Has buffer protection become second-nature?

I took a break from the physics recently to have a crack at the challenge that is now known to have been posted by GCHQ at http://canyoucrackit.co.uk. And it was really rather fun, once I got into it. My day job as a developer these days is almost exclusively based around the sort of high-level languages that almost seem divorced from the machine-code that they ultimately represent, so “getting my hands dirty” with assembly language and stack pointers was refreshing, if something of a busman’s holiday. A couple of nights ago I reached the end, and while the jobs being advertised weren’t of interest (wrong country, wrong pay-grade), it was still rather satisfying, if lacking in cake.

[Mild spoiler alert; I’ll try to avoid giving away anything too major, but some hints might be dropped.]

But having completed the challenge, and knowing that I’d almost certainly done much of it the “hard” way (for which, read blindly fumbling while flailing maniacally), I thought it would be instructive to peruse some of the solutions and walkthroughs that others have been posting lately. Indeed having not studied much cryptography at all, I hadn’t been aware that one of the stages was actually working through the RC4 algorithm to encrypt/decrypt that stage’s payload. As far as I could tell, it was a black box, turning gibberish into something slightly less gibberish. One of the stages required us to implement a simple virtual machine code in order to make sense of a data-dump, and it was interesting to compare my implementation (knocked together quite inexpertly in JavaScript: if anyone asks, I can see if I can still dig it out) with others written in C and Python for example.

The final part of the puzzle involved downloading an .exe file, and reverse-engineering it to figure out how to feed it a suitable “license” file to produce a URL that leads to the passphrase for the challenge page. And here I noticed something I thought quite interesting from reading other people’s solutions. It turns out from a brief inspection of the executable that it depends on the Cygwin “crypt” library, and what is quite clearly a hashed password appears in the file’s data block. So cracking that hash will give us something we can use somehow within the license file; examining the assembly code will clarify the “somehow” part. The code for loading the license file into memory turns out to be pretty straightforward, so what I did was to grab a password cracker (I used John the Ripper) and let it spin for a few hours. Eventually the password dropped into the vending slot, and I was good to go (once a few more details were cleared up).

And from what I’ve read, that seemed to have be most folks’ solution. A few noted in passing that one of the instructions in the code had a potential buffer-overflow problem, but no-one seemed to care. However, on one blog (containing videos explaining solutions for all parts), the author (who had commented on the buffer problem) noted that GCHQ subsequently contacted him to say that they were aware of the vulnerability, and that indeed it was deliberately placed there to allow people to skip the password hash check.

Well I’ll admit I felt kind of silly at this point. As soon as I read that, it not only became obvious how I could’ve avoided a few hours of password-grinding, but indeed it went some way to explaining the slightly quirky way in which the check was being performed by the code: it was laid out that way in order to make it easier to exploit the buffer overflow to get the desired result. But what I found really interesting was the fact that clearly a number of people spotted the dodgy code, but it didn’t occur to them to use it as part of a code-breaking and “hacking” challenge!

Of course this is all merely anecdotal, but it made me wonder whether, for some people at least, the security message might be sinking in—when unsafe code is so immediately recognisable to a developer that their inner alarm bells sound before they’ve even had time to process what’s wrong, perhaps we’re finally starting to outgrow the bad habits that the pre-Internet innocence fostered. Buffer overflows aren’t a major issue for the kinds of development we do at my current job, but if I could install a nervous tic in any developer who comes to work for us, at the merest hint of unsafe SQL parameter passing (there is no excuse), I’d like to think it would make the world just a little better.

At the same time, though, the message is only any use if people remember why it was written in the first place. Taking part in challenges such as this, or the various educational hacking sites (such as http://hackthissite.org) I think helps developers stay in touch with the reasons behind some of the do’s and don’ts of secure coding.

Why Derren Brown’s “Assassin” made me uncomfortable

I recently watched the first of Derren Brown’s “Experiments” series, “Assassin”. In it, Derren proposed to find out whether it would be possible to use hypnotic suggestion to “program” a complete stranger to carry out the assassination of a well-known figure yet retain no memory of having done so. The remainder of this post contains spoilers, so read no further if you don’t wish to find out what happened.

Now you might think that the reason this made me uncomfortable was the notion that Derren (or anyone else, for that matter) could, if he so desired, cause a person to commit murder at his bidding. And indeed, such a prospect—if true—would be extremely disturbing. But what troubled me about the program was that it seemed to me that Derren was crossing a line that I believe he has previously been quite careful to avoid, and that he chose to do so in a manner that has the potential to cause trouble.

The program started off in a manner similar to some of his previous shows; a small pre-recorded stint with an intimate audience, demonstrating some “parlour tricks” of the sort typical of a stage hypnotism show. He tells the audience that he will be assessing their susceptibility to hypnotism, and narrowing down to one individual to take part in an unexplained experiment. The audience at home, of course, know what the so-called experiment will be about.

Having selected his preferred candidate (and verified, through a stunt with an ice-bath, that he lies in the “top 1%” of hypnotic subjects, as required), the rest of the show follows this candidate being taken through a variety of tests of hypnotic suggestion. The subject is not told what the intended goal of these tests is—a day at a shooting-range is spun as a test to see whether his “focus” could be improved via hypnotic suggestion, etc. Viewers, meanwhile, are told how each “test” builds up to the programming required to turn a everyday citizen into a cold-blooded killer.

Finally, with all of the program in place, he is brought to a live seminar on language by Stephen Fry. A lady in a polka-dot dress gives him his audio and visual cues, and after a pause (for effect?) he reaches into a case, withdraws a pistol, and fires three rounds at Fry. Afterwards, he is asked if he has any recollection of the event; of course he has none, until the video is played back to him. Stephen Fry (who was “in on it”, and had worn blood-packs to pop in time with the shots) was sitting in for the replay, and appeared flabbergasted at the seemingly genuine confusion of the would-be killer.

But the question, and where I take issue, is this: was it real? This seems an odd thing to ask of what was, after all, an entertainment program, but it is a subject about which Derren Brown tends to be quite unequivocal. He often prefixes his shows with the disclaimer that what you will see is a combination of “magic, suggestion, psychology, misdirection and showmanship.” There was no such statement attached to this program, and none of the supporting website information made any attempt to clarify this. So was this, as publicised, an experiment, or was it just another grand illusion?

Now I must admit that while I have always been a great fan of stage magic, I tend to be left a little cold by mentalism, so I can’t claim to be a huge fan of Derren’s effects. The closest I can come to explaining why would be to say that my instinctive thought on seeing a magic trick being performed is to wonder “how could that possibly have been done?” And unfortunately, for many feats of mentalism, the default answer—a stooge—readily comes to mind. Never mind whether or not a stooge actually was involved (and I’m not saying one was in this show), the fact that one could in theory explain the effect takes the wonderment out of it for me.

However, there’s no denying that he is a superb showman, and I think his greatest trick is that, despite routinely telling his audience that he intends to employ misdirection and showmanship, he seems to have them believing every word he says.

[As an aside: one thing that endlessly fascinates me is the number of those who argue that none of Derren’s effects make use of stooges, because his programs almost always carry a subtitle explaining that there were no stooges involved. When did we start believing what magicians tell us?]

So by labelling this show as an “experiment”, and making none of his usual disclaimers, I think he is in danger of blurring the line between misdirection and misrepresentation.

Of course this is assuming that the show was an illusion. On balance—and let me stress that this is purely the opinion of one with no expertise in the subject whatsoever—I believe it was such, based in part on the following:

1. It is my understanding, and the opinion stated by some academics present at the pre-recorded selection phase, that programming a subject to perform an act as out-of-character as to kill without reason has been shown to be beyond the scope of hypnotic suggestion.
2. The entire show seemed to pan out a little too neatly; finding a suitable candidate, Derren repeatedly remarking that his subject was progressing better than he’d hoped, the final shooting showing the subject “pausing” far longer than ever before as each of his “triggers” were activated; all seemed to smell somewhat of dramatic licence.
3. The mere fact that the experiment, which, if real, would seem to raise some serious concerns regarding criminal law, was performed in the context of a Friday night entertainment show suggests to me that Derren himself is not taking the “experiment” too seriously.

As it was, however, not only was it never suggested that the show was anything less than 100% factual, one of the major themes of the show was the claim of Sirhan Sirhan—who shot Robert Kennedy—that he was acting under precisely this sort of hypnotic suggestion. Already, I have seen Internet discussions involving people who are convinced that, because the format of this show was different to his previous events (regarding the usual disclaimers), it must have been real. Perhaps this view can be forgiven when we note that alongside Derren Brown’s grand illusions, he has also made a number of television shows exposing fake mediums and psychics, who, he feels, are exploiting vulnerable people by claiming to have powers they do not. Could a show, falsely claiming to prove that conspiracy theorists and a convicted murderer could, in fact, be correct, not be classified as exploitation? It’s a fine line, but for me it’s too close for comfort.

As for the possibility that the show was, in fact, entirely kosher, I’m not sure I’m any more comfortable. As suggested above, if Derren really thought such a thing might be possible, why on Earth would he choose to present it as a piece of throwaway television? Is it not serious enough to warrant controlled scientific research? I would imagine Sirhan Sirhan might well wonder the same. And what of the polygraph test taken by the subject after a dry(ish)-run with a water-pistol (pun intended)? The man conducting the test (I don’t recall his name, but he was billed as the first professional polygraph operator in the UK) was filmed saying that as far as he was concerned, the subject genuinely believed that he had not done what we had seen him do, and that he would testify as much if asked. If that was genuine, does it not raise concerns regarding the admissibility of polygraph evidence? Of course, if this were all illusion, we have no idea when this polygraph was actually administered…

I don’t want to spoil a magic act for anyone, but the point at which performers suggest that what they are doing is anything beyond legerdemain, it’s my opinion that they risk fuelling some dangerous beliefs, and to be honest, I don’t see the point; people will continue to be astonished by magic even when they know it’s not “real”.

Bruce Willis Is A Ghost

There’s a certain kind of film (or, more generally, story) that I’m a complete sucker for. It’s the sort that, right near the end, the storyteller reveals that one little fact that brings the whole story together; completely changing your perspective on all that had come before, and subjecting audiences to a brief and frantic moment of replaying the whole film/book in their head, figuring out what it all means. You all know the sort I mean: The Sting; The Usual Suspects; Memento and so on. Or to take a book, you can’t do a much better job than Douglas Adams managed with Dirk Gently’s Holistic Detective Agency, in which he plays the ultimate trick on the reader by filling the book with the kinds of amusing yet incidental sidetracks that we have come to expect from his work, then in the closing chapter pulls off the sheet and reveals not only the solution to the overall mystery, but how pretty much every one of these asides was a vital piece of the puzzle. In one chapter we go from an entertaining but fragmented collection of events to suddenly seeing how it all fits together when the final piece is found. And I love it.

With that in mind, I want you to consider a long film. Really long. Peter Jackson long, and then some. Specifically, a little over 34 years long (and counting). The main protagonist, we shall call him Bob, has arrived where he has via a certain sequence of events. Being neither famous, infamous or otherwise remarkable (aside from being dashedly handsome and an all-round Good Egg), his particular sequence could be argued to be reasonably typical; a collection of occasionally entertaining, but largely unconnected happenings. There is a token love interest to keep the focus groups happy (though such comments may prove painful very shortly).

It’s in this 35th year that, with the audience running low on overpriced popcorn and watered-down drinks, the screenwriter has decided it’s time to reveal the “twist”. About three months ago, based on some fairly inconsequential incident in the ongoing anxiety plot-device, I did some online research, and resolved to ask my GP for a psychiatric referral to discuss the possibility that I have Asperger’s syndrome. Today, that process has reached the conclusion that I do, albeit at the mild end of the spectrum.

For those that don’t know, Asperger’s syndrome is itself considered to be part of the autism spectrum; in fact the line between Asperger’s and high-functioning autism is blurred at best. It is chiefly associated with a certain degree of difficulty in social interaction, and generally presents in childhood, leading to difficulties “fitting in” with other children. This often leads (in adult life) to susceptibility to depression and/or anxiety, particularly in social contexts. People who know of my anxiety problems will no doubt figure out that this was what led me to look into this as a possible source.

Where this all gets interesting, and why I subjected you to the introductory spiel is in the number of “secondary” indicators that, in hindsight, could perhaps bring whole areas of my life to this point under the one umbrella. For example, there are often signs of physical clumsiness; either at the whole body level, or in fine motor control. Bad handwriting is common. Slow, monotonic and pedantic speech patterns, along with a tendency to focus on particular points too far also; not to mention going off at peculiar tangents and returning to previous topics at a whim. Sound like anyone you know? Sticking to daily routines, and pursuing specific interests or “projects” almost obsessively; tending to value “alone” time (say, watching crappy television until all-hours in your girlfriend’s flat) are all typical, all me. Hell even the speech therapy sessions I needed as a kid may be related (we learn to speak by mimicking others around us). There’s more, but I won’t bore you further with it. Suffice to say that almost every recollection I have from childhood upwards straightforwardly makes more sense when put in an Asperger’s light.

So given the diagnosis, what changes? Not much, to be honest. There’s no “cure”, nor any treatment (beyond the pretty little pills I take for the moment to control the anxiety). It’s just part of the package that is me. Having the diagnosis helps me understand how I am where I am; ties up old issues from my rarely-missed school days, and with luck may provide guidance on dealing with the anxiety and other issues.

That said, there’s a good reason I put the word “cure” in quotes. It is argued by some—and I happen to agree—that it is inappropriate to describe Asperger’s syndrome as a universally Bad Thing. Along with the undoubtedly negative aspects associated with the syndrome come a number of characteristics that I wouldn’t give up for the world (and here you will have to forgive me for abandoning my normally impeccable modesty). Asperger’s “sufferers” are typically above average intelligence, and tend to excel in maths and science (indeed one of the tests I did results in a numerical value indicating the degree to which you fit the profile; about a third of the way between “normal” and “mild Asperger’s” is marked “Average computer scientist”). The “obsessive interests” mentioned above can equally be marketed as “highly focussed”, and tends to be coupled with attention to detail. A strong sense of morals and ethics is not unusual, and while social interaction is difficult when growing up, social rules can be “learned”, making it easier to act objectively in difficult circumstances later in life.

So in essence I will continue to be me. Nobody should feel the need to treat me differently—indeed that would be the worst way to deal with it—I’d just ask people not to be offended should you find me behaving like… well… me. And feel free to ask if there’s anything you want to know about. I make it a point to be as open and honest as possible about my mental health, as I’m buggered if I’m going to let it be something to be ashamed of.

Inception for geeks

There are times when a geek should do their best to fit into normal society; to rein in the inner nerd, and resist the urge to commit atrocities against traditional sensibilities. But this isn’t one of them, and so I present the (99% spoiler-free) programmer’s guide to Inception.

class Inception implements ChrisNolanFilm {
  void plot() {
    try {
      Idea.write();
    } catch (RuntimeInception ri) {
      ri.printStackTrace();
    }
  }
}

Sorry. First tweeted here.

iPhone 4 versus duct tape

There has been an awful lot of talk lately about the iPhone 4’s antenna troubles. And indeed, from having used one for a few weeks, it does indeed behave badly if held in a particular manner in a weak signal area. But one rumour has been following this story around like a bad smell—the legendary Duct Tape “Solution”.

It seems obvious enough—two antennae next to each other, separated by an insulated gap; fine until you “bridge” the gap by having your hand in contact with both sides, causing a short-circuit. Hey presto: no signal. So a small square of insulating tape over the gap, and problem solved! Alas, no.

Most people have heard of a capacitor, though perhaps don’t know what one is or does. Quite simply, it is two conductive “plates” separated by a thin dielectric, or insulating, layer. So an antenna with a layer of tape being held by a person such that an area of skin is in contact with the tape is basically a large capacitor. When a voltage is applied across a capacitor, charge builds up on the two conducting plates over time. As the charge builds up, the capacitor starts to resist more and more current from flowing, eventually stopping the flow altogether. The amount of charge that can accumulate is called the capacitance, and this varies directly with the area of the conducting plates (area of hand covering antenna), and inversely with the thickness of the dielectric layer (tape).

In an alternating, or oscillating, current, both the voltage across a component and the current flowing through it resemble a sine-wave. If you divide the amplitude (height) of the voltage wave by the amplitude of the current wave across a component, you get a number that is called the impedance of the component. Note the similarity with the resistance of a component in a DC circuit, which you might recall from school is equal to the (constant) voltage divided by the (also constant) current. The impedance of a component in an alternating current is essentially how much it… well… impedes the flow of current.

What this is leading up to is the fact that, across a capacitor in an alternating current, the impedance varies inversely with both the capacitance and the alternating frequency of the signal, which for mobile phone radio waves is pretty high—around 400-1800 Mhz. So the impedance of a piece of tape separating a radio antenna and your hand is negligible. You may as well be touching the antenna directly.

Roughly speaking, in an alternating current, rather than charge flowing round a circuit, it oscillates back and forth. With a capacitor in the way, charge builds up on the plates just as in a DC circuit, but at high frequencies, it turns round and goes the other way too fast for enough charge to build up on the plates to impact the current.

The good news for people whose phones work with a bit of duct tape on the antenna is that your phone works without it too. Trust me. The bad news is that if you have gone around saying your phone is unusable without tape, then you are fooling yourself. And the really bad news for people who have published damning reviews of the iPhone 4 while suggesting that duct tape will fix it, is that you are lying to your readers. Plain as. This is not to say that the phone doesn’t have an antenna problem—it does—but if you say your tests showed improvement with duct tape, you cast serious doubt on the validity of your tests.

As for solutions, well, with a bumper, or other case, you are increasing the thickness of the dielectric layer in the “capacitor” between your hand and the antenna, dropping the capacitance way down, and to the point that its impedance is too great to cause the antenna detuning issue, even at radio frequencies. You can also minimise the capacitance by altering your grasp of the phone—lower the contact area and you lower the capacitance. So Apple’s well-published suggestions “not to hold it that way” or “use a case” are scientifically the best ways to reduce the problem. But as many have pointed out, a phone for which the natural grip is the wrong one (all phones have bad areas, most aren’t right where you want to put your hand), or for which you need to spend additional cash to get a decent performance is a poorly designed phone. Apple should really address this somehow; right now it seems that the best course would be the free case, and iPhone users putting up with the fact that our phones are awesome at pretty much everything… except being phones. Or return it, of couse.

If you read the rest of my blog here you will see that I am but an amateur physicist, so it’s fair to say I could have this wrong. But the level of physics in this material is not particularly high, and since there’s no real way that I can be setting up experiments in the areas I’m currently studying, I jumped at the chance to test this theory out for myself. And while the results were more qualitative than quantitative (since I lack the means), I have tested duct tape, electrical tape, Sellotape and the plastic overlays that came off the phone when I unboxed it. No difference was noticeable with any of these materials entirely covering the parts of the antenna that were in contact with my hand. If you want a more credible source for these findings, there are a number of posts worth reading at www.antennasys.com/antennasys-blog.

Ain’t science a bitch?

Update: thanks to the nice folk at Anandtech, it seems I’m right and wrong. High impedance tape does exist, and can be applied to the phone. Even with such tape, the impedance is not enough to completely isolate you from the antenna, though perhaps it could do so enough to bring the phone into line with others. I would guess the tape must be made from a material with an impressively low dielectric constant; I still believe that the DIY fixes involving bog-standard tape are spurious, and if you want the best performance in a weak signal, a case would be a good idea. But it’s nice to think that there is a potential solution out there—also nice to know I was on the right tracks.

My brain hurts.

Currently reading some results regarding complex numbers, the proof of which involves a radius term , euler’s notation , and the splitting of a complex number . So finding terms like and even is doing my nut. This is in a printed book too, so it’s not a bad e-book translation error.

On the other hand, posting this did teach me how to define roman-style functions in without \operatorname (which WordPress doesn’t support on their hosted blogs). If anyone cares, it’s \mathop{\mathrm{Op}}.

Eep!

OK, so this blog is nominally about physics and associated topics, but…

Having watched Doctor Who this evening, and tolerating no spoilers whatsoever, Steven Moffat is an arsing genius and I love him to bits.  That is all.

Deviating standards: epilogue

A subtle variant of the “inconsistencies” in the last post can arise where a concept is introduced and used in a simplified form, which can catch you unawares in more general settings.  For example (and while I’m trying to keep these posts agnostic of any particular field, it’s hard to describe this without example; but don’t worry if the details aren’t clear, it’s the idea that matters):

A vector space has associated with it a scalar field.  The most obvious one is the field of real numbers; they are also commonly associated with complex numbers.  Given a vector space over either of these fields, you can turn this into an inner product space by defining the inner product of two vectors and as , where is a member of the scalar field.  The inner product must satisfy a number of properties; one of these dictates a form of commutation: , where denotes complex conjugation—a process that leaves real numbers unchanged.  You will therefore, very occasionally, see an author avoid mentioning complex numbers if they are making only brief use of an inner product space with real scalars, by quoting this property as .  If not aware of this, you may miss the fact that conjugation is required in the complex environment.

Again, the only real protection to this is to make sure you read any introductory chapters where terms ought to be properly defined.  If in doubt, and the text makes assumptions of prior knowledge, Wikipedia is generally a good place to look for definitions, as it will tend to quote the most general form.

Deviating standards

One of the purposes of this blog was to discuss the additional challenges presented by self-study, over structured courses such as those offered by Universities and the like. I touched upon the lack of an obvious “road-map” in the Background page, and I’ll expand on that later. First I’d like to talk about a problem that is not unique to self-study, but that is exacerbated by going it alone.

Simply put, once you get past the “general physics” books, aimed at late high-school to early undergraduate (such as the rather fine “Fundamentals of Physics” by Halliday, Resnick and Walker), you will be flicking between books specialising in particular subjects, and no two of them will use the same notation or terminology.

Starting with conceptual differences, there are three main issues:

1. Different names being used for the same concept,
2. The same name being used for different concepts,
3. Different definitions for equivalent concepts.

In some cases you’ll see two or more of these at the same time (you could say that the general problem is a linear combination of these basis difficulties, but you might strain a friendship or two if you do).

Some examples I’ve met so far:

1. Where most books I’ve encountered talk of Hermitian operators (or matrices), the book I’m currently reading on Fourier Analysis calls these symmetric operators. This sort of thing is not too tricky to negotiate, unless compounded with a different, but equivalent, definition for the concept in question (more of which later).
2. Whereas most books in the subjects I’m currently studying will use adjoint to mean “conjugate transpose” of a given matrix, I did spend some time brushing up on my differential equations using a book that defined the adjoint of a matrix as . The fact that three chapters later he switched to using it as the conjugate transpose without thinking to warn us was, I think, just to piss me off. (Entertainingly, this was not a very new book; in the chapter on improving the efficiency of approximation algorithms we were warned that computer time can cost up to $1200 per hour.) Fortunately, in this case, a previous book had warned of the clashing terminology and confirmed that these were entirely unrelated usages, or I might have spent an evening scratching my head.
3. In a nicely circular conclusion to this tale of three, in the book above that used “symmetric” where other books use “Hermitian”, the defintion of a symmetric operator was an operator for which inner products and were equivalent, while another book defined an operator to be Hermitian if it was self-adjoint, i.e. . As you may have guessed (or already know), these definitions are equivalent—as long as you use the right adjoint!

Once you get beyond conceptual differences, you of course have notation to deal with. Will the author use primes for derivatives ()? Or Leibniz notation ()? Perhaps subscripts (), or (for time derivatives of a vector) dot notation (, or )? Often these will be used interchangably within any single book, according to what seems to the author to be most natural for the given problem, but you can be sure that at some point you’re going to fail to recognise a friendly equation in unfriendly clothes.

So how does one deal with this sort of silliness? Well there are a few things you can do to help:

• Never skip the opening chapters of a new book. Pretty much every text will start with a review of topics, and while it can be dull going over the same ground time after time, this is also where the author lays his/her notational cards on the table. The use of different but equivalent conditions for a certain concept will mean that you may follow the text but get hopelessly lost in a proof if you aren’t prepared for it. And if nothing else, you may get treated to an elegant or more enlightening derivation of something.
• The more sources you have with overlapping interests, the better you’ll get at recognizing the well trodden paths; in the example above of the use of “symmetric” in place of “Hermitian”, we’d just introduced a particular concept (eigenvalues), and I was 90% sure we’d be moving immediately to Hermitian operators, simply because it’s the natural next step.
• Make use of sample chapters (for e-books) or “look inside” buttons on web-stores—or you could even (gasp!) try a book shop (try between “iPods For Dummies” and “Book-reading For Dummies”, if it’s anything like my nearest Waterstones), if you’re particuarly keen to follow a particular style.
• Finally, and a theme that will be picked up later, sometimes if you’re struggling with a particular section of a book, take a step back, and just keep reading without focusing on any proofs. Sometimes you will find that a few pages ahead you will realize that the author is actually doing something you recognize but in a different form, and with this understanding it all slots in place.

Of course, any further tips are always welcome!

Replace the touchscreen with paper, and this could take off…

A while back I grabbed the Penultimate app for the iPad, just ‘cos it seemed fun at the time. I didn’t really envisage using it for studying—the fingertip control is pretty dicey to write anything small enough to fit more than two or three short lines of calculation. Besides, why bother when you can just grab a pad of paper and a pen(cil)? (if you’ve not seen Peter Serafinowicz’s iPad video, it’s worth a giggle).

That said, since the first road-test of the pad was taking it on holiday, I did actually find that I would occasionally drop from Kindle to Penultimate, to scratch out a determinant verification or the like. And with practice I became a little better at squeezing more in a page of scribbling. Not that I think anyone but me could have decyphered more than a character or two!

With that in mind, I decided to do some experimenting with a home-made stylus. Since the touchscreen is capacitance-based, it was going to have to conduct well enough to be more or less equipotential with my fingers. It was also going to need to be tapered to a flattish surface for the screen to register it. In the end, I sliced off the flat end of a pencil to leave the angle at the tip somewhere between 30 and 45 degrees, wrapped the whole thing in kitchen foil, and neatened up the ends.

Finding the right angle to write at takes a little practice. Also, though some people seem to have found the “wrist protection” feature in Penultimate to work well, I find it works some days but not others. Easily solved by just finding a thick enough insulator to rest your wrist on when writing. Results below (note: I have shocking handwriting at the best of times!)

I don’t think I’ll be totally giving up on pen+paper though.