Bottomline: It'll take a couple of months until we'll be settled again. As soon as that is the case, I'revive this blog.

Till then, hang in there!

What is ownCloud?

I'll let Frank answer that himself:

You can use it to store your files in your personal cloud storage and access it from all your devices. It will also support versioning, backuping, sharing, syncing and other server based functionalities which are useful additions to KDE applications.

ownCloud is the central exchange point for my data and a companion for different KDE powered devices using the AGPL license.

So there you go. Your own online storage with connectivity to virtually all your gadgets. The benefits are obvious: You don't give your data away as it will still be on your own hardware. That alone is a big improvement over most other online storage systems. I hope my favorite mobile office applications, namely the Files, QuickOffice and iThoughts applications for the iPhone will support ownCloud once it has reached a certain stage.

Help a good idea to grow!

When you leave your comment on this blog you will be asked to type in two words which are displayed as distorted graphic. Most bulletin boards and free mail providers ask you to do the same before they allow you to create an account.

CAPTCHA 101

The reason behind is the same most of the time: Preventing SPAM. Spammers use forums, blog comments and contact forms to post their ads. They use bots (quite similar to the bots that update the search index on Google, Yahoo and all other search websites) to automate that process.

So the idea of CAPTCHAs is to present a task to a website visitor that is difficult to solve for a machine, but easy to solve for a human. The graphical CAPTCHA is the most commonly used one.

There are other CAPTCHA variants such as audio-based ones or image recognition based CAPTCHAs. I've even seen a simple math question as CAPTCHA.

The arms race

In December 2009 Jonathan Wilkins announced that Googles' most prevalent CAPTCHA method, reCAPTCHA has been broken. It is now possible to identify the words presented by reCAPTCHA with an accuracy of around 20%. For spammers that is good enough. WIth a 20% sucess rate, every fifth attempt will result in a successfully placed ad. Mr. Wilkins argues that even a success rate of 1% is good enough since the resources used by spammers often are not their own, thus their utilization is free (think bot nets).

This is bad news for everyone. I really hope Google updates its reCAPCTHA algorithm to a variant that is harder to solve by machines. For the record, I also use reCAPTCHA here in this blog.

Update: As of December 31st 2009 reCAPTCHA seems to be updated. Google responded quite quickly. So far I can already say that the number of spam posts I get in this blog has reduced drastically, albeit not come to a stop. Anyways, thanks for a quick response Google!

This situation is critical because spammers do not need to be particularly good at breaking CAPTCHAs. If one out of five CAPTCHAs can be broken and spammers still make a living out of this the CAPTCHA itself is useless in the sense that SPAM will enter your system.

Jonathan Wilkins has a .pdf paper where he gives guidelines for the creation of strong CAPTCHAs. It is a really interesting read even if you're not involved with CAPTCHA development  directly.

Which is the best solution?

Well I guess your mileage may vary.

For now I will stick to reCAPTCHA [official homepage] although it is broken and I need to remove a few unapproved comments every day. I like the idea behind the project so I'm willing to accept the minor annoyance that it currently imposes.

Text-recognition CAPTCHAs such as reCAPTCHA require strong OCR solutions and to my personal surprise, that is still a field what needs a lot of improvements. So even if reCAPTCHA becomes to cumbersome for me, I'll stick to another visual CAPTCHA method.

Audio CAPTCHAs are not recommended by Jonathan Wilkins because he argues that the field of speech regognition is more advanced than that of OCR. Aside from their security, I don't want my visitors to do something unfamiliar, and listening to an audio file to fill out a form certainly is.

I like the idea of asking a simple question, such as "What color is an orange?" or "What is 3+5?". Not sure about the security though. The latter one can be automatically solved by Google itself for example. However, I'm half way convinced that this is an approach that has a bright future.

Promising examples of what might be next

SQUIGL-PIX
On the reCAPTCHA website you can find a link to the SQUIGL-PIX project, apparently the latest project by the reCAPTCHA guys. It presents you with three images and asks you to outline a certain object. Only if you outline the object correctly (after chosing the correct image) the CAPTCHA is solved.

Give it a try. It is fun, easy (for us) and I sure hope it is hard for machines.

CAPTCHA The Dog
Another interesting approach is Captcha The Dog. You are presented with nine images total and have to pick the one that shows a dog while all others show a cat. You have to pick the single dog several times (from different picture sets) and click 'ok' once there are only cats.

The idea is brilliant and the basic reasoning behind it is the same that makes SQUIGL-PIX good: Object recognition instead of text recognition.

Captcha The Dog goes one step further and allows you to use your own set of images, tapping on the financial feasibility to break your individual set of images. There is even a WordPress plugin available but I have to give a warning: According to the installation page the plugin requires allow_url_fopen and allow_url_include both to be active. Sounds like trading one evil for another. XSS anyone? Too bad, the idea is great.

3D image rotation
The third approach I'd like to present is proposed by Taylor Hayward and apparently does not have a name. It asks you to identify an object appearing in two rotated 3d renders. You are presented with one control image, and a set of nine randomly rotated images out of which one is the (rotated) control image. I found it hard to imagine so go see the blog - it'll be much more clear.

Once again, the method relies on object recognition. Great idea.

"Do not try this at home"

When you google for "php captcha library" you find literally thousands of home grown 'solutions' for secure CAPTCHAs. Once again I can only urge you to read Jonathan Wilkins paper on secure CAPTCHAs before you use one of them. The bottom line probably is that they will not work very well for you because their authors try to obfuscate the letters in a way that poses no or only very limited issues to OCR software.

Just assume that if Googles' solution to CAPTCHA is broken, yours will get broken too once the incentives to try are high enough for the bad guys.

That being said, developing your own approach while sticking to Jonathans guidelines will most likely be an interesting spare time project.

Possible benefits

Believe it or not, I really see possible benefits coming out of this arms race. As the spammers' tactics to solve CAPTCHAs improve, the good guys are forced to improve their generation of CAPTCHAs. After some time, the newer CAPTCHAs will also be broken. The cycle continues.

Naturally, the only way for the good guys to verify that the new version of a CAPTCHA is indeed more secure than the old is to think like a bad guy and try to break your own CAPTCHAs.

This might - and I believe it surely will - lead to better OCR software, better audio recognition and in general a higher standard in 'intelligent' algorithms that are able to solve every day problems.

Audio recognition might help the deaf to read what people say, by other means than lip reading. A universal translator (famous in Star Trek) is not completely out of scope either, although it is still really far away.

Text-recognition is highly in demand on mobile devices. If a program can identify highly distorted characters from a CAPTCHA, I'm sure the same ideas can be applied to read hand writing.

I'm glad you like the topics and ideas I present here. I'll continue to give my very best in 2010 and I promise I have a couple of interesting topics already piled up.

A successful and prosperous year of 2010 to all of you!

The solution that comes up by reflex is to use graphics, often auto generated. But keep in mind that graphics are meaningless for search engines. Your SEO suffers if you use graphical headlines (the most important bits of information as far as search engines are concerned).

The next solution is flash. Google is able to read flash, so your SEO might suffer not that much. But what about your visitors? Ok, Flash is installed on virtually any PC these days. But not on the iPhone. So do you care about your mobile visitors? I think you should.

Furthermore, I use the NoScript Firefox extension as a security measure to disable JavaScript and many other "dynamic" content such as Flash by default. So I won't see your Flash headlines - all I see is a nasty empty box with the NoScript logo. Don't think I'll enable Flash just to see your headlines. Chances are that I leave your site in favor of another one with similar content, without flash.

Enter Cufón, a pure JavaScript implementation that is able to render TrueType fonts in all modern browsers. It works by converting your classical .ttf or .odf file into a JavaScript representation and rendering it through SVG. Check their in-depth explanation how that works. It utilizes JQuery so you can easily use the JQuery selectors to convert a headline into a nice font, or all paragraphs with a certain class:

<script type="text/javascript">
    Cufon.replace('h1', { fontFamily: 'Vegur' });
    Cufon.replace('.menu', { fontFamily: 'Myriad Pro' });
</script>

Check the usage page on the Cufón website for a detailed explanation.

Why I prefer Cufón

There are a few things that really make Cufón stand out:

For me the best thing about Cufón is that it degrades nicely. If JavaScript is disabled or blocked as in my case your visitor will still see the standard html tags in their natural font as defined in your StyleSheet. No content will disappear.

Search engines are save. Your headline is still there, will be indexed and your SEO won't suffer at all.

It is style-able. You can style your truetype headlines through Cascading Style Sheets just like you would without Cufón. Set the color, size etc just like you used to.

Cufón is easy. If you're even slightly familiar with JavaScript and CSS, you don't have to learn anything new.

Conclusion

Although Cufón has it's limits it is by far the best solution to the custom font issue on the web today.

Give it a try, I'm convinced you won't be disappointed.

Best of all while stable, Cufón is still in active development so we all can expect improvements and fixed to come up pretty frequently.

The AddThis "Social Bookmarking & Sharing Service" provides the possibility to share my blog to virtually all social bookmark services (currently over 200) with a single (!) button and also has an easy option to send links via email. Similar to ShareThis, AddThis provides me with an analytics-like overview of which articles have been shared when and where. Pretty neat. The documentation on AddThis is better than the one for ShareThis though so I went for the former.

Since with removing the Tweet This plugin the "auto-post to Twitter" option is gone I installed WP To Twitter to compensate for that. In fact WP To Twitter has more options than Tweet This, making things even more flexible for me.

If social bookmarking is a concern for you, check out AddThis and WP To Twitter.

Now was the time to do the transition back to the desktop. I had kept all my mails on the mail server during the whole time, so my inbox would be in sync just by downloading all mails. But I wanted to have access to those mails I had sent as well.

Thunderbird has no inbuilt option to migrate or merge messages from a file into your existing account. Worse, there are no provisions to keep two Thunderbird installations in sync.

Luckily Thunderbird uses the mbox file format to store the mails of a folder such as the Inbox or Sent in a single file. The format is widely used, especially in the *nix world.

With a bit of research I found that I was not the only person with this problem and even better I found the blog by Paul Betts containing an article "Merge Thunderbird / Evolution style (mbox) folders".

Paul wrote a program "mboxmerge" that is capable of merging any number of mbox style files into one, without duplicates and without loosing mails - in my case at least. Using it is as easy as it gets:

mboxmerge.exe Inbox_A Inbox_B > New_Inbox

This will merge the two files Inbox_A and Inbox_B into a new file New_Inbox.

In my case what I did was make a copy of the whole Thunderbird "Mail" folder from both my netbook and my desktop and call mboxmerge like this

mboxmerge.exe Netbook\accountname\Sent Desktop\accountname\Sent > Merged\accountname\Sent

The two "Sent" files got merged into a new one. I then took the newly created Sent file from the "Merged" folder and moved it back into my original Thunderbird folder, overwriting the existing file. Since I had the backup anyways there was no need to keep a copy.

In fact if you'd rename the original Sent file and start Thunderbird you'd see a new mail folder in your account. Easy to fix, but annoying.

All that was left to do is start Thunderbird on my desktop with the merged Sent folder and verify that both the old and the new mails were still present. They were. mboxmerge made my day. Thanks Paul!

After a lot of research I found the "Secure Form Mailer Plugin" by Dagon Design. Many thanks to @lewayotte (blog, website) and @glennansley for the pointers.