Board games on the iPad: a technology showcase

Of the thousands and thousands of titles available for the iPad and tablets generally, a genre where the device comes into its own is that of board game conversions.

A number of excellent implementations of genuinely absorbing strategy board games (as well as more traditional games such as Scrabble and Monopoly) are now available, with more being continually added to the list. Here are a couple of favourites I have reviewed recently:

• Settlers of Catan, something of a "classic" among strategy board game fans, works particularly well on the iPad and in this implementation includes (as in-app purchases) the Seafarers and Knights & Barbarians extensions, making the iPad version extremely good value for money.
• Stone Age is a more recent board game, involving a combination of "resource gathering" as found in Catan along with turn play revolving around "strategic choice of actions". The iPhone implementation discussed in the review is very playable, faithful to the original and attractively presented, with a high-resolution iPad version on the way. In the meanwhile, the iPhone version will play on the iPad, albeit in slightly low resolution if you have a non-retina iPad.
• Puerto Rico and its card game cousin San Juan are both available for iPad. Puerto Rico features an admitted slightly crowded screen in order to fit on the entire game board and islands of up to 5 players. Its card game cousin San Juan is slickly presented and its less complicated layout lends itself well to the iPad.

A key features of all of these implementations is pass and play mode, to which the iPad clearly lends itself. Like many other board game fans, I look forward to seeing what further offerings become available over the coming months and will post reviews of my favourites to the Multimobilia site.

LetterMeister for iPhone free for limited period

The LetterMeister word puzzle game published on this site is now free to download for a limited period, reduced from the regular price of $1.99 Take advantage to download your copy now!

If you have a QR Code reader for iPhone, then scan the image to the right. Else search for LetterMeister in the App Store for more information.

The desktop version is also available for Windows, Linux and Mac OS.

New comments and links facility being rolled out

On most pages of the Javamex programming site, you can now add feedback and questions to the articles. Look out for comments boxes in the following locations:

• in the box to the right of the main page;
• in the box at the top right of certain "popular" articles;
• in the box at the bottom of the page beneath most articles.

Some popular articles on the site where we may expect to see comments include the sections on the Java volatile keyword and synchronisation, Java threads (which includes various tutorials on threading and multitasking in general, including thread scheduling) and random numbers, which looks at various pitfalls associated with using the standard Java random algorithm and how and when better algorithms should be used, e.g. for security purposes or to improve "simulation" type applications.

It is hoped that by having this comments facility, both regular and new readers of the Javamex programming tutorials will be able to engage in discussion and improve both their knowledge and the content of the tutorials.

Encrypted world war II droppings

The public's imagination has apparently been captured this month by stories of an encrypted World War II message found attached to the leg bone of a carrier pigeon that had apparently been lodged in a chimney in Surrey for the past 70 years.

There doesn't seem to be complete consensus on the identity of one or two of the letters, but a transcription of the message looks essentially as follows:


AOAKN  (.)  HVPKD   FNFJW    YIDDC
RQXSR        DJHFP      GOVFN   MIAPX
PABUZ        WYYNP   CMPNW  HJRZH (.)
NLXKG       MEMKK   ONOIB    AKEEQ
WAOTA (.)  RBQRH    DJOFM    TPZEH
LKXGH        RGGHT    JRZCQ     FNKTQ
KLDTS         GQIRW    AOAKN

The dots in parentheses probably aren't part of the encoded message as such, assuming word/phrase/sentence boundaries were not explicitly encoded. But they may be a clue to such boundaries, with the scribe inadvertently inserting them as they came to the end of a sentence/phrase. They suggest that at the time of transcription, such boundaries were still present, probably ruling out a system akin to today's modern block ciphers.

Notice the sequence "AOAKN" appearing both at the start and end, which is presumably not part of the encoded message, but possibly a reference to the encryption key, some kind of "message start/end codeword", or some kind of authentication sequence.

So what does the message say? Can it be decoded with modern computational methods? Simple schemes such as letter substitutions and even variants of the FairPlay cipher apparently used at one point during WWII could potentially be deciphered.

But despite various rumours and hypotheses I have seen on a few Internet forums, unfortunately, the distribution of letters in our mystery message appears to be consistent with encryption using a one time pad. In a one time pad, one "mixes" each letter in the message with the next letter of a secret randomly generated sequence known only to the sender and recipient. If implemented properly (meaning the stream of letters forming the one time pad has to be genuinely random and never re-used for multiple messages or parts of messages) then this scheme is completely secure. (Modern stream ciphers are inspired by the technique, but rely on a generating a pseudorandom sequence from a relatively small secret random key; as with modern cryptographic techniques in general, they are "secure enough in practice for the use to which they are put" if their usage guidelines and limitations are properly understood.)

One hope for "cracking" the message would be if the such a scheme was not implemented properly (for example, using as "secret" one time pad a sequence of letters based on a known text such as the American Constitution, or indeed any text in a common language with well-studied letter/word distributions.

One other thing seems clear: if the message is crackable without more information, the people with the tools and knowledge to crack it are GCHQ if they can be bothered.  So my guess is that (a) with minimal resources and standard tools they have decoded the message and this is a recruitment drive, or (b) GCHQ have ascertained the scheme is some variant of a one time pad (or not something they can trivially decode with the resources they can be bothered to devote to some one-off 150 character message from World War II) and what is being sought is some of the "social" knowledge around locating the key/clues to its generation in case they can then idly decode it with close to zero effort.

And in the worst case, the story has revived public interest in history, mathematics, computing etc while being a temporary distraction from the humdrum financial turmoil and political scandal which otherwises graces our news outlets.

Reading environment variables and system properties in Java

The first of a new section of forthcoming tutorials "miescellaneous and system" features of Java, a new tutorial has been added on reading environment variables and system properties in Java.

The tutorial looks at issues such as:

what technically is the difference between OS environment variables and Java system properties?
commonly defined properties for cross-platform use
how to enumerate environment variables and properties, including how to unify the two separate APIs.

As usual, comments, feedback and requests for new tutorials are welcome via the Javamex forum.

Java 7 patched, although there are still reports of vulnerabilities

The reported vulnerability in Java 7, which allows untrusted code to override the SecurityManager and hence run malicious code on a client machine, was patched by Oracle on Thursday. Java 7 Update 7 fixes the vulnerability in the form in which it is actually known to be being exploited "in the wild".

General users can download the update to Java here.
Developers can download the update here.

There still remain reports that the patched version still contains a vulnerability allowing the SecurityManager to be overridden, but not in a form currently known to be being exploited. You are advised to "watch this space"...!

Serious vulnerability in Java 7: another nail in the coffin for Java as a client-side web technology

On Monday, an "extremely critical" vulnerability was announced in version 7 (i.e. all versions 1.7.x) of the Java Runtime.

The vulnerability is effectively that Java's Security Manager settings, controlling permissions that govern critical operations such as file access, network connectivity, running external processes, can be overridden. In particular, the Java web browser plugin normally sets security restrictions ("sandboxing") meaning that arbitrary files cannot be read from the host machine and arbitrary processes cannot be started by a Java program embedded in a web page. The vulnerability discovered in Java 7 effectively allows these restrictions to be bypassed (specifically, this example code does so by making reflective calls via the Javabeans framework).

This vulnerability-- more so than previous cases, it seems-- has sparked a strong message from many commentators that Java applets are no longer a fundamental part of the web infrastructure. The advice given by many industry commentators is that Java is not needed by most users and should be disabled: the security risk it poses outweighs the benefit for non-specialist users.

If for you, Java is still a "core" piece of web technology, then less extreme action you could take:

• using Google Chrome, go to chrome://plugins and ensure that the Java plugin is not set to "Always allow" and only run Java on sites that you trust;
• use another browser, with Java disabled (or a device such as the iPad that doesn't support Java) for browsing sites that are not in your "trusted" list;
• when using a public network (e.g. in a coffee shop etc), use a browser or device that does not have Java installed (e.g. your iPad is safe);
• if you have to use your laptop over a public network with a Java-enabled browser, do so over a VPN.

Of course, whenever you browse to an untrusted web site and/or use a non-encrypted connection over a network with components that are easily controlled by a third party (e.g. in a miscellaneous coffee shop) there is a tangible risk from various possible vulnerabilities. What arguably makes this vulnerability different is that: (a) it is relatively easy to exploit by an attacker; (b) in the race to close the vulnerability, the Bad Guys currently have the "upper hand": an exploit has already been integrated into standard hacking tools whereas no patch is available or announced (at the time of writing).

So... check your Java settings and watch this space!

Update: a patch has been released which partially addresses this vulnerability.