UI mockups - nice and easy

I write code. Sometimes it will be a short script, sometimes a web app, next day it can be something with more
traditional user interface but designing user interfaces is my worst nightmare. I can plan the whole app, write and test the code, but when it comes to UI design I just want to run away - it is simply not my game.

Usually when everything is
finally ready (or so I think) somebody comes and says 'Oh! By the way - if you moved this part here, it would be better - easier to use' and quite often they
are right, so I've started asking my potential users how they want it done before I actually create it at all, but for that I need simple drawings that would explain my idea - something they can look at and say if they like it or not. Preparing several sketches takes time, modifying them takes even more... but there is a tool that helps.

A humble screen shot is worth more than a thousand words...

As simple as that - prototype of simple blog layout in less than 10 minutes using Balsamiq Mockups for Desktop (demo version). Simple, nice to use, very effective!

Normally I wouldn't write about 'software' (especially commercial), but there is something special about this one....



First of all the main use of this program is to do mockups of user interfaces - be it web apps (which for me is yet another form of UI), iPhone apps, dialog windows or anything else. Sometimes all you really need is simple wire frame to show what will be where - rough cut to present the idea - and using pen and paper is simply too... boring and ineffective, especially when you want to discuss your ideas, then possibly change it a bit and discuss again. Here comes in Balsamiq Mockups for Desktop.

Mockups for Desktop runs as Adobe Air application so it's cross-platform. The interface is very intuitive and easy to work with, so you can't get it wrong. You can get first mockups ready literally in minutes after you start the application for the first time ever - modeling my other blog layout idea took me just 3 minutes. It is very simple - just drag the element from the UI library to the main drawing area and put it in the right place. Editing objects comes as natural thing - I guess even a child could do it :-)

I won't be telling you how to use it - go figure it out yourself and have fun as I did :-) Wow! I think that was the first time ever I had a smile on my face when trying to work on the user interface side of things. I think it's a really good piece of software and honest 'well done' to the guys at Balsamiq.

BTW. Irek, thanks for bringing it to my attention ;-)

wykop.pl owned - data stolen

The news of the day in Poland is that wykop.pl - polish site doing the same stuff as digg.com - got owned in a pretty bad way - database with user's login credentials and e-mail addresses was stolen. This post is a result of gathering info from public sites (in Polish - mostly off Dziennik Internautow which gave nice coverage) so all of it is already in public domain - otherwise I wouldn't quote any fragments or call on any information given here.

Info about breach goes public

Following what Dziennik Internautow wrote in their post, on 5 Sep 2009 a person using nickname Gimbus1xD has informed administrators of wykop.pl about the breach (no link - original post taken down) and about the fact, that some of the information stolen was already used to compromise account held with other websites, including allegro.pl (auction system like eBay). To prove his revelations, Gimbus1xD posted also screen shots of compromised Allegro account with transactions that happened two days earlier and another one with PHPMyAdmin browsing 'users' table.

The scary part here is that as Gimbus1xD wrote, about 40% of those passwords have been broken (despite being hashed) with simple dictionary and brute-force attacks because passwords were up to 7 characters long.

Allegedly the database is in the hands of vichan.net admins, which again allegedly shared 'unhashed' database with their moderators - including Gimbus1xD, who broke the news. So far it's not clear what made Gimbus1xD change his mind and make this information public.

That's not yet the end...

How mobile a mobile broadband may be?

Quite recently I had a chance to travel by train from London towards Manchester and back. The journey was not bad in fact - first class on Virgin Trains does the trick... even more when you have free wi-fi included and power sockets for almost all seats.

So does it work at all? Well - quite frankly yes, it does. Even at the cruise speed it's quite stable, but don't expect broadband speeds! I was wondering how it's done, because the hot-spot is provided by
T-Mobile, so most likely something like 3G broadband type deal, shared among all passengers. Let's see where we are...

Microsoft's EPIC FAIL

Probably everyone has seen it already... It hit reddit.com yesterday getting to the top of the front page, BBC wrote about it, it was all over Twitter, and got even it's own video clip/mockup, etc. Simply the best FAIL!

BBC did a great job in capturing it (see BBC link above for full article) - I was too slow to do a screen shot this time :-/ I have removed the image from here - don't want to upset BBC by copying their content without permission (although probably I might call it on fair use policy - anyway just see the links above and that's it).

Funny enough link on reddit.com that points to dropbox.com is no longer valid (404 win!) and Microsoft has replaced the image to be as the original one (oops - forgot to resize orange bar below the text - that happens if you have rocket a up your ****), but no worries, you have faithful users on the Internet :-D

Are TFL top-up machines secure?

Another day, another FAIL.This becomes my daily routine it seems, but that's another story.
This time TFL - operating London's public transport network that covers undergound, overground, DLR, buses and whatever else comes.

During one of the Security Now! podcasts (#193 was about Conficker so it was somewhere between #194 and #196) one of the main discussion topics was (to no surprise) why Windows shouldn't be used in places like ATMs, hospital equipment (MRI scanners, heart monitors, etc) and most of other control
systems we have and use today.

In fact it's really hard not to agree with that. The arguments were very clear and sound:

• Most if not all of those systems are "consumer grade", not any kind of "industry type" things
• They are connected to the network
• They are not patched in general (it works so don't touch it)
• Most don't run any antivirus/firewall (not related to business function?)
• Many were not planned to be put on-line in any way (but we know they are)

The machine above takes cash or card - can we trust it then? Does it run anti-virus software and firewall (it's networked - it should)? How can I be sure it won't do what some ATMs in eastern Europe did? We can't be sure of anything if they end up like above, so feel free to add those to a 'Windows no-go list' if you wish and do top-ups on-line at the TFL website - I think it will be safer than at those machines - in general they don't reinforce any trust I might have had for them some time ago.

T-Mobile (U.S.) got owned?

Few minutes ago I came across a full disclosure post saying no more no less than

Like Checkpoint Tmobile has been owned for some time. We have
everything, their databases, confidental documents, scripts and
programs from their servers,financial documents up to 2009.

If that's true... Ouch!

Just few hours ago I was thinking "what a nice and quiet weekend evening", hmmmm... seems it was just a quiet time before the storm hits. I guess that news coming from the world may be very interesting, so let's wait and see what happens.

EC-Council courses certified by NSA

Chris Riley brought up a good post on his blog...something I totally missed in the news :-o

Following (literally) the press release from EC-Council we read "EC-Council Courseware certified to have met the CNSS Standards by the
United States National Security Agency (NSA) and the Committee on
National Security Systems (CNSS)". Shocked? I am!

What does it change or prove?
From my point of view it says that EC-Council knows how to do marketing, which obviously they do a lot. My impression when meeting EC-Council people at different expos and conferences were like, uhmmm... security? WTF? Business is business, most important part is to keep it going. Create a business model (hey - I don't blame you for that, good you succeeded!), build brand, loyal user base, make some media stir and here you go. It's simple - if I see someone talking about security with $$$ signs in his eyes, that's a sign for me to back off and go elsewhere. That's my personal impression regarding EC-Council as an organization - full stop.

My thoughts on standards and compliance
Chris has raised in his post some really good points about material quality. I would add, that conforming to standards and requirements (be it well known old friend ISO 9001 or any other ISO-based, PCI-DSS, etc - you name it) is just a matter of proper wording in the marketing materials and in some internal paperwork. I used to work in this area for some time (ie. standards, certification, implementation, paperwork - I've been on both sides of the process, from the bottom to quite high in the chain) and I can tell you that there are two ways to achieve so called "compliance" with any "standard" I came across so far - make damn sure you do what you say you do and do it very well and that conforms to requirements... or make sure auditors don't bother reading :-) and "OK" what they got. First impression method, social engineering, etc - great place to apply those!

Paper will accept anything you want, but this doesn't change in a bit what people know, what they do, how they work, use their knowledge (how much are they worth), etc.

Nothing has changed... exactly nothing!