www.twitter.com – it still has the most features, is less annoying, and doesn’t suck as hard.

An HTC DoA: Part 5

Continued from Part 4 (read from the beginning).

I took a trip to the UK at the beginning of the month, and when I returned on the 13th immediately checked my credit card statement. I wasn’t surprised to see that the refund still hadn’t been processed (now past the 14-business-day cut-off mark for credit card refunds). I called HTC yet again, and after a bit of hold time was given some good-ish news.

The agent confirmed that yes, HTC’s warehouse had received my phone and they had accepted it. However, someone at said-warehouse hadn’t closed the ticket in their system which prevented the refund from being processed. I was promised that the ticket would once again be escalated and that the escalations team would get the warehouse to close the ticket and things would get moving again.

I asked if HTC would compensate me for the interest accrued on my credit card from having this charge sitting on it for nearly two months, but was told they wouldn’t do anything. It was worth asking about, though.

So, on Tuesday the 17th I once again checked my credit card statement and there it was! A line item showing a credit for the DoA Nexus One. Although I wasn’t happy with the time it took to deal with the issue, and the interest charges that built up from it, I was ready to put the issue to bed.

And then I got the following email from HTC:

Dear Laslow,

Thank you for using HTC Customer Service. We want to make your next visit even better and would like your feedback. If you haven’t already done so please help us improve by taking a quick survey on your experience using HTC Customer Service.

Get Started

Thank you very much for your time. Be sure to visit us online at http://www.htc.com to read the latest announcements and check out our newly released products.

We are unable to receive replies to this email account. Please visit us at http://www.htc.com if you have any questions or need further assistance.

Sincerely,

HTC

I couldn’t pass it up. I filled out the survey and was completely honest about the experience I had with trying to get a refund for a DoA unit and how ridiculous that I had to choose that route in the first place, rather than having the option to simply get a new, non-refurbished replacement like American customers. I submitted it, and then completely forgot about it.

This morning, while I was off rebuilding a borked IPCop box, HTC left me a voice mail message that went something like this:

Good morning Mr. Laslow. My name <redacted> from HTC, and I’m just calling to follow up on your return. I am very, very sorry that it took so long to process your refund. I’m also very sorry that you received a DoA unit in the first place. If you need any further assistance with this, please call us at 866-449-8358. Once again, we appreciate your business and are very sorry about this whole thing.

I was stunned; I never expected to hear back from HTC at all. I’m not, however, surprised by the fact that they simply apologized rather than offering some form of compensation (be it an accessory, a t-shirt, anything really). Regardless, I’m happy that this is over and I can finally end the tale of an HTC DoA.

Updated x4: The Non-Existent State of IPv6 in Canada

Further Update (06/27/2011): If you have a Dlink DIR-825 router, I just published an article on getting a free Tunnel Broker IPv6 tunnel account working. Check it out! If you have a router that is cable of an IPv6 over IPv4 tunnel, or just want to use a single computer, check out Tunnel Broker from Hurricane Electric.

Over the last few days I’ve been attempting to gather information on IPv6 in Canada, and so far the news is grim. Why am I looking in to it? Well, there have been a number of articles posted lately about the impending end of available IPv4 addresses and the sorry state of IPv6 addoption, and I wanted to check in on my local ISPs and see if any of them are preparing for this. The short answer? No.

My region has two primary ISPs – Telus and Shaw Cable. I did a quick Google search to see if either had made any announcements about IPv6 readiness, and I ended up with no relevant results. In fact, a search of “IPv6″ on the domain shaw.ca only returns results on user hosted pages. Searching Google for “IPv6 Telus” only comes up with one close match – this PDF document that’s basically a beginners guide to IPv6.

So, I opened a ticket with my ISP (Shaw), and tweeted at their customer care guys. I also tweeted at Telus’ customer care. Here’s what I got back.

Telus tweeted back pretty quickly:

@laslow We don’t have any news on implementation of IPv6. It would make sense that everyone will switch eventually. -Trevor @TELUSSupport

I replied, and they came back with this:

@laslow We’ll try and help where we can but no real info on this. Hope your day goes well!

Well, that was rather uninformative.

Sean from Shaw Customer Care also replied rather quickly on Twitter:

@laslow hey man, no word on IPv6 yet, hopefully sometime in the near future though.

Shortly after, I received the following reply to the ticket that I opened with Shaw:

Hello [Laslow],

This is [Agent], thank you for your e-mail.

At this time there is no set date that IPv6 will start to be used. As soon as address’s have ran out with IPv4 then everything would be switched over to the IPv6. Kind of like how in B.C. not including the lower mainland we have been using the area code 250 for years. There are no longer numbers available with the 250 area code so they moved to 778 area codes. It will be similar to this when IPv6 is released, sorry we have no further information for you at this time on this.

So in short, Shaw’s plans are to wait until they’ve run out addresses, and then worry about what to do next. I don’t know about you, but I’m definitely feeling more confident that Shaw will be able to connect me to IPv6-only services in the next, you know, ten years or so.

Honestly, though, there are a number of ISPs in the states that already have public IPv6 tests available (Comcast, for example) – why is Canada so far behind?

If anyone reading this works for Telus or Shaw and has more information on their progress towards IPv6, please leave a comment or send me a tweet – It would be nice to know if there are at least plans in place rather than just a sense of “we’ll cross that bridge when we get there”.

Updated (11/29/2010):

I contacted Shaw, Telus, and Rogers via twitter again and received the following responses (still waiting to hear from Shaw):

@laslow At this time we do not have any information/news – Ryan with @TELUSSupport (Direct link to tweet)

And:

@laslow Hi Laslow. I have no info – but can ask around tomorrow. I’ll get back to you if I get an update. (via @RogersEliseDirect link to tweet)

I’ll post any additional information I receive as I get it.

Updated (11/30/2010):

Shaw responded this morning with the following (still no additional information back from Rogers):

@laslow yes, it’s in the pipeline, however, no confirmed release dates yet. (via @Shaw_SeanDirect link to tweet)

So we have at least one ISP that will willing to publicly state that they have plans to deploy IPv6. Still, solid details would be welcome.

Updated (02/01/2011):

You can check to see if your ISP has IPv6 Prefixes using this site. If they do (I can confirm Shaw and Telus do, haven’t checked others yet), it shows that they have IPv6 connectivity with the rest of the world. If not…well, it might be time to panic. I bugged Shaw again via Twitter about IPv6, and got this response:

@laslow I honestly have no idea, but I’ll make sure you’re the first to know should I hear something.

So, I’ll update again when I hear more.

An HTC DoA: Part 3

Continued from Part 2.

It’s day 5 now and still no shipping label. I called HTC again and got a slightly different answer out of this rep. This one told me that my ticket had *just* been escalated and was on it’s way to the warehouse now. When I told him that the other agents had told me it had already gone up to the escalation team, he started backpedaling and said that although the ticket had been escalated it takes them time to look things over.

4 days? Ya, right.

So I asked for a supervisor. After waiting on hold (no music, just silence so you never know if you’ve been cut off), a ‘supervisor’ came on the line (supervisor is in quotes as, having working in a call centre before I have first hand experience pretending to be a co-workers supervisor – it’s a very common practice). I asked again what was going on, and she had yet another story. Apparently, HTC’s shipping system has been ‘down’ for ‘a few days’, and they have no ETA on things. She assured me, though, that (for real this time!) my ticket has been escalated, it should be at the attention of the warehouse, and I should have a label by Monday or Tuesday.

So, starting Monday afternoon (as nobody’s around to man the phones on weekends), I’ll continue with my daily phone campaign trying to find out when I can possibly expect to send back my wife’s brick…err…Nexus One.

Continued in Part 4.

An HTC DoA: Part 2

Continued from Part 1.

Day four of the return process and no real progress to report. According to the details given to me by HTC on Monday (see part 1), I should have received a shipping label in my email the following day. When I didn’t, I called HTC support back. The agent I spoke with told me to check my spam folder (already done – nothing), and then said that she would ‘escalate the ticket’ and a label sent out right away. I thanked her, disconnected, and waited.

And waited.

End of day Wednesday rolled around and still no shipping label. I called HTC again and was told that it can take an extra day when things go through the escalation process and that I should expect it to show up in my email no later than Thursday.

Well, here we are on Thursday and still no label.

I called HTC yet again, and was told that yes, I should have received the shipping label today. The agent then proceeded to tell me that he update the ticket, ‘increase the priority’, and that I should keep waiting.

Really, HTC? I’m normally a pretty patient guy, but come on! I’ve heard of American customers getting new, replacement phones within days, but we Canadians need to go through this gong show of a return process and then re-purchase the device because otherwise we end up a refurbished phone instead of a new one. This is bad PR, people. It’s time to start spreading the news.

Find out what happens next in Part 3.