Archive for the ‘New Zealand’ Category

NoCowboys security failure [updated x2] [fixed]

Friday, October 19th, 2012

  A few months ago while looking for an arborist my wife listed the job on NoCowboys.co.nz, a New Zealand website for finding and rating businesses. Because of the way jobs are manually checked before appearing on the site there is a delay after submitting before you can tell if it worked. While I was trying to work out why the job hadn’t appeared on the site yet I happened upon a gaping hole in their security which enabled me to edit any other job on the site as well as see all the correspondence between clients and businesses. Most of the correspondence is either the client giving their address or the businesses providing a quote. Obviously giving out an address is not great, but the quote can be harmful too. While I couldn’t change what the quotes were, I’m sure businesses would find it useful to know what the competing quotes were before providing their own one. It’s also possible to reply on behalf of the job-lister, and thus turn down quotes to ensure yours was the only one that got through. But this is only half of the site. The other half is being a business. If they have the same lack of security on that side then it will be trivial to edit the quotes from your competitors and destroy their reputation by adding a few swear words here and there. I haven’t been able to verify if such edits are possible because it costs $299NZD to register and I’m not paying for the privilege of checking their security any more than I already have. Still, I’m prepared to assume that if it is the same developer across the site they’ll have made the same basic mistake everywhere.

; ; ;Before I explain what this mistake is I should point out that I emailed NoCowboys about this in July, and again in October. I told them exactly how to perform the hack and suggested the cause and a fix. I have heard nothing from them and they haven’t fixed it. Hopefully by putting this in the public domain they’ll take more notice. Who knows, maybe we’ll see a listing under their Computer and IT Security section.

; ; ;So finally, what is this hole then? It’s simple, staggeringly simple. You need to register first and then login. If you had listed a job you could go to the edit page, or use this URL as an example: http://www.nocowboys.co.nz/jobs/myjobs/XXXX/overview-v2 except instead of XXXX you’d have a job number. All you need to do is change the job number to the one you want to spy on and you’ll have full write-access to that job. The only security check they do is that *someone* is logged in, they don’t check who is logged in. Authentication but not authorisation.

Update : Oct 20th

It gets worse. The whole point of NoCowboys is to see opinions and ratings from other customers of the business you’re looking at to decide if you want to use them. So it’s not good that businesses can edit any review on the site. All a business needs to do is use this URL as an example and fill in the review number they’d like to edit. http://www.nocowboys.co.nz/edit-my-rating/XXXX.

Update 2

NoCowboys have contacted me and are working on a fix. Apparently the contact email address wasn’t working so this was the first they heard of it :/

Update 3: Oct 21stNoCowboys have fixed the problems. That was pretty quick from when they first read my messages. If it hadn’t been for the faulty feedback form on their site they would have had enough time to fix it in private and the world would never have known.

My take on the smoke-free ad debacle

Tuesday, February 7th, 2012

See the update at the end of the article

By now most people in New Zealand are probably aware of the Health Sponsorship Council’s decision to edit their “Smoking not our future” ad, or as the New Zealand Herald put it “Piri Weepu’s baby bottle advert ban” (for further reading check the links at the bottom). Though the article did say that breastfeeding support group La Leche League‘s opinion was canvassed (among others) it also incorrectly attributed an email campaign to them and left the general populace with the incorrect assumptions that LLL were butting in where they weren’t welcome, had started a campaign and banned the advert. In reality they merely provided feedback when asked that resulted in 2 seconds of film being removed while still maintaining the message of positive male parenting through a smoke free environment. The 2 second clip featured Piri Weepu, a hugely popular All Black after his incredible kicking efforts during Rugby World Cup 2011, bottle feeding his daughter. The Ministry of Health is actively trying to increase New Zealand’s low breastfeeding rate so the feedback from all the groups was to remove the clip and thus try to prevent undermining an important government funded health campaign. There was never any comment that Piri and his partner should be breastfeeding, there was no criticism of them at all, only that the images this ad may have contained would work against other ads. But alas this was lost in translation into eye catching headlines. On most Herald articles there is link to send a link out via Twitter and a link to see who had already done so. Today I followed that link and immediately saw someone who had got the wrong end of the stick and thought I could perhaps correct them. It didn’t work, and I got labelled a troll, spam and an ass for trying to stand up for reality. Here is the transcript of the back and forth with @kchawkings:

KH: Hell to the yes! Go Piri! “They are my kids, I’m not going to have anyone tell me how to raise me kids.” http://nzh.tw/10783857 via @nzherald

CS: @KCHawking ….said the man in the how to raise your kids advert to the people not telling him anything about raising his kids.

KH: @craigstanton dude, do you have nothing better to do than hunt down every mention of that article on twitter?

CS: @KCHawkings @NZHerarld linked to all the tweets at the top of article, I’m just doing what I can to correct a massive misunderstanding.

KH: @craigstanton And again I ask: Do you have nothing better to do? @NZHerarld

CS: @KCHawkings Do you have nothing better to do that comment on the article to start with? Maybe spend some time looking into the facts first.

KH: @craigstanton I commented because I support Piri being a great role model for fathers everywhere. Did they not stop to think that the benefits of the images would outweigh the negatives? That’s not to mention the numerous reasons a baby may not be able to drink from the breast. A fair amount of the people who follow me subscribe to the same beliefs, judging by the positive response I’ve received. As far as I’m concerned there is nothing wrong with Piri bottle feeding his daughter, and in my opinion it’s PC bullshit gone mad. It should never have been an issue in the first place. Now get off your high horse and go SPAM someone else, because that’s all your tweets are: Short Pointless Annoying Messages.

CS: @KCHawkings The benefits existed in all the other shots in that ad. They made no comment at all about whether or not he should bottle feed. I made that comment in support of a wonderful volunteer organisation who were asked and gave their opinion.

KH: Come on Kate, there’s no need to feed the trolls. Just because some guy is being an ass doesn’t mean you need to reply. Just block him.

CS: @KCHawkings I’m not being an ass, read what really happened, you’re dumping on a great bunch of people because the NZHerald misinformed you

There seemed no hope of getting the message across that LLL had not told Piri or any other parent what to do within the confines of Twitter, so as a last ditch attempt I have emailed her directly and await a reply, though I honestly don’t expect one.

I’m sorry if I came across as an ass to you, that was never my intention. Nor to troll nor spam. If you’re willing to hear what I have to say about how the NZHerald has twisted what happened then please read on. If you’re already reaching for the delete key then you can at least be sure that I won’t try to contact you again.

I’m glad you’re still reading. I read the Herald article and saw the link to tweets that mentioned it so I went to see what people thought. I was really surprised at how many people thought that the breastfeeding group, particularly La Leche League had criticized Piri in some way. They definitely didn’t. They have no knowledge of his situation and even then I’ve never known them to criticize people for their choices, they just provide support for people who have made the choice to breastfeed. Despite the headlines of “ban” and “protest” etc etc what actually happened was very simple. The Health Sponsorshop Council made an ad to promote the non-smoking message. They consulted with multiple breastfeeding groups and received the same feedback from all, that the bottle feeding scene would go against another government funded health message trying to make breastfeeding more acceptable. It was not an attempt to degrade the value of bottle feeding, they have been very clear on that. The HSC edited out 2 seconds of footage from the ad and maintained their message that a loving, caring dad looks after his children in a non-smoking environment, with absolutely no comment on how he chooses to feed them. If it ended there the ad would have gone to air and no-one would have any anything to worry about. But then the Herald ran a piece that many people misunderstood to mean that these groups wanted the whole ad banned, and that they were having a go at Piri when then really weren’t.

So why do I care? Well I know a lot of people involved with one of the groups that were asked for feedback. They are wonderful mums giving so much time to a volunteer organisation that is saddens me to see so many people calling them names like Nazis and Breastapo. Some of them even bottle feed their children, but are still on hand to offer advice on breastfeeding when it is sought. They were simple asked their opinion and gave it, then New Zealand replied with an outpouring of hate. It was a matter of keeping New Zealand health messages on target and not contradicting each other. Akin to making sure no-one in a sober driving ad is smoking. Your tweet seemed be based on what I thought would be a simple to correct misunderstanding about what the groups said (or in fact didn’t say) about Piri’s parenting. I had hoped that if I could point you towards the facts of the case you might see that you were mislead and that there would be one less voice denigrating the work these ladies do.

With all that said I really am sorry if you felt harassed on Twitter, or if this email is too much. Your website has a Contact Me button so I figured you’d be open to listening to random strangers from the internet. I won’t bother you again.

Sincerely,

Craig, proud father to be, T minus 10.5 weeks and counting :-)

Further reading:

NZ Herald feedback page

La Leche League’s press release about the ad

La Leche League FAQ about supplementing milk supply, note there is no judgement in the words “…recommending a specific infant formula is beyond the scope of La Leche League. Please consult with your health care provider.”

Health Sponsorship Council’s response to the Positive Men group on Facebook when asked to reinstate the footage

Thank you for your interest in the Smoking Not Our Future ad.

As part of a standard post-production process we identified the (two-second) bottle-feeding shot as one for possible re-editing two weeks ago. As a result we asked for comment from La Leche League NZ and Plunket NZ. After receiving feedback a decision was made last Wednesday (1 February) to replace the shot with one that continues to show Piri in his role as a loving father, providing a smokefree home and car for his whanau.

The advert will go to air Sunday 12 February as planned.

Thanks

Update Sept 6th: 2012

The Press Council has upheld a complaint by La Leche League about the NZHerald’s coverage of the story. A few important points are:

  • The League did not mention Piri Weepu or comment on his fathering skills.
  • The Council notes that the newspaper is now willing to make a correction, but the claim as published was a serious one, it did cast a slur on La Leche, and the Council finds no evidence that the League called Weepu’s role as a dad into question.
  • That this was not the image at the centre of the controversy should have been made clear to readers.
  • It did seem to the Council that at times the La Leche League was being pilloried for things they did not say or believe.
  • The Council does not believe that the use of the word censorship is warranted. The League made a suggestion, the HSC considered the suggestion and willingly removed the image from their own advertisement. This is not censorship.

Unfortunately the Herald was not so keen on publishing the correction. Relegating it to page 34 and not putting it front and center like they did with their original inflammatory articles. So, Miss Hawkings, if you’d like to apologize the door is wide open.

Otago Tandem Rail Trail

Sunday, April 24th, 2011

A week ago Tania and I rode the Otago Central Rail Trail, and since it was a first proper holiday since our wedding 3+ months ago I think it counts as a honeymoon. The rail trail is 150km of old railway track that has been converted for use by bicycles and pedestrians. Because it was built for trains it never gets steeper than 1:50 and that’s quite achievable on a bike. We opted to work together on the long inclines and thus on Monday morning my aunt Janice drove us to Clyde and Altitude Adventures dropped off our rented tandem.

We’ve rented a tandem before and found it was a lot of fun. That time we were riding around a beach suburb in San Diego having to deal with pedestrians, “side walks” and occasionally traffic. This time was lot simpler. Most of the people we saw were heading our way and only one was on foot. Much like the PCT when everyone is on a trail with the same goal and similar traveling style there’s an easy camaraderie between strangers. We all have to deal with the same hills and are all getting sore bottoms (though some to a greater degree, do hardly riding a bike more than 5km for the last 15 years).

We were very lucky with the weather in what has been an unusually wet season. The fields were much greener than normal but we were late enough that the trees has started to change and it wasn’t the still dry air that can sit over the Canterbury plains. I’ve put a selection of photos in a MobileMe gallery page, but you really have to experience in person. I’ll gladly do it again and definitely encourage more people to go by tandem. It’s just so nice to have your other half within arms reach the entire time, a very sweet way to spend a few days in New Zealand.

Google Street View Trikes in NZ [updated]

Monday, April 19th, 2010

Back in January Google announced that the trikes, which shoot footage for Google Street View where the cars can’t go, were about to start roaming the outback in search of interesting off-road places. They started at Taronga Zoo and held a public vote to choose the rest. Well that’s all fantastic if you’re interested in seeing Australia. And thousands millions of people are. But I happen to think that New Zealand has some pretty awesome things to show off too so I’m starting a list of places that the trikes should visit when they come here.

1: Otago Rail Trail

The most obvious starting point. 150kms of trail graded gently enough for the trains of yesteryear. The trail might be a bit rutted and bumpy so I hope they’ve given those trikes some good suspension to protect the equipment as well as the rider.

2: Wai-o-tapu

It’s an amazing “thermal wonderland” not far south of Rotorua and though it looks really good from the sky you really need to get in amongst it to show off some of New Zealand’s famous geothermal features.

3: The Luge

Whilst they’re down in Rotorua they should definitely pay a visit to The Luge. It’s a set of paved downhill tracks each as wide as a single lane road over looking the city. But don’t spend anytime looking down there because you need to pay attention to the corners and other riders as you hurtle down the hill on your three wheeled carts. This is my favourite man-made tourist attraction in NZ by far, and features in any good road trip. There’s one in Auckland too but you can see most of it from the motorway and it doesn’t look half as exciting as the Rotorua one.

4: Rangitoto Island

The jewel of the Hauraki Gulf is a volcano with a few unsealed roads. Right now they are only used by the D.O.C. workers and the pull-along tourist tractor that takes those that can’t walk to the summit. The last 100m or so is on wooden steps that the trike couldn’t traverse so they’ll need to carry it. Which should get them in good practice for…

5: The Tongariro Crossing

One of the world’s best day hikes, and there in lies the problem. If Google can get the Street View equipment down to a size where two people can carry it I’d gladly be one of the sherpas.

6: Viaduct Harbour

Often touted as ‘party’ central for things like The America’s Cup, the Rugby World Cup and really any event that Auckland hosts. I made a Real Place for it a while ago but I think it could do with the Street View treatment, ideally on a day when some really interesting big yachts are in.

7: Rainbow’s End

New Zealand’s biggest theme park may not stack up against the some of the ones in the recent UK update but that doesn’t stop it being the best one we’ve got. As you can see on the map there’s enough space to be worth exploring and I reckon putting the trikes on the race track would be fun too. If only they could make a splash-proof version for the log flume :-).

Any other suggestions?

Update

GEarthBlog.com has some speculation that StreetView might be heading indoors. If this is true then I’d add Te Papa, New Zealand’s national museum to the list of places to document. I think GEarthBlog’s idea is more of documenting the collections in proper posed photo shoots rather than riding a trike down the halls, but I like the idea of riding around the museum late at night when all the other visitors have gone home.