One of the less well publicised features of Apple’s iCloud service is Back To My Mac.

This service provides a private IPv6 network which you can use to securely connect all your Mac hosts.

To use BTMM you will need to upgrade all your Macs to OS X Lion and sign them all into the same Apple iCloud account. You will also need your unique BTMM account number.

When you are signed into iCloud you can discover your BTMM account number as follows:

$ dns-sd -E
Looking for recommended registration domains:
Timestamp     Recommended Registration domain
12:07:46.550  Added     (More)               local
12:07:46.550  Added                          icloud.com
                                             - > btmm
                                             - - > members
                                             - - - > 123456789

The final line shows your individual BTMM account number.

For example, if you Computer Name (set in System Preferences > Sharing) is mymac and your BTMM account number is 123456789, then the fully qualified domain name of the host is mymac.123456789.members.btmm.icloud.com.

If you have spaces in your Computer Name then replace them with dashes, e.g. “My Mac” becomes the hostname my-mac.

To test connectivity to your remote host use ping6, e.g.

ping6 mymac.123456789.members.btmm.icloud.com

To list all the SSH enabled hosts on your domain:

dns-sd -B _ssh._tcp

You would SSH into your host using this command:

ssh -2 -6 username@mymac.123456789.members.btmm.icloud.com

Note that you will only be able to communicate with the other hosts on your iCloud private network if the Mac you are using is also signed into the same iCloud account.

You can also use an open SSH connection to access your non-Apple hosts on your internal network by using SSH port forwarding. This tunnels the destination traffic over the BTMM private network via your remote Mac.

For example, if you have a web server running on a host with the IP address 192.168.1.2 then you can use this SSH command to set-up a forwarded port:

ssh -2 -6 -L 8080:192.168.1.2:80 username@mymac.123456789.members.btmm.icloud.com

To access the remote host from your local machine you would go to http://127.0.0.1:8080/

Open a Terminal window and execute these commands:

launchctl unload -D user /Library/LaunchAgents/com.symantec.ev.daemon.plist
sudo killall -m  "Enterprise Vault .*"
sudo rm -f /Library/LaunchAgents/com.symantec.ev.daemon.plist
sudo rm -rf "/Library/PreferencePanes/Enterprise Vault.prefPane"
sudo rm -rf "/Library/Application Support/Symantec Enterprise Vault"
rm -rf "~/Library/Application Support/Symantec Enterprise Vault"

Center Parcs marketed itself as the original “British holiday the weather can’t spoil”, but they are doing a pretty good job of spoiling holidays without the weather.

Consider the pricing matrix above. What could possibly cause the astronomical price hike in that one specific week? It’s the half-term school holidays.

I do expect to have to pay a premium because of the school holidays. 50% would seem acceptable to me, but a 300% price hike? Even Michael O’Leary would find that hard to defend!

I have studied Economics, I know all about supply and demand and differential pricing. The prices above do not seem to be not reflecting a shortage of supply however. There is no “only x remaining” in the middle week, so I can only deduce that the huge cost spike is a deliberate and cynical manipulation of the pricing model to take account of school holidays.

While some families might bite the bullet and succumb to the exorbitant price tag, their stay must be tinged with bitterness at being financially exploited in this way. If you are being ripped-off so badly before you even arrive, what more do they have in store for you while you’re there? It’s not the kind of business that I would like to spend my money with.

Center Parcs certainly doesn’t have a monopoly on this exploitative behaviour. It’s an industry-wide phenomenon which has been allowed to run wild.

The blatant profiteering at the expense of parents and teachers is discrimination on a massive scale. Isn’t it time the UK Government acted on these unfair business practices?

After upgrading to Android 4.0 ‘Ice Cream Sandwich‘ I found that some of my existing apps weren’t working as expected.

On deeper investigation I discovered the culprit. When installed on devices running ICS the apps made HTTP POST requests when they were programmed to be GET requests.

It appears that Google have subtly changed the working of the java.net.HttpURLConnection class – without telling anyone!

The Android package reference documentation has this little gem tucked away in the class overview notes:

HTTP Methods

HttpURLConnection uses the GET method by default. It will use POST if setDoOutput(true) has been called. Other HTTP methods (OPTIONS, HEAD, PUT, DELETE and TRACE) can be used with setRequestMethod(String).

My now non-functional Android apps did indeed call setDoOutput, but in Android releases prior to 4.0 this did not result in the HTTP method being changed from a GET to a POST.

Even explicitly setting setRequestMethod("GET") does not fix the problem. Basically if you don’t want your app to POST, you must not call setDoOutput.

The apps have not changed, there is nothing referencing this change in the API Differences Report, but the behaviour is definitely different in Android 4.0.

Could this be what’s behind the flurry of Android Market app updates for ICS-related fixes?

I previously wrote about a method for creating a super-secure filesystem using Dropbox’s cloud storage.

After updating to Mac OS 10.7.2 “Lion” I struggled to get the MacFusion GUI to work and so I wrote a shell script to automate the mounting and unmounting of the EncFS filesystem.

I also took the opportunity to switch from the now abandoned MacFUSE to Fuse4X, which is a properly maintained fork of MacFUSE started in June 2011.

The install procedure is much simpler than before, you install Fuse4X and EncFS, but instead of using the MacFusion GUI you just call my script instead.

To the instructions!

First download and install Fuse4X and a version of EncFS which uses the Fuse4X APIs. Thanks to Simone Lehmann for providing an EncFS Mac installer at http://www.lisanet.de/?p=128 (also mirrored here).

Next download my encfsadm archive, unzip the contents and copy the encfsadm script to a local folder, e.g. /usr/local/bin

To create a new encrypted volume (stored locally at first to prevent the EncFS key from being synchronised with Dropbox):

encfs ~/Desktop/_Encrypted ~/Documents/_DropSec

Answer ‘yes’ when prompted to create the new folders and choose ‘p’ for pre-configured paranoia mode (256-bit AES encryption). Enter a secure password when prompted and you’re done.

Now the filesystem has been created we can deal with securing the key.

umount ~/Documents/_DropSec
mkdir ~/.keys
mv ~/Desktop/_Encrypted/.encfs6.xml ~/.keys/dropsec.xml

The commands above move your key from the EncFS filesystem into a hidden folder in your (local) home directory

Now move the entire ~/Desktop/_Encrypted folder (minus your key) into your Dropbox:

mv ~/Desktop/_Encrypted ~/Dropbox/

Open the encfsadm script with a text editor and change the variables at the top of the script to match your local configuration.

For ease of use the script stores your EncFS password in your Mac OS login keychain.

To set your password:

encfsadm password

The setup is now complete.

To check the EncFS filesystem:

encfsadm status

To mount the encrypted filesystem:

encfsadm mount

To unmount the encrypted filesystem:

encfsadm unmount

Alternatively call the encfsadm script with no arguments and it will alternate between mounting and unmounting.

If you want to create a simple application to call the encfsadm script then use Mac OS Automator.

Start Automater, choose ‘Application’ and use the ‘Run Shell Script’ action. Provide the path to your script (/usr/local/bin/encfsadm) and save as an application. Drag the app to the Dock and you have a simple and secure one-click EncFS mounter/umounter.

Alternatively you can use the EncFSadm application which I have included in my encfsadm archive.

Wearing team colours won’t help you ride like Lance Armstrong, any more than putting on a Man United shirt helps you score goals like Wayne Rooney.

It doesn’t matter who you are or what shape you are in – Lycra is not flattering.

Try lifting your head and sniffing the air instead of the bum crack of the cyclist in front.

Having a cycle that weighs less than a bag of sugar won’t help you win le Tour de France.

Fitting a bell will not interfere with the delicate balance of your cycle.

Pavements are meant for pedestrians.

The UK road network is designed for motor vehicles. If you’re going to use it, abide by the rules.

You know those mysterious boxes with red, amber & green lights? Those are traffic lights. Yes, they apply to you too.

Ride in single file on narrow or busy roads and when riding round bends – like the Highway Code instructs you to.

Since you don’t pay Road Tax or have third-party insurance, get out of my way and use the cycle lanes provided.

Public urination is just that. Calling it a “nature break” doesn’t make it any less disgusting and unsanitary.

Take a car if you want to get somewhere quickly without dripping and stinking of sweat.

I’ll leave you with some considered words from someone I’d never heard of before, but for whom I now feel a close affinity – ESPN commentator Tony Kornheiser.

The last time I looked, the roads were made for automobiles…We’re going to be dominated as if this was Beijing by hundreds of thousands of bicyclists…They all wear … my God … with the little water bottle in the back and the stupid hats and their shiny shorts. They are the same disgusting poseurs that in the middle of a snowstorm come out with cross-country skiing on your block. Run ‘em down…Let them use the right, I’m okay with that. I don’t take my car and ride on the sidewalk because I understand that’s not for my car… Why do these people think that these roads were built for bicycles? … They dare you to run them down.

The image above is of a jiffy bag that I received in the post this morning.

Being the wary soul that I am, I was immediately suspicious of this package and so inspected it in more detail.

On face value it looks like an official upgrade pack, perhaps from the satellite broadcaster BSkyB? They do occasionally update their viewing cards and so this seemed quite likely.

But on closer inspection I spotted this small-print:

This package contains promotional material from Virgin Media.

I should have guessed as much when I saw that it was addressed to “The Occupier”. This is a well known tactic of Virgin Media to stop their tat being classed as addressed mail and thereby sidestepping the Mailing Preference Service. I’ve never been able to shake off Virgin’s junk mail, I don’t think anyone ever has.

So this package isn’t anything to do with satellite TV at all. It’s yet more pointless unsolicited junk mail from Virgin Media.

A quick bit of web searching and I found a recent Advertising Standards Authority (ASA) Adjudication on Virgin Media Limited.

The conclusion of the adjudication was that Virgin Media had breached two Committee of Advertising Practice codes and that their advert was misleading.

The ASA noted the text “This package contains promotional material from Virgin Media” was considerably smaller than the main copy on the front of the envelope, was at 90 degrees to all the other text on the envelope, and was located far to the right of the envelope under a series of reference numbers.  We considered that the combination of those factors meant it was likely to be overlooked by consumers and that consumers would therefore be unaware that the envelope contained promotional material from Virgin.

We noted Virgin considered the text “Please see inside for Legal Stuff” indicated that the envelope contained promotional material.  However, we considered that that statement was unlikely to be understood by consumers to mean that the mailing was a marketing communication. We considered, for instance, that the placement of that statement, combined with the likelihood that consumers might not have noticed the text which identified that the mailing was from Virgin, could lead consumers to think that the envelope contained legal and other information, and possibly technology, from their satellite TV provider which would result in an upgrade to their existing satellite TV package.

We considered the ad did not make clear that it was a marketing communication, or that it was sent with commercial intent, and concluded that it breached the Code.

The ASA adjudication is dated 2nd November 2011, but I received this package today on 16th November 2011.

It looks like Virgin have subtly altered the layout on the envelope and moved the line about it being promotional material, but this doesn’t make it any less misleading.

A complaint to the ASA has been submitted. Let’s see what happens this time!

In September Google announced their intention to comply with requests from European data protection authorities and offer a method for opting-out of their Google Location Server (GLS).

Peter Fleischer (Google’s Global Privacy Counsel) has today published an update on the European Public Policy Blog and Google have added specific opt-out details on their Maps Help page.

What is GLS? It’s a location service that most Android smart phones use to request your current location. Your smart phone could simply use satellite positioning (GPS) to accurately pin-point your location, but GPS consumes battery and generally only works outside.

Instead of using GPS your smart phone attempts to discover your location by scanning for nearby WiFi access points. It gathers the relative signal strengths, network names and unique network addresses and sends the details to the Google Location Server (GLS) for processing.

The GLS checks its database of WiFi access points and returns an estimate of your location. If your local WiFi access points are known and already in the GLS then it will return a fairly accurate location, almost on a par with GPS, for a fraction of the power.

Google built their WiFi location database while collecting data for Google StreetView and it is constantly updated and augmented by smart phone crowdsourcing. The manner in which Google collected this data has been controversial and Google have been investigated for breaches of interception laws. As a result Google has been forced to offer this opt-out scheme to appease regulators.

So what do you need to do to ensure that your own WiFi access point is not included in the Google Location Server database?

Simply append “_nomap” to the SSID of your WiFi network and Google will remove it from their database the next time a device sends information to the GLS.

It’s undoubtedly an inconvenience to change your WiFi network name and re-associate all your wireless devices, but if this scheme is adopted by all the mapping services (Microsoft, Apple, Skyhook) then it could well be worth it.

The problem stems from the way in which Android creates shortcuts. An Android shortcut is not simply an alias to the application binary, it’s actually an Intent that directly specifies the ComponentName it should run.

It’s not enough to use the same manifest package name and digital certificate when you publish an update to your app.

For any existing shortcuts to carry on working you also need to ensure that the ComponentName is identical, which means making the entry point Intent the same as it was in the previous version.

In short, keep your ACTION_MAIN Intent the same and your app will update cleanly.

In reaction to the criticism Steve Jobs delivered a scathing personal attack on Adobe Flash in an Apple article entitled “Thoughts on Flash“.

Jobs began by saying he “wanted to jot down some of our thoughts on Adobe’s Flash products so that customers and critics may better understand why we do not allow Flash on iPhones, iPods and iPads“.

In his critique Jobs went on to detail six main reasons why Apple was so staunchly against Flash, which I have paraphrased below:

1. Open. Adobe’s Flash products are 100% proprietary. By almost any definition, Flash is a closed system.
2. Full web. Adobe has repeatedly said that Apple mobile devices cannot access “the full web” because 75% of video on the web is in Flash. What they don’t say is that almost all this video is also available in a more modern format, H.264, and viewable on iPhones, iPods and iPads.
3. Reliability, security and performance. Symantec recently highlighted Flash for having one of the worst security records in 2009. We also know first hand that Flash is the number one reason Macs crash.
4. Battery life. H.264 can be decoded in hardware which doubles battery life during video playback.
5. Touch. Flash was designed for PCs using mice, not for touch screens using fingers.
6. Cross platform. We know from painful experience that letting a third party layer of software come between the platform and the developer ultimately results in sub-standard apps and hinders the enhancement and progress of the platform.

Reading Jobs’ article again really highlights his genius for strategic vision.

New open standards created in the mobile era, such as HTML5, will win on mobile devices (and PCs too). Perhaps Adobe should focus more on creating great HTML5 tools for the future, and less on criticizing Apple for leaving the past behind.

Steve Jobs
April, 2010

How prophetic that closing paragraph was in light of Adobe’s announcement just 18 months later to cease development of Flash for mobile devices, and focus on HTML5 instead.

The news of this dramatic Adobe turnaround came in an official blog post from Danny Winokur, VP & General Manager, Interactive Development at Adobe.

Flash to Focus on PC Browsing and Mobile Apps; Adobe to More Aggressively Contribute to HTML5

HTML5 is now universally supported on major mobile devices, in some cases exclusively.  This makes HTML5 the best solution for creating and deploying content in the browser across mobile platforms. We are excited about this, and will continue our work with key players in the HTML community, including Google, Apple, Microsoft and RIM, to drive HTML5 innovation they can use to advance their mobile browsers.

Our future work with Flash on mobile devices will be focused on enabling Flash developers to package native apps with Adobe AIR for all the major app stores.  We will no longer continue to develop Flash Player in the browser to work with new mobile device configurations (chipset, browser, OS version, etc.) following the upcoming release of Flash Player 11.1 for Android and BlackBerry PlayBook.

Although Jobs was undoubtedly correct to back the HTML5 open standard, I have to question whether he was merely a soothsayer or the architect of Flash’s demise. Clearly with no Flash support on Apple’s iOS products there was a massive disincentive for developers to continue using Adobe’s technology.

Either way, Jobs got his way. It’s a shame he never got to see it.

Tethering refers to the practice of sharing your mobile phone’s cellular data connection with external devices connected by Bluetooth or a serial cable. For example, you might activate tethering on an iPhone and use your mobile data on a connected laptop.

Smartphones generally do a very good job of providing transparent tethered data to connected devices (and hiding these from the network!), so it’s not usually possible for the mobile operator to easily identify tethered traffic.

You could perhaps use deep-packet inspection to search out user-agent headers, but this method is not reliable and not scaleable.

When I first started looking into this problem, I came up with the idea of getting the mobile device to make a clear distinction between on-device and tethered data consumption. The ideal identifier to use for this task is the Network Service Access Point Identifier – or NSAPI.

When an application requests a data bearer, the mobile device sends a PDP context activation request to the radio network.

Contained within the PDP context activation request is the NSAPI value. The NSAPI identifies a PDP context within the mobile device and the SGSN. This is necessary because a device may have multiple PDP contexts and application endpoints.

The mobile device usually allocates NSAPI 5 to the first PDP context. The reason for this is that according to the design specs (3GPP TS 24.008), the first five NSAPI values are reserved.

My proposal is to use the previously reserved NSAPI values (0-4) to identify an endpoint that is terminated on an external tethered device.

By using these reserved values the SGSN can distinguish between on-device data and tethered connections. This could be used to apply different network quality of service parameters or even differential billing.

I first proposed this solution in 2002, but it’s going to take widespread industry adoption to make it happen, particularly from the mobile device vendors. But with LTE just around the corner, perhaps this solution is too late?

There was however a technical spanner in the works, which has prevailed in ruining this bonus ever since. The name of this ‘spanner’ is BT FON.

FON is a network of community hotspots, which in the UK is mostly made up of BT Total Broadband customers. As a BT customer you can opt-in to sharing your broadband bandwidth with other FON members. In return you have access to any BT FON community hotspot that you come across.

It’s actually quite a neat idea, but the launch of this service introduced a big problem for iPhone customers trying to use the BT Openzone premier hotspots.

For reasons best known to themselves, when BT set up a BT FON community hotspot they also make it act like a BT Openzone hotspot. This is fine if you’re a BT FON member as you can roam onto either of these networks, but if you’re a subscriber of BT Openzone through a partner like O2 then you only have access to the BT Openzone premier hotspots.

Most smartphones remember known WiFi networks and will automatically associate with them when they are in range. The only way they have of differentiating between networks is the network name – or SSID.

If you save the “BT Openzone” SSID on your smartphone then it will attempt to use a WiFi hotspot that broadcasts that name whenever it’s in range. This allows the device to seamlessly move between WiFi access points and cellular data without having to ask you each time.

The problem for O2 customers is that when have registered with BT Openzone and saved it as a known network, your smartphone will blindly associate with any hotspot which claims to be “BT Openzone”. This includes the BT FON hotspots for which you don’t have access!

When this happens your smartphone effectively goes offline and apps which rely on a data connection stop working until you move out of range. The only remedy for this is to remove BT Openzone from the known networks list, which is an inconvenience and negates the benefits of a BT Openzone subscription.

Now finally it seems that BT are addressing the problem. They are hastily updating residential home hubs and changing the broadcast SSID from “BT Openzone” to “BT Openzone-H”.

Thank you BT. It’s only taken you 4 years to sort this mess out.