I have been using Mac OS X Lion for two days now. This is fresh enough to remember the issues I encountered when installing.

Installation

It took me several tries to find an installation method that worked for me. In the end, the successful method was :

1. Download the Lion image
2. Open the image (right-click, Show Package Contents) and extract installESD.dmg
3. With Disk Utility, burn installESD.dmg on a DVD disk. This makes it bootable.
4. Restart the Mac, press Command, Option, P, R at boot time to reset the PRAM
5. Boot from the Lion DVD. It takes 5 minutes to load.
6. Go to the Disk Utility and Repair permissions
7. Reboot again from DVD
8. Install Lion from DVD and take a 35 minutes coffee break

I followed this guide to create the DVD. It could as well be put on a USB stick, but it needs to be one larger than 4Gb.

Usage experience

Quite strangely, it seems that the Java VM was not part of the standard installation. When I accessed a web site requring  Java, OS X kindly offered to download and install it. I restarted the browser and could continue.

Mail.app is an application which is central for me. On first launch, it took one hour to rebuild my (very large) mailboxes. The new three column display is most welcome. I used to use Widemail to achieve this same result in earlier versions. At first, the folder list was hidden. When restored (click “Show” on the second button bar), it was displayed with large characters, pretty inconvenient with a 13″ laptop screen. Quite strangely, this cannot be adjusted through the Mail.app preferences. You need to go to the System Preferences/General, and adjust the Sidebar icon size. This will also change the value for the Finder windows.

As I expected, GPGTools  does not work anymore with the new Mail.app. According to the developers, work is underway to restore the compatibility with the new Mail.app version.

Mission Control replaces the Spaces app for those virtual desktops. It works a bit differently, but it just requires getting used to.

The IPv6 stack has a new version number, dated 2009. The previous one was ten years old. I failed to notice any new feature, though. No DHCPv6, and no GUI option to set the IPv6 Privacy Extensions. By default, it is off. To turn it on requires editing a configuration file. Whether those privacy extensions are a good or bad idea is another debate.

The mouse or trackpad behaves in the opposite direction than it used to. Scrolling to the top requires to slide you fingers down on the trackpad. This can be changed in the System Prefererences/Trackpad, first option.

Other than that, I did not notice major differences. This may explain why the new OS X version still runs happily on a 5 year old MacBook, with 2 Gb of RAM. Apple continues its strategy to make you a captive consumer. FaceTime and Apple Store are linked to your AppleID.

In the end, was the upgrade worth it ? Frankly, the new features in Lion are not something the world has been waiting for anxiously. There is  no compelling reason to upgrade.

Update: after 2 weeks of use, I notice that Lion is slower on the average than Snow Leopard was. After adding 2Gb of RAM to my Macbook, I regained most of the lost speed.

Ahead of the World IPv6 day,  APNIC has launched an useful initiative to collect statistics regarding IPv6 connectivity. If you are interested in testing your clients’ IPv6 capabilities, you can use the APNIC Labs Google Analytics Tracking Code. This allows you to test your customers’ experiences connecting to your website via IPv4, IPv6, and dual-stack.

The APNIC code relies on Google Analytics. If you are using Google Analytics as a plugin in your WordPress blog, you might be interested in the versions I hacked together to integrate APNIC‘s code into the following two popular plugins:

You will need a tracking code that you can obtain at the APNIC labs web site.

Note this is not a discussion on  whether Google Analytics is Big Brotherian. Many web sites rely on it to collect statistics. I thought it might be helpful if a WordPress plugin existed that supports the APNIC feature.

I have a web site which announces future events. In WordPress, you would adapt the publish date of the  post to suit the event’s start date. All is good on the web site itself. I use the c2c_get_upcoming_posts plugin to display them on the front page, but there are other ways.

The RSS feed is another matter. By default, WordPress only shows those posts which are current to date. Later posts are not visible, which defeats a bit the purpose of announcing an event. If the readers following the RSS feed are only informed on the day of the event, it is of little help.

I added the following function to the functions.php file (in the WordPress theme folder) to show future posts.

function include_calendar_posts($where) {
global $wpdb;
if ( is_feed() ){
// add SQL-syntax to default $where
$where .= " OR $wpdb->posts.post_status = 'future' " ;
}
return $where;
}
add_filter('posts_where','include_calendar_posts');

This morning, I fixed an annoyance in the Hellotxt plugin I use on this WordPress blog that would resend a notification to hellotxt.com every time one updates a post (to correct a typo for example).

I sent a tweet about this and, much to my surprise, I immediately received a series of direct messages on Twitter asking for the code. So here it is:  hellotxt.php.txt , as well as the diff to the original file: hellotxtpress.php.diff

There are actually four five changes:

• Added configuration option for URL shortener, so you can use your favourite URL shortener service. It defaults to mine.
• Added configuration option for post prefix. By default, it is “New Blog post: “

• Replace WP smart quotes by plain ones.  This is to prevent that some microblogging sites print out the HTML entities value, instead of the quotes themselves. Copied straight from WP Laconica Tools.
• Don’t resend a post that was already submitted.  The inspiration came from the WP Laconica Tools.
• Added configuration option for Twitter hash tags

I will submit my changes to the plugin author, who may decide to incorporate them in a future release.

Many software applications rely on validation routines to check the validity of domain names. By validation, I mean here to test the string submitted by the user and see if it matches a pre-defined pattern. A typical example are web forms that need to validate e-mail addresses.

This is by no means a new issue. It first appeared with the introduction of the .info TLD. Before that TLDs were only two or three letters long, and many validation routines could not cope with the 4 letters of .info. At the time, ICANN had developed a testing tool which allowed developers to test if their code took into account the requirement for 4 letters. Still, you find today on the Internet tons of library routines that do not support 4 or more letter TLDs.

Some of these routines also rely on a hard-coded list of TLDs. Even today, I sometimes find that some web sites cannot deal with my .eu domain, which was introduced 4 years ago.There are hundreds of thousands of these routines written in Javascript, PHP, Perl, ColdFusion, ASP and just about any programming or scripting language you can think of.

In the Draft Applicant’s Guidebook to new gTLDs, ICANN has clearly indicated that it does not guarantee universal acceptance of the new TLD, and rather place the burden on the registry operator to educate its customers. This made sense during the previous new TLD rounds, where there were only a few added, one at a time and with long intervals between them.

With the new gTLD round, ICANN plans to add a lot of TLDs, potentially at very close intervals, if not at the same time. The figure most often heard is 500. That is a quantum leap forward. All those hard-coded lists deeply buried in software will need to be updated. It will not happen overnight. It may take years. This time also, we are throwing into the mix TLDs which could be long strings, like .coca-cola. We are also adding IDN (internationalized Domain Names) in non-ASCII characters, which will be a real issue with all environments that do not process double-byte strings. There are tons of legacy applications that do not support that, and some never will.

The good news is that programmers do not need to worry about their job. There is plenty of work ahead. The bad news is that most of them are not aware of these upcoming TLDs, let alone the implications it will have on the code they wrote, or the code they use and written by someone else.

So, it does not make sense now for ICANN  just to say it is someone else’s problem. If the new gTLDs cannot be processed on the client platforms, this will mean their acceptance by the user community will be low. This means less revenue for registries, registrars and finally ICANN. This would also mean a partial failure of the whole new gTLD program, for which ICANN will be accountable for. It could cost ICANN much of its credibility, because it would not be the failure of one specific TLD for which the registry could be blamed, it would mean the failure of several, all for the same reasons.

Hence, I suggested today to ICANN to plan a workshop at the Seoul meeting to help identify these issues, so that clear guildelines can be given to the software community and an awareness campaign can be launched. It is absolutely crucial to identify the issues, the amount of work they represent and the time it will take to fix the code before the introduction of these new top level domains.

The EAI working group of the IETF has finished (part of) its work on the interationalization of e-mail addresses. This, together with Internationalized Domain Names (IDN) will make it possible to send e-mail messages to non-7 bit ASCII addresses e.g.  måtte@københavn.dk or 中国@中国.中国 .

There are 3 RFCs, covering changes to the SMTP protocol, e-mail message format and delivery Status Notifications.

http://www.rfc-editor.org/rfc/rfc5335.txt
http://www.rfc-editor.org/rfc/rfc5336.txt
http://www.rfc-editor.org/rfc/rfc5337.txt

They still have the “Experimental” status, meaning they are not yet a standard. How long this will take to see them in actual products is difficult to guess.  Software vendors tend to look at market demand before implementing new features . Hence, it is time to pressure your favourite e-mail client vendor. Tell them you need that. For Microsoft Outlook, you could try here. For Apple Mail, there. For Mozilla Thunderbird, still somewhere else.

Over the years, the venerable traceroute command has become a less useful tool, due to the fact there may be  some devices like load balancers along the way from your computer to the other.

Enter Paris-Traceroute, which tries to be smarter. In addition, it can also do traceroutes in UDP and TCP, in addition to ICMP, which is often blocked by firewalls.

It has currently been tested and confirmed to run on Linux and NetBSD. I can confirm it also compiles and works on MacOSX, but needs to be run as root. For the Redhat and CentOS crowds out there, I am currently build a RPM.

A while ago, I replaced the official Mozilla build of Thunderbird I had on my Mac with an optimized-for-Intel build I found here.

Taking the process one step further, I compiled it myself from source. This allowed me to change one thing that annoyed me in the application. Thunderbird puts subject lines between brackets when you forward a message. It is not a configurable option. This is hard-coded into the application in the file nsMsgCompose.cpp (lines 2017 and 2018) and in mimedrft.cpp (line 1350).

One other annoyance I had with Thunderbird on MacOSX is that it displayed the date in MM/DD/YY format, rather than the DD/MM/YY format we use in Europe. This happened regardless of the date settings on the Mac, and irrespective of the official build I used.  Bingo this time. Recompiling Thunderbird solved this issue. My guess is that the application takes the defaults of the platform being used for compiling, rather than the run-time defaults.

Finally, my Thunderbird.app is now 31Mb, rather than 52Mb for the official build. As a result, it starts and runs visibly faster.

From the press release: Unbound – a new open source alternative to the BIND domain name system (DNS) server– makes its worldwide debut today with the worldwide public release of Unbound 1.0 at http://unbound.net.

Released to open source developers by NLnet Labs, Verisign, Inc. (NASDAQ: VRSN), Nominet, and Kirei, Unbound is a validating, recursive, and caching DNS server designed as a high performance alternative for BIND (Berkeley Internet Name Domain). Unbound will be supported by NLnet Labs.

It is good news for the Internet as a whole there is another alternative to the venerable Bind. With a 75% market share, this means an exploit in Bind might cause serious trouble for a lot of people. With more alternatives, we mitigate the risk.

I have not tried it yet and certainly my experience on this small site will certainly not be representative. If you want to give it a try, download the source from http://unbound.net

I built RPMs for RHEL5 / CentOS 5 (WARNING Totally untested ! use at your own risk)

unbound-1.0.0-1.i386.rpm
unbound-1.0.0-1.src.rpm

See also the static page with more details for geeks.

Update: I have been using this RPM over the last two hours in lieu of Bind for local resolving and can report it works as intended

if (substr_count($_SERVER['REMOTE_ADDR'],":") > 0 &&substr_count($_SERVER['REMOTE_ADDR'],".") == 0) {
echo 'Congratulations ! You're using IPv6 ! Your address is'.$_SERVER['REMOTE_ADDR'].'.';
}  else {
echo "You're just using IPv4. Your address is '.$_SERVER['REMOTE_ADDR'].'.';
}

function is_connected_ipv6(){
return (substr_count($_SERVER['REMOTE_ADDR'], ":") > 0 && substr_count($_SERVER['REMOTE_ADDR'], ".") == 0);
}
echo is_connected_ipv6() ? "(via IPv6)" : "(via IPv4)";

I recently switched to a new position in my day job. I moved to another campus and office, where I found on my desk a computer with the default standard configuration. The default browser in this configuration is Internet Explorer 6.

I am still in a state of shock. Over the last four years in my previous position, I had been using Firefox as my main browser, mostly because of AdblockPlus, a remarkably efficient advertisement blocker.

With IE6, I have rediscovered how advertising on web sites can be distracting and invading. Suddenly, the pop-up windows, Flash animations and other nasties are there again. Unlike a paper magazine, when you only need to turn the page to ignore them, advertisements on web sites really prevent you to work until you close the pop-up window, stop the animation, turn off the volume, etc.

I guess one could say that Wladimir Palant, the developer of Adblock Plus, is one of the greatest benefactors to computer productivity over the last few years. Thanks, mate. Great job. I am forever grateful.

Apple has announced it is developing a Windows version of its Safari browser.  The browser will be freely available for Windows in October 2007.  This is good. Safari has demonstrated its many qualities on the Mac. It is a fast and reliable browser, maybe just lacking the range of extensions that Firefox has.
More competition in the Windows world is always welcome, if only to prevent overall market dominance from happening.

I tried Beta 3 of Safari for Windows this morning on my office computer. The good news first.  I was pleasantly surprised by the speed at with it launched, compared to Firefox or Internet Explorer. According to Apple, it beats all the competitors for speed of HTML rendering, Javascript execution and launch times.

As is typical with beta versions, some things do not work yet.

• Importing Firefox bookmarks. I have not tried importing IE bookmarks
• Although Safari identified my company’s automatic proxy, the keychain module in the browser does not seem to work yet, so I had to enter a user name and password for each and  every HTTP connection. You may have several for each page you want to display, so in this case it is very inconvenient.
• The user interface is typical MacOSX. This may be surprising for Windows users, especially in the preferences menu, where there is no “OK” or “Apply” button to confirm the changes you made.

Overall, Safari for Windows is very promising. I look forward for the next beta and the official release in October.

We keep hearing in the ICANN and IETF crowds that DNSSEC is unavoidable and that it is the way to go. These are the same crowds saying that we should move to – or at least support – IPv6. In both cases, the prophets are not always those who actually do it. While www.isoc.org and www.ietf.org are running on a dual IPv4/IPv6 stack, much of the companies working within the IETF do not run dual stack web sites: Cisco, Microsoft, IBM, Sun, etc.

So, rather than telling others that they should run DNSSEC, I figured I should do my homework and run DNSSEC myself, without waiting for my TLDs to get signed.

The job is done, but it was no easy task. If you are looking for a simple button on a GUI to sign your DNS zones, move on. Currently, this is not for the faint of heart, which might explain the slow adoption path. Bind does include all the tools, but you first have to figure out how the damn thing works and use the right parameters.

I found a tool which made my life much easier. It is called ZKT. Once you have configured the header files to your environment and adapted your file directory structure to the requisites of ZKT, you can actually sign all your zones in one pass. It will call the necessary Bind tools with the right parameters. I have created a cron job that will periodically check which signatures need updating and change the zone files accordingly. Highly recommended.

We all know some countries heavenly censor what their Internet users are allowed to see. The reasons are many. Some point out the mistakes of the Great Dictator (or “Liberator”, as they usually call themselves) or critize the annexion of territories or denounce the use of torture (sorry, this should read “physical pressure”) by the regime, etc. Usually, this means censoring newspapers, civil liberties association web sites, usually hosted outside the country.

Over here in democratic countries, we are often well intentioned in trying to help those who cannot access all information to still be able to. It usually takes the form of letting your computer act as a relay for the person wishing to access those banned sites. There are different technologies, one of them being Psiphon.

Forbes has an interesting story on the unwanted side effects of letting a remote individual use your connection to access banned content. According to Forbes, the Psiphon network is often used not so much to read the web sites of the likes of Amnesty International, Human Rights Watch, the Guardian or the Washington Post, but also to access porn sites.

This has led some people to leave the Psiphon network, because they do not think they should offer bandwidth for looking at porn material.
Fair enough, but one hypothesis the Forbes story did not investigate is that those regimes which censor might be willing to poison the system itself. Rather than trying to block the use of the relaying technology by technical means, they may find it easier to fill the Psiphon network with fake porn lovers, thus disgusting those who offer uncensored access. A quite effective way to prevent their citizens to access the full Internet.

IPv6 deployment is in a chicken and egg situation. On the one hand, there is no willingness from ISPs and commodity DNS router manufacturers to include IPv6 support in their infrastructure or equipment because “there is no demand”. On the other hand, there is no demand because the average Joe Blow could not care less if he accesses a web site under IPv4 or IPv6. It should just work. The equipment and infrastructure should adapt transparently.

One of these days, when there will be IPv6-only web sites, Joe Blow will call his ISP to complain he cannot access them. This may happen sooner that you think. The North American Internet Registry (ARIN) has issued an advisory to alert the community that it will no more be in a position to allocate IPv4 addresses in the near future and strongly advises companies and ISPs to look at IPv6 instead.

What we users can do is to stop waiting for the industry to get its act together and work around its limitations.

Most consumer OSes these days support IPv6, either natively like MacOSX, Linux or Windows Vista or as an add-on, like Windows XP. If you have the traditional setup with a computer connected to the Internet through a DSL router, the latter is being assigned a dynamic IP address. Your computer in turn is being assigned an IP address by the router, typically out of a private address space (per RFC 1918).

What we need now is a way to tunnel trough the hostile IPv4 environment to connect to an IPv6 Internet. The specifications are defined in RFC 4380 and nicknamed Teredo. There is an implementation for Unix-like operating systems called Miredo. And for those of you who are uncomfortable editing Makefiles and compiling source code, the good news is that there are pre-packaged versions for MacOSX and Ubuntu Feisty (just type “apt-get install miredo”. You should have the universe repository active).

I tested both and they work out of the box. I am actually editing this post through an IPv6 tunnel over a straight IPv4 ADSL connection. Pretty amazing.

I did not test the MS Windows implementation. However, since Microsoft wrote the specs, I suppose it should be quite easy to set up there, too. Some tips are available at the IPv6 Task Force web site and Microsoft‘s own site.

What does that bring to you ? Well, first you will be considered a certified geek by your neighbourhood. More seriously, not much right now. What I notice is actually that my connection is slowing down. This may be due to the fact that tunnelling a protocol through another one is never efficient. Also, the peering agreements between backbone operators are not as optimal as they are in the IPv4 world. But at least, I am ready for the future.

I was reading this article this morning on IPv6 vulnerabilities and specifically the IPv6′s type 0 routing headers. The recommendation is to disable the routing of these headers, as they have no practical purpose anyway.

After doing some Googling, I read that this kind of header was disabled by default in Linux kernels starting with version 2.6.20.9. This server is running version 2.6.9-42. The workaround here is to filter out those packets at the firewall level. Fine, except for the fact that ip6tables on RHEL4 and CentOS4 does not include the plugin to filter out the routing headers. Hence, you need to recompile the iptables package with the ip6rt module enabled. That’s just a small Makefile editing.

To make life easier for you, here are my RPM and SRPM:

iptables-ipv6-1.2.11-3.1.isoc.i386.rpm
iptables-1.2.11-3.1.isoc.src.rpm

Once installed, do not forget to add the following lines at the top of the /etc/sysconfig/ip6tables file, near the top and before allowing anything else :

-A INPUT    -m rt --rt-type 0 -j DROP
-A FORWARD  -m rt --rt-type 0 -j DROP
-A OUTPUT   -m rt --rt-type 0 -j DROP

Of course, if you are not running IPv6 at all, this is not an issue for you. And if you are using another distribution, your mileage may vary, as they say.

I did some checks on the start-up time of the three operating systems I have on my MacBook. They are fairly equivalent in terms of functionalities. I could use either one to get the job done.

The job is not that difficult to handle. Mainly it consists of web browsing, e-mail and general documents. I have Firefox,Thunderbird and OpenOffice on all platforms. In the case of MacOS, I use NeoOffice instead. It nicely integrates with the Aqua GUI and does not require to load X11 to work, like the official OpenOffice version.

Further, with MacOS, I can close down the lid of my laptop and know it will work when I reopen it. With Ubuntu, I have a 50% chance (risk ?) to need to reboot and loose whatever work I was doing.

I guess I have a good reason to boot MacOSX more than the other two.

A while ago, I pointed out the very bad decision taken by Dexia-BIL bank in Luxembourg to use a Macromedia Flash applet to defeat phishing attempts. Competition being what it is, the number one bank in Luxembourg, BCEE, could not afford to sit and watch. They just copied the idea.

As was pointed out in the case of Dexia-BIL, the system is very user-unfriendly. However, customer-friendliness does not seem to be part of the equation.

Somehow, banks feel responsible for the fact that their customers are clueless when it comes to Internet e-mail. Rather than educating them, they think it is smart to protect these poor souls against themselves and their naivety. Or it could be the legal department telling the IT guys they have to find a way for the bank not to be held liable in case a customer would sue them if he fell victim of a phising e-mail.

So, again let us remind the banks and their customers how to fight phishing attempts:

• Use common sense. A reputable bank does not send e-mails asking for personal information they should already have. Actually, a bank does not use e-mail to communicate with customers. They are convinced you are always available to walk to their branch office during office hours, and that you have nothing better to do.
• Ask your ISP to filter out phising attempts in incoming e-mail messages. The cost is low. Open source tools do a wonderful job at that. MailScanner and Amavis-new do it for free. If your ISP wants to spend a lot of money, there are commercial products, too. If it is unwilling to do that, there is still client-side software. But you should rather move to an ISP which cares about its customers. In the “ISP” acronym, “S” stands for “Service”. If there is no service, vote with your feet.
• Avoid broken mail clients that display HTML by default.
• Double check the hyperlink you are clicking on.

And if you are too dumb to do any of the above, avoid accessing your bank account through the Internet and go to the branch office for every transaction. At least, this will give additional work to the clerk behind the desk and maybe he will be able to keep his job, rather than being fired because “customers use the Internet anyway”.

Update: 2nd March 2007: The bank confirmed they want to use Flash to defeat key loggers.

1. Key loggers are a “feature” of MS Windows, mostly. Well conceived operating systems do not allow the installation of such malware. The choice of the operating system is up to the user. He is free to upgrade to a more secure one. If he does not, that is his problem not the bank’s.
2. On the Windows platform, key loggers should be intercepted by the anti-virus program. If it does not, that is the user’s problem not the bank’s.
3. While the Flash applet may help defeat the key loggers on the Windows platform for the specific use of the online banking service, it does not solve the general issue of the key logging malware on the Windows platform in general. In fact, this would give the false impression to the clueless user that he is protected against key loggers, while in fact he is only protected for a specific application and not when using his credit card on Amazon or elsewhere.

The only conclusion one can draw from the whole thing is that the bank wants to be legally covered in case a customer complains. Security has nothing to do with it. The bank could easily disclaim liability in case the user does not implement the right security tools on his computer. It could, for example, disclaim liability in case the browser allows the installation of malware, which is typical of Internet Explorer.

The original post is after the break

My bank, Dexia Luxembourg, has recently changed the login procedure to their online banking system to use a Macromedia Flash applet. My guess is that they want to find a way to defeat phishing and key loggers. I said “my guess” because bankers are not known for communicating much with their customers, even less to actually explain their decisions. The customer is just too stupid to understand … This is just another guess.

Using Flash is a real bad idea, because it is proprietary technology. If and when Adobe decides to drop the whole thing or change the specs, or ends the support of one of another platform, the bank and its customers will be stuck.

Some years ago, the same bank had an authentication system that required the Microsoft Java virtual machine. Not only did it not work on non-M$ platforms, it did not work either on all those Windows based computers that ran Sun Java. Apparently, the bank did not learn from its own recent history.

Flash is only available on a limited number of platforms: Windows, MacOSX and Linux. The statistics of this web site indicate that only 82% of the browsers support Flash. Although this is certainly not representative of Dexia’s customers, it shows that not all users have the Flash plugin installed in their browsers. Why they don’t is a question the bank should ask itself. Maybe they have good reasons.

In many corporate computing environments, there are security policies which prohibit the download or use of some software. Windows network administrators can block the use of certain files types or programs with a few mouse clicks. As Flash is increasingly being used to deliver video content, which eats up the corporate bandwidth, I would expect that some companies will prevent Flash to be used in their environment. Too bad for the bank’s customers wishing to manage their checking account from their office.

There are other reasons, too:

1. Phishing fraudsters need to work quick. That means they have to find as much victims as possible in a very short time frame. The best way is to target banks with a huge number of customers, like Bank of America or HSBC. A small bank like mine is unlikely to be a target for fraudsters.
2. There are enough tools the ISPs can deploy to identify phishing attempts in e-mails. In Luxembourg, most of the ISPs do not filter spam or charge for filtering. Too bad. But again, it is up to the customer to vote with their feet and select a professional ISP.
3. The user should be suffciently aware by now that a real bank never sends an e-mail asking for access codes. It has been repeated over and over again in all languages and in all media. Unless you are just arriving from Mars, you should know. If you don’t, I am sorry to say it is your problem now and that you should bear the consequences of your ignorance. It is not up to a bank to set up strategies to work around clueless users.
4. The Internet is no different from the real world. You would not drive a car before learning how to drive. Similarly, you don’t believe the average salesman ringing at your door. Some people totally lose their common sense when they are front of a computer, forgetting the Internet is a ugly medium for a ugly world. But it is not a bank that is going to change this perception.

In the case of this specific Flash applet by Dexia, the design is poor, to remain polite. Its interface requires a mouse and even then, it asks you to place large areas into small boxes.

There is apparently a competition for the most unfriendly application ongoing between Dexia offices throughout Europe. At the same time the Luxembourg branch threw this awful Flash applet at its customers, the Belgian Branch did even worse.

They now require to have your Maestro card and a special random code generator, both of which you are most likely to have with you in a cybercafé in Shangai or elsewhere. It takes 9 steps to log in. And the same steps again every time you need to confirm an order.

Dexia Belgium wins the price of the most unfriendly Internet banking application, with Dexia Luxembourg close second.