• Code Factory Entry Here
• Direct Download Link Here (7.1kB, requires .NET Framework, which you may already have)

Technical notes:

• The settings screen assumes you understand what the Mandelbrot Set is. If you don’t, the point is that for each point on the screen, the colour represents the number of iterations required before the value exceeds a certain cutoff. You don’t need to know what that means, but the cutoff is one of the options. Since some points (those within the Mandelbrot Set) will never get there, so the maximum number of iterations option lets you choose when it should give up. A higher cutoff will produce smoother colours but take longer to process. A higher number of iterations will produce more detail but again take longer to process.
• The colour step controls how fast the colour changes. A low number will give less contrast but a less psychedelic image.
• The minimum spread to zoom, which must be between 0 and 1, controls how interesting something has to be before it will be zoomed in on. Some parts of the image take longer to process than others, so the maximum difficulty to zoom, which again must be between 0 and 1, controls how long a part of the image could take before it will be ignored. If no area of the screen matching these rules can be found, then it will revert to the entire Mandelbrot Set image and start zooming again.
• After a great many zooms, you start to hit the limits of double-precision floating point numbers, so changing the maximum zooms option puts a hard limit on how many times it zooms before going back to the start. I find the 40th zoom is where it starts going wrong, though to be fair by that point you’re looking at an area that would have been 1% the size of a hydrogen atom at the original zoom level.
• There’s no frame rate limiter in this. If you have a ludicrously fast PC at low resolution, it may run too fast. You could try increasing the first two numbers to silly levels. That ought to slow it right down.
• I have no idea what happens to this screensaver on multiple monitors.

Code Factory page: http://www.apathysketchpad.com/codefactory/code.php?id=autohotkey

Direct download link: http://www.apathysketchpad.com/codefactory/file.php?id=autohotkey.ahk

The “The Screen Is An Art Package” Applications

These are designed to go in a quicklaunch bar, or in an Aquadock, or something. They all allow you to run simple image manipulation on the entire screen. Some are useful only for people who do a lot of work with images (and don’t want to fire up The GIMP every time they get an email), others are just really, really useful. They are:

• Brightness And Contrast* — make faint images visible without having to copy-paste into an art package.
• Channel Splitter* — toggle display of red, green, blue, hue, saturation, and value of the screen.
• Colour Picker* — find out the RGB code of any pixel. Also shows HTML colour codes which you can copy to the clipboard.
• Copy* — drag a box on the screen and it will copy that area to the clipboard.
• Filters* — apply blur, sharpen, edge detection or any custom filter to the entire screen
• Freeze — prevent an area of screen from updating. You can also use the programme to quickly grab an area of screen, and move it around. It is very useful for comparing graphs, keeping headers in scrolling tables, and making quick notes from a document you’re reading.
• Histogram* — see a histogram of the area of screen you select.
• Morphology* — erode and dilate the screen. Useful really only for imaging types.
• Paintbrush — this allows you to draw on the screen, and then continue to work with the painted lines still visible. This is useful for all kinds of different things, as well as being basically awesome.
• Save* — drag an area of screen, and save it to a file. Nothing you can’t ordinarily do, but it’s so much faster…
• Thresholder** — threshold the screen image.

Regular Expressions Applications

Regular Expressions is a massively useful standard for doing very advanced find-and-replace operations. I’ve built two little programmes around it:

• RegExp — a command line utility that takes standard inputs, applies a regular expressions search to them, then gives the results as standard outputs. It can be used by anyone who understands the Windows console properly to run regexp find-and-replace on any text file or to create a batch file based on a directory structure. To be honest it should have been built into Windows to begin with. Put it in a folder on your PATH environment variable, or else add its folder to PATH (using contol panel > system > advanced > environment variables).
• RegExp File Renamer* — takes a regular expression pattern and a folder of files, and applies the find-and-replace rule to all filenames therein. It’s ridiculously useful. It has a preview feature so you can test the expression before applying it to your precious data, and it can copy, delete, move and rename on demand.

Everything Else

• AnyOverlay — drag a picture onto this window (or load one with the right-click menu) and you can keep it always-on-top, resized, semitransparent, and/or masked to a colour. Useful for aligning things and comparing images. Also pretty handy just for previewing images.
• Coverer And Measurer — tiny application which can be always-on-top (to hide things from people) and displays its dimensions, so you can use it to measure screen distances.
• Folder Viewer* –not the easiest to use application, but it’s designed to help you flick through a lot of folders each with the same images in. I can’t imagine this will be as useful to you as it is to me.
• Text File Combiner — it allows you to combine text files in unusual ways, sticking the new file to the top, bottom, left or right of the old. It’s not great but I’ve used it before and it helped.
• Video Calibration Tool* — calibrate webcams, USB cameras, TV cards, and the like. It shows you the live feed and the histogram, so you can make sure you’re getting the most from it. Probably only of interest to people who need such cameras for something more important than Skype.

You can download it here. All the applications in it require .NET, because they wouldn’t exist otherwise.

As before, the source code is available, so you can see just how little has changed and just how easily you could have done this yourselves, you lazy bottoms.

As you can hopefully see, the categories list has been knocked on its side and the archives list has been collapsed into a little menu, accessed by either a category tab or a little tab on the right above the “recent posts” list. (I haven’t decided which yet.) This has rendered the left sidebar totally useless and so that has been removed, the search box having moved to the corner, where the site’s content meets itself, which is all in all I think the best possible spot for it. Also, I’ve lost the Facebook badge and replaced it with a Facebook link in More Of Me. Similarly, the “Meta” column (which has a stupid name, but that’s what WordPress calls it) has been put horizontally under the logo.

I was thinking a lightish grey for the background (where the “links” header is), and white for the main page background. The line down the left hand side that comments and titles go over would either be a narrow line, probably in blue, or the edge of a margin, which also may end up being blue but probably not as Manchester University like a blue bar there and I’m not branding my blog to resemble my employers. I thought the Google Reader and Other Pages ‘tabs’ would be darker than the white Recent Posts tab.

I’ve done no coding at all on this, so I can’t tell you if or when it will go live, and it may have to change depending on what is actually possible, but for the time being, discussion is welcome in the forum thread I made for the purpose. (You won’t need a forum account to post there, but you can’t identify yourself without one, other than by writing your name somewhere within the post.) I’ve disabled comments to keep all the discussion in one place — I’d like to keep the blog comments for comments about the things in the blog and the blog itself rather than code and site design. If you have any comments, please let’s hear them. If anyone voices distaste after I do a redesign and they’ve not mentioned their concerns now then I shall be most annoyed.

Colours would be a good thing to suggest, because if I do them they’ll just end up all being blue again, as that’s all I can do. I’d like to get some pale yellows, and some earthy colours in, because I like the modern look they can give a website. I’d consider some dashed lines, too, as they seem to be popular these days, but other than the margin line on the left, I can’t think where they’d fit in.

As everyone in the world knows by now, most websites and forums use “captchas” to try and stop computer programmes from posting fake comments containing adverts. “Captcha” stands for “Completely Automated Public Turing test to tell Computers and Humans Apart”. And as everyone in the world ought to have realised by now, they don’t work.

There exist a number of ways around them, the most cunning and most effective, although the most difficult to set up, is to build a pornographic website and get real humans to solve the captchas for you in exchange for naked pictures.

But mostly, they’re easy to get around because they’re shit. This, for example, is the default captcha that comes with the now obsolete phpbb2:

That is very easy to solve. (It should perhaps be pointed out at this stage that my job is in large part to extract shy information from images.) As with all the algorithms I’ll show you, this is the first and simplest one I could come up with, and it’s only the start. In all cases I will extract a binary mask of the letters for transferal to a more general OCR system. Also in all cases, I will use Matlab 6 to perform the analysis.

Here is the code required to make this captcha machine readable:

function bank=solvefuzzy(bank)

[x y c n]=size(bank);

%First, greyscale the lot by taking the red channel
bank=bank(:,:,1,:);

%Now blur it slightly.
for (i=1:n)
bank(:,:,1,i)=filter2(ones([3 3])/9, bank(:,:,1,i));
end

%Now threshold it.
bank=(bank<0.63);

%Now trim the borders.
bank(1:x,[1 y],:,:)=0;
bank([1 x],1:y,:,:)=0;

Here is the result of this algorithm on four example captchas:

Now that wasn’t hard. And I know that the letter shapes aren’t ideal, but it’s a very uniform font they use, and the letters aren’t rotated, so it’s as easy as pie to extract the characters from this mask.

Of course, cracking obsolete captchas isn’t terribly useful, or wouldn’t be if anyone bothered to update their forums, so here’s a captcha from phpbb3:

The first thing you should notice about this is that it’s gorgeous. But let’s have a look at the code required to break it:

function bank=solveclassy(bank)

%First, greyscale the whole thing
bank=mean(bank,3);

%Now threshold it.
bank=(bank<0.55);

That’s two commands. Now, let’s check the results.

So that’s done it perfectly, with no real image processing at all. Of course, this is a little unfair to the new captcha — it is in reality much tougher than phpbb2’s, because it uses many fonts and angles and sizes. So some kind of cunning would be required to turn these shapes back into characters, but that’s really nothing OCR software doesn’t do as a matter of course. And if you were to take each character individually (even if they overlap, the colours in the original image would distinguish them) and perform, say, a Radon transform on them about their centroids, this would give you a distinctive pattern for each letter and number in each font. The point is that from here it is entirely possibly to crack this captcha. Besides which, phpbb is open source, so training the process by Radon transforming all possible characters would be fairly simple.

But phpbb3 has another trick up its sleeve: a second type of captcha. This is the one used on www.phpbb3.com’s forum, so presumably they trust it:

Aside from the fact that it looks like something from a bad Spectrum game, the first thing you should notice about this is that it has clearly been designed to be almost impossible to crack, by someone who knows nothing about cracking captchas. For example, the uniform background colour. Well over 90% of the image is a single colour and every pixel of every letter is that colour. Then, the individual letters are outlined in distinct and uniform colours, and then, as if that wasn’t helpful enough for crackers, the characters are made up of little square elements (which I will call ‘charels’), so we can reconstruct the characters down to the pixel, generally the right way up. It really couldn’t be more helpful if it tried.

So let’s see some code.

function result=solvefunky(bank);

[x y c n]=size(bank);
result=zeros([x,y,1,n]);

%First, determine that background colours.
%We assume the first colour with five continuous pixels of itself
%along the first row is background.
background=zeros(3,n);
for (i=1:n)
colour=[0 0 0];
j=1;
count=0;
while (count<5)
if ((bank(1, j, 1, i)==colour(1)) && …
(bank(1, j, 2, i)==colour(2)) && …
(bank(1, j, 3, i)==colour(3)))
count=count+1;
else
colour(:)=bank(1,y,:,i);
end
end
background(:,i)=colour(:);

%Next, find areas that are that colour
backgroundareas(:,:,i)=((bank(:,:,1,i)==background(1,i)) & …
(bank(:,:,2,i)==background(2,i)) & …
(bank(:,:,3,i)==background(3,i)));

%Now, find areas of that colour smaller than 15 pixels
temp=bwlabel(backgroundareas(:,:,i), 4);
small=zeros([x,y]);
numberofregions=max(temp(:));
for (region=1:numberofregions)
pixels=sum(temp(:)==region);
if (pixels<15)
thisarea=temp==region;
%This leaves a lot of bits which aren’treal, but we know from
%looking at the captcha that the letters are outlined in just
%one colour, so lets eliminate anything that’s got more than
%one colour adjacent to it. (In fact, we allow one pixel of a
%different colour as this works better.)
adjacentpixels=(imdilate(thisarea, [0 1 0;1 1 1;0 1 0])&~thisarea);
red=bank(:,:,1,i); green=bank(:,:,2,i); blue=bank(:,:,3,i);
ar=red(adjacentpixels); ag=green(adjacentpixels); ab=blue(adjacentpixels);
if ((sum((ar~=ar(1)))<2) && …
(sum((ag~=ag(1)))<2) && …
(sum((ab~=ab(1)))<2))
small=small|thisarea;
end
end
end
result(:,:,1,i)=small(:,:);

end

That results in this rather pleasing image:

Now all I’ve done here is to find the pixels that are part of the larger “charels” which comprise the message. There’s still a lot of work to be done to find the message in ASCII format, but it can be done: you can separate the individual characters by recourse to the original image — each one is outlined in a distinctive colour, and if a colour is reused then it probably isn’t reused in adjacent characters, so a simple contiguity test will catch it; you can reorient and rescale each character by picking a charel arbitrarily and seeing where its neighbours lie relative to it, using the provided coloured outline as a guide and the ’shadow’ colour to define the vertical and/or horizontal axes — this will allow you to build up a reoriented image of each letter, which can be easily checked against the known font to see which it most closely matches.

Those of you who know me should already have worked out that this took me less than one evening, including grabbing all the pictures and writing this entry. I wouldn’t bother if it was going to take longer. You know that. So if you employed a good programmer for a week to crack such a captcha you ought to be able to finish the job off. Then you’d have access to every phpbb3 forum out there.

Clearly there are false positives and things in these processed images: the bottom one in particular has a large false positive in the Z, and the last H has a bit missing where the L overlapped it. I don’t think either of these would actually affect a good OCR algorithm (given that said algorithm would have the font used built into it and have an ideally oriented and scaled image of the letters, albeit with the odd mistake), and even if it did, well, we cracked the other three. If we assume we can crack 75% of these captchas, then we can break into a forum which allows us 5 attempts (which is pretty standard) 99.9% of the time.

phpbb3 also allows the user an almost ludicrous amount of options for their captcha. This is good, as it means that a cracker will have a harder time beating the captcha in the general case. But in the specific case of the default settings, which almost everyone will use, this won’t help at all.

So what’s the solution? Personally, I use a bespoke text-based captcha. Image based ones are hard to programme, which isn’t a problem if you’re doing something like phpbb, because it has to be hard to crack (oh dear) and text based ones really aren’t. Another problem with image-based solutions is that some devices or people can’t read them, so there usually has to be a fallback, and then you have two links, of which a cracker need only outsmart the weakest. (Sorry for the mixed metaphor there.) I think bespoke text-based is good because there’s no really motivation for a cracker to devote any time to cracking it, as they’ll only get access to my websites, and if they do I can very easily change it the following evening. But it couldn’t work for phpbb as you can’t make a bespoke captcha for every user.

Some captchas are obfuscated further than these. Sometimes this is a simple case of drawing lines over and through the text. This is pretty easy to beat — any good photo touching-up software has had this feature since the week after flatbed scanners were invented, and replicating it is not hard, even when the lines must be found automatically. A better solution is to deform the letters themselves, though this involves a very direct tradeoff: anything you do that makes letter shapes harder for a computer to identify will have the same effect for your legitimate users. Again, I would attack such a captcha by not attempting to restore the original image, but by developing an algorithm to characterise each… well, character based on its Euler number, the number of sharp corners in its outline and their relative locations, and maybe the Euler number of the shape you get if you dilate it a bit. I believe this could crack such a captcha with minimal training.

Theoretically, human authentication is the best way, but humans aren’t apparently very good at that. It’s not always apparent from a name and an email address if a user is a human or a spambot. My proposed solution is a deliberately impossible captcha: you find or create an image, possible of random abstract ‘art’, or a landscape, or a sort of randomly generated Rorschach ink-blot test, and ask the user for a vague, one sentence description. Then a human would authenticate the user’s account by seeing if the user’s description of the image relates to that image in any way. It’d be a little subjective, but I really can’t see it being cracked, except perhaps be Derren Brown concocting a sentence that would appear to describe any image. And people would learn to spot that sentence. It would still be susceptible to the porn crack, but then everything is, and honestly I think it’d be fairly easy to tell which descriptions of Rorschach ink-blots had come from the minds of teenage boys looking for naked pictures with a pretty high degree of certainty.

Plus, I think it’d offer a fascinating glimpse into the psyche of all prospective users of your forum.

You can download all the above code, and some general making-it-work gubbins in the Code Factory, but you’ll need Matlab to make it work, and you’ll need the Image Processing Studio, to make it run. If anyone wants to extend the code, do feel free. Complete code is available if you want it, though — people sell it to prospective spammers.

It features no admin panel, because they’re too easily hacked and in any case I prefer to hack the database in PHPMyAdmin and hack the behaviour in the PHP files, so I’ve made all the code as readable and abstracted as I could to make this easier. It also features fully native support for all kinds of cunning levels of sticky threads, closed threads and Anarchy Boards that just aren’t possible in most forum scripts. It’s based heavily on the CMS I made for RealVG, and it takes a very different approach to most forum scripts, not least because I don’t see the point in spending a lot of time producing something that already exists. It’s very well suited to small site run by people who know their way around PHP (such as this one), but less well suited to large sites with many staff members (as they’d all need FTP and PHPMyAdmin access to administer it) or sites run by people who don’t know their way around a web server (because they’ll not be able to set it up, not least because there’s no installer at the moment). Since it has no admin panel, no session IDs (cookies are required), and checks your password on every page, it is, as far as I know, totally secure. I’ve little doubt there’ll be a hole in there somewhere, but keeping things simple and well abstracted is always the best way to keep them secure, and I think I’ve done that fairly well.

Other features I intend to add are email thread subscriptions, Facebook style user “walls” and the ability to email users who say they don’t mind (but not private messages because I don’t see the point), and some kind of file attachment system. And a “forgot my password” link, because they’re always useful. Also there are a lot of extra fields like “edited by” links that will need adding to the skin.

So feel free to register and post there, but do bear in mind that me and Testing Jeff will just spam mercilessly until the beta is over. And feel free also to request features and report bugs — that’s what beta is for. Such reports should be in my email inbox, comments on this post, or in the special beta test subforum.

The old forum will stay where it is indefinitely, though it won’t be reopened (for the forseeable future). I’ll update the various links later, and possibly put a notice on the old forum explaining where the new one is.

Reason being, my phpBB forum keeps getting hacked, by morons no less, because it features the world most insecure admin panel. I don’t know if you’ve ever clicked the “administration panel” link at the bottom of a phpBB forum. It’s a tiny link at the bottom of pages which is only displayed to administrators and anyone else who wants to see it badly enough. When you click it, a large button appears saying “please don’t click here if you are a hacker”, and clicking it automatically takes you to the admin page. The admin page has three options: ban users, change the kind of captcha you use, and change the index page to say “Joo hav been hacked by Captain Awesome’s CyberDweeb Klan” and play shitty music. I understand phpBB employ people specially to compose this music.

Whatever the reasons behind this insane design philosophy, the result is that phpBB is a total chunk of crap. So what I’m doing is writing my own forum script. My forum script is better than phpBB. Sure, I’ve not added any way for users to register, so I’m the only person who can post, but that’s one better than phpBB, since I’ve had to take away phpBB’s access to my database, so even I can’t post there without doing it via PhpMyAdmin. Secondly, it is impossible to hack the admin panel on my forum script, because it hasn’t got one. Nor does it have a moderator’s panel that can delete all the threads at once. That’s just asking for trouble in my opinion. And you don’t need these things. At least, I don’t.

phpBB is, I think aimed at people who want a cheap forum for their website and want to have a team of moderators and admins watching over it and doing handy things. Mine isn’t. Mine is aimed squarely at me. It does things my way. If you want to change the look, you change the PHP files. If you want to edit the forum list, you use PhpMyAdmin. If you want to ban a user, PhpMyAdmin. If you want to delete a load of threads at once, PhpMyAdmin.

It’s a much better system. It’s more flexible than phpBB’s mod controls (which are useless at best) and it’s infinitely more secure. Once it’s up and running, my new forum will be at forum.apathysketchpad.com. Well, it’s up there now but it’s nothing but meaningless testing banter at the moment, so there’s little point in looking at it (though I’ve no doubt someone will).

I don’t really understand phpBB. I’ve looked at the source and it’s crazy. The database is split across a hundred things; they take away your RegExp and give you a rubbish asterisk system, which the code then turns back into RegExp. The posts are stored across two tables. The whole thing is just madness in a jar.

So I’m doing it myself. Honestly, it seems like the only way sometimes.