Ok Google, Open my curtains!

Finally I've found a worthy enough reason to write a blog post.

I've been wanting to make the curtains in my home "smart" for a while now. I have what is called "grommet curtains"  and there are apparently no off the shelf solutions to automate this. There is this kickstarter project called Slide which retrofits to any curtain type, but that is still in its early stages and a bit pricey (~$150).

I ran into a tutorial which spoke about automating grommet curtains. But they used a 3d-printer to print custom designed components which wasn't an option for me (I don't have a 3d printer and i don't have any knowledge of how to design components for a 3d printer).

I borrowed the basic idea from that video. Two pulleys at either end with a rope running around them. One of the pulleys is attached to a servo which is controlled by a microcontroller. Here's an awful sketch of the idea:

Here are some of the challenges faced/things i did:

• There is no cheap off the shelf servo that has a pulley attached to it. So i had to tweak around to figure out a way to mount a pulley to the servo.
• The load on the servo to pull the rope along with the curtains is pretty high. So the servo has to be mounted securely to the wall. I first tried a heavy duty double sided tape, but that wasn't enough to withstand the tension of the rope. I then tried out various things and found a mount that could be screwed into the wall.
• The wall mount for the servo held it too close to the wall and there was no room for the pulley (whose diameter is larger than the breadth of the servo) to fit in and rotate smoothly. So i used a couple of washers behind each mounting screw to give enough room for the pulley.
• To tie the other pulley (which has no motor), i simply used a rope to tie the pulley on to the curtain rod's mounting bracket.
• The servo had to have metal gears in order to have enough torque to pull the curtains. But such servos need a minimum of 4.8 volts of power. I found a NodeMCU board which had a 5V pin to supply enough power to the servo.

Here are the list of parts with links to where i bought them:

* NodeMCU (ESP8266) microcontroller (model with 5V pin) - Amazon - $5.98
* Jumper wire (to connect to the 5V pin) - Amazon - $5.24
* MG995 Servo (360 degree, metal gear, digital model) - Amazon - $10.99
* Servo wall mount - Amazon - $12.99
* Washers - I just used a couple of old washers lying around. Equivalent link: Home Depot - $2
* Pulley (for attaching with servo) - Servocity - $3.49
* Pulley (for the other end) - Home Depot -  $2.47
* Rope - Home Depot - $3.98
* Safety pins - Amazon - $3.15

Total Cost - $50.33 (some of it can probably be gotten for a cheaper price on ebay/gearbest/aliexpress).

Ok, with all that out of the way, let me explain how exactly i built and programmed this.

Step 1 - Attach pulley to the servo

Attaching the winch pulley to the servo is quite straight-forward. I screwed in the 4 pieces of the pulley with 2 bolts (on diagonally opposite ends) and small hex nuts. I then attached one of the servo horns to the other two holes of the pulley with two small screws (that came with the servo).

Now, the servo horn can merely be screwed into the servo until it's fairly tight.

Step 2 - Install the mounting bracket

After marking two spots with the mounting bracket's holes, i drilled in two drywall anchors on those spots. Then use two screws to screw the mounting bracket into the wall placing two washers in between the mounting bracket and the wall. This makes sure there is enough room to mount the servo along with the pulley.

This is the bracket i used to mount the servo to the wall

Step 3 - Attach servo to the mounting bracket

This is very straight-forward. The only catch is i used two nuts instead of 4 to attach the servo on to the mounting bracket.

Servo mount with washer behind. Pulley attached to the servo.

Step 4 - Mount the pulley on the other end

I used a small rope to tie the pulley on to the curtain rod's mounting bracket on the other end. A nut and bolt can also be used but since the rope worked for me i didn't look further.

Step 5 - Tie the rope on to the pulleys

Loop the rope around the pulley without the servo once. In the servo end, loop the rope around the pulley at least twice and then tie a really stiff knot. Make sure that the rope is really tight. Cut off any extra rope since it could cause friction when the rope is moving.

Rope tied to the pulleys and attached to the curtains.

Step 6 - Attach the curtains to the rope

I used a couple of safety pins to attach the curtains to the rope. I set the curtains in fully closed positions and then attached each half to one of the ropes. When the pulley spins, both the ropes will move in opposite directions thereby opening each curtain outward. The same process is reversed to close it.

Curtains attached to the rope with safety pins.

Step 7 - Program the microcontroller

This is my first foray into programming a microcontroller and surprisingly enough it was really simple. The NodeMCU ESP8266 board is a $5 wifi enabled board. Wifi means that you can send commands to it through simple HTTP requests.

Here's the arduino sketch i used to make a simple HTTP server that supports 3 commands: left, right and off (which spins the servo left, right and turns off respectively): https://gist.github.com/vickyg3/94b80435fa10a58691f563f643aaf807

Once this is flashed into the board, controlling the servo is simply a matter of "curl http://<ip>/left".

Step 8 - Mount the microcontroller

I mounted the microcontroller near the servo (using a small double side tape on the wifi chip) and just attached the servo wires to the appropriate pins (i used a jumper wire to connect the power wire to the 5 volt pin). I then ran a long micro-usb cable that i had lying around to power the microcontroller.

Step 9 - Home Assistant configuration

I added this to home assistant as a command line cover that used curl. Here's a sample configuration:

Where curtains.sh contains the following:

I determined the time to sleep between rotating the pulley and turning it off by trial and error. It usually took more time to close than to open because the set up struggled a bit to pull the curtains in that direction. It now shows up in home assistant, like so:

That's it. You can now include this in your automations, etc. I have set up automations like close the curtains after sunset, when we are away and so on.

If you have your home assistant tied to google assistant, you can control the curtain by saying "Ok Google, Turn the <curtain name> on/off". If you want custom commands, you can also try ifttt with google assistant to have commands like "Ok Google, open my curtains!".

Here's the Eureka moment

Some cons of this system:

• The servo is a bit noisy. This is probably ok given that curtain control is not too frequent. It is probably bearable for 10 seconds or so once in a while.
• Hooking up the curtains this way makes it impossible to control the curtains manually (since the curtains are tied to the rope). I've worked around this by sticking a button next to the curtain by the wall for those scenarios where we don't want to use voice control. Pressing the button will open/close the curtain.

  

  Button to control the curtains in lieu of voice/phone control.

Comments and suggestions about improving this in any way are welcome!

Playing With Technology - Break Bob's Account!

Folks,

In this edition of Playing With Technology, we have yet another simple challenge. Go ahead and enjoy it!

Scenario

Bob is a famous underworld hacker. His systems are known to be of proven security. He has recently launched a public website to which only very few of his friends have access. He has an admin account where he manages all the user accounts. Your goal is to login into the admin account and find the secret key! Bob generally is too confident about is system's secureness and hence he chooses only passwords of length 4. Also, he enforces an hourly limit of 30 hits to his website. As with the previous hack, clues and hints can lie anywhere and everywhere!

Bob's Website: http://foamsnet.com/pwt/bob_account/
Username: admin
Password Length: 4
Hourly Limit: 30 requests per hour!

Once you find the key, Post it as a comment in this post. I will approve all the comments once i reveal the answer and will aggregate all the correct responses along with the answer.

-Vignesh

PWT Solution - Reach Alice's Website

Hey guys,

Thanks for the overwhelming response for the first PWT post. Here is the solution and explanation for "Reach Alice's Website" hack.

You can view the question here.

To give away the solution in a briefly, it is about "HTTP Referer field in the request". HTTP requests can have a field known as the "Referer" which will contain the URL of the point of origin of that particular request. By looking at the Referer, the current page can find out where that particular request came from. Since it is easily forgeable (like in this hack), referers are generally used only for statistical purposes and none of the application level logic will rely on this field.

So yeah, the solution is, just send a HTTP request with the "Referer" set as "http://www.fakehackersworld.com" and you will get the key.

Here is a sample request without the Referer field set:


Here is a sample request with the Referer field set:


List of persons who completed this task

Please view their original comments to see how they did it.

• Varunkumar Nagarajan


• Viswabharathi


• Raghav


• Azhagu Selvan SP

Congrats to all of you !

The good response that i have got for this post will definitely keep me going about PWT! Thanks guys!

-Vignesh

Playing with Technology (PWT) - Reach Alice's Website !

Hey folks,

This is my first series called "Playing with Technology (PWT)". I will post an interesting real time question related to some technology for you to play around with. It will involve anything and everything i am familiar with. You may have to write scripts, perform hacks, etc. There are no rewards involved. It is just to share the minimal knowledge i possess in the form of an interactive series.

PWT will kick off today with a very simple real time hack that i call as "Reach Alice's Website". Go ahead and enjoy the hack.

Scenario

Alice (yes, our same good old friend Alice) owns a website. Recently, her website was acquired by Hackers World Inc. (http://www.fakehackersworld.com). The CEO of Hackers World considers this acquisition as a very confidential one and decides that all traffic to Alice website should only come through Hackers World website. But the sad part is that, Hackers World website is accessible only to the employees of Hackers World. Your goal, being a hacker, is to somehow reach Alice's website through Hackers World website and acquire the secret key from there!

Alice's Website: http://foamsnet.com/pwt/visit_alice_site
Hackers World Website: http://www.fakehackersworld.com

Remember clues can be lying/hiding in anywhere!

Once you find the key, Post it as a comment in this post. I will approve all the comments once i reveal the answer and will aggregate all the correct responses along with the answer.

Update: The solution has been posted here

-Vignesh

Bom Sabado - The orkut virus !!

If you are still one among those who give a damn about orkut, then this might be one thing that your really care about. Today, orkut has been hit by a vulnerability that is really a security threat for your account.



The virus is called "Bom Sabado", meaning "Good Saturday" in portugese. This is yet another XSS attack, thereby making it the second XSS attack on a major website this week. Earlier this week, Twitter faced a similar attack. There is no official update from google yet on this issue.

What does it do?

When you open orkut and if you are affected by this virus (which could be possible if one of your friends are already affected), a piece of javascript will automatically run doing the following:

• Makes your browser hang for a moment


• Adds you to the attacker's communities (orkut equivalent of facebook fan pages) without your consent


• Sends a scrap (orkut equivalent of facebook wall) to all your friends without your consent, with the text "Bom Sabado" and a piece of code that will do the same set of actions when your friend log in to his/her account

How to prevent this?

• Unlike the twitter XSS attack, this is a severe one that steals your cookies and thereby impersonate your session. If you have logged in to orkut anytime today, clear your cookies and cache of your browser.


• To be safe, change your google account password and security question. To do this, go to https://www.google.com/accounts


• Do not visit orkut until google officially says that they have fixed it. For updates, keep looking here


• If your account seems to be behaving crazy or if its totally compromised, then see here for a solution.


• Delete your orkut account and join facebook !

I badly want to use orkut now!

If you badly want to use it now, then you can use this minor hack to do that. The virus seems to be loading the malicious javascript code from tptools.org and hence you can tweak this to point to something else in your hosts file.

Edit your hosts file (Windows - C:\windows\system32\drivers\etc\hosts; Linux - /etc/hosts) and add the following lines: 127.0.0.1 tptools.org
127.0.0.1 www.tptools.org
This tweak will make tptools.org will to resolve to your own system and hence the javascript will fail to load. Note that you are at your own risk, i am not responsible if your account gets compromised even after you make this tweak !!

I will try to update this post once there are some official responses from google.

-Vignesh

Twitter onMouseOver Saga - XSS and much more !!

There cannot be a better time for me to write about XSS as the famous twitter recently came across with an XSS vulnerability that was exploited by many all around the world by forcing users to redirect to some illegal site or post/retweet stuff without their consent, etc. What the hell was wrong with twitter ? Why did all this happen ? In this article, i have tried to answer these questions.



First let us be clear with the terminology. XSS stands for Cross Site Scripting (It is not called CSS because CSS already refers to Cascading Style Sheets). XSS is a way of injecting malicious code into a web page so that the users are troubled, user data is stolen, etc. If you don’t understand what that means, read along, you’ll understand it by the end of this article.

Before going into XSS, let me give a brief introduction about what Client Side Scripting is. Client side scripting (I don’t want to abbreviate this as it will again end up as CSS!) is nothing but a piece of code that gets executed within your web browser. When you open a website, the website is rendered as HTML along with some Client Side Scripts. For example, you click on a piece of text and a pop up appears saying “hello world”, then it is a simple script that has been run within your browser. An example of a client side scripting is JavaScript.

JavaScript can do things like redirecting the user to another website, accessing personal data (in the form of cookies, etc.) and much more. Twitter gets data from the user (in the form of status updates) and displays them in your timeline. Since client side scripts are nothing but pieces of code embedded along with HTML, the displaying part of twitter has to be clever enough to distinguish scripts and escape them (a simple example of escaping is to replace > with &gt; and < with &lt; as that will avoid the browser from misinterpreting data posted by user as an HTML tag - another simple example would be using printf(“\\n”) in C to literally print \n in the screen and not a new line).

Similarly, JavaScript code has to be escaped properly before being displayed or else there is a possibility that the browser will misinterpret the data posted by the user as JavaScript and start executing it which might cause potential damage. If the escaping is not done properly, then the attacker (usually the person who is always one step ahead of the developer) will be clever enough to exploit that display method to inject malicious JavaScript code to cause damage. Such an improper display mechanism is known as a XSS vulnerability and the attacks exploiting XSS vulnerabilities are known as XSS attacks. Twitter faced one such attack two days back.

Now to better understand how XSS attacks are performed, lets call our friends Alice, Bob and Oscar for help. So the following sequence of steps explain how an XSS attack is performed:

• Bob hosts a website (in this case www.twitter.com) where users are allowed to make posts


• Bob's website has an XSS vulnerability (in this case the javascript onMouseOver function vulnerability)


• Alice and Oscar are users of Bob's website and Alice can view updates posted by Oscar (in twitter lingo, Alice is following Oscar)


• Oscar spots the XSS vulnerability in Bob's website and decides to exploit it. So he makes a post that exploits the vulnerability (in our case redirect the user to some illegal website when he moves the mouse over the post)


• Alice eagerly opens Bob's website and is redirected to a totally unexpected website as she accidentally moved the mouse over Oscar's post (to be worse, while her mom is watching from behind ;-))


• There is also a possibility that Oscar can exploit the vulnerability and steal Alice's session information (cookies) and impersonate Alice


• Thus, Alice is screwed (as always) !!

It is really bad that a website in the scale of twitter had such a vulnerability. But after all, no product is perfect. An official blog post from twitter said that this bug was created as a result of fixing some other issue. I personally feel that a company like twitter cannot afford to give such a lame excuse for it could have caused many celebrities profiles to have posted spam tweets and much more damage. Nevertheless, sites like twitter, facebook, etc. are the primary target for attackers these days and hence security precautions always has to be the number one priority.

Read more about this on twitter's official blog here.

-Vignesh

Linux X Server - Awesome Abstraction !! :-)

Before you start reading this, a headnote, this article is targetted for people familiar with linux. Though i have tried to keep it as simple as possible, some parts of this article may seem greek and latin to those who are not familiar about linux.

To start with, as the title suggests i am gonna talk about the Linux X windowing system. Before starting, there have always been so many things about linux that have been controversial (like Vi vs Emacs and Linux vs GNU/Linux to name some - people who are not familiar with all these, just ignore and read on). Linux has always been (atleast according to me) distinct in its way of organizing itself so that the users can extract maximum output of it. Adopting strictly to the basic open source principle of "choice". Briefing it in a nutshell, linux and its companions have always adhered to the goal of providing the maximum choice for its users (best example is the number of linux distributions out there (ubuntu, fedora, suse, etc)).

The linux way of architecturing a product or its feature is in such a way that it can be extracted to the fullest. I am going to write about one of the best examples of such an architecture that linux has built over years, the X Windowing System. So, what the hell is it ? If you are a linux user, you are most likely to be using the X right now. If you have seen linux before, then you have probably seen X. Before talking about the architecture of the X windowing system, let me give a brief introduction about it.



The X windowing system is the basic graphical user interface in linux. The X protocol specifies the way the windows are displayed on the screen. So whats the big deal about it? All the operating systems have some such thing that is used to display stuff on the screen. Yeah, thats true. But the way X does it is significantly different and i shall say, the designer of X is a real out-of-the-box thinker.

If you or me were designing such a system that is used to display stuff on the screen, all we would have done is make a level of abstraction over all the processes that requires display and just draw whatever is requested by the processes simply on the screen. X does just this. But how it has layered itself is what stands out.

First some terminologies. The programs which require to display something are known as the X Servers. The entity that actually interacts with the screen and draws stuff on the screen is known as the X Client. People generally tend to confuse this with the client-server model whereas this is actually client-server model with the roles reversed. In general, the guy who provides service will be called the server whereas here the guy who requests service is called server. (I still could not figure out why this terminology is followed).

The X server and client communicate via sockets. This is where X stands out. Since they communicate via sockets, yeah you guessed it right, it does not matter where the client and server runs (whether on the same machine or not). The TCP/IP stack of the OS takes care of the abstraction in how the requests and responses reach the client and server. So, the client can be any running application (even on a computer without a monitor attached to it) and the server can be any computer (of course with a monitor attached to it). As long as the client and server can communicate with each other via a network, it is possible to access both the computers using a single monitor.

Though this might sound fairly trivial today thanks to a bunch of remote GUI software available in the market, this is something that has been so well thought on those days when X was designed. It is when i see such wonderful designs i realise my college HOD's phrase "More the abstraction, Better the survival".

This article may even be a piece of junk. But i just could not resist blogging about such an awesome design.

P.S.: Seriously, you can scold me openly. :-)


-Vignesh

Google's Funky Secure Search ;-)

Google has been one company which has always have been a dream of every IT professional. They always have a unique approach in everything they do, right from search to mail to docs. If there was one thing for which google was always under the spotlight, it was for privacy (A tit bit: google search privacy policy has approximately 2000 words in it - run this command to verify if you are in linux "wget http://www.google.com/privacypolicy.html > /dev/null 2>&1 && wc privacypolicy.html && rm privacypolicy.html" - it will print the number of lines and the number of words in google's privacy policy). Google has always faced issues regarding privacy.

Ok first of all, lets define privacy with respect to internet. Defining privacy is simple, when you are on the internet, noone else should be bothered about what you are doing. The service provider's job in the internet is just to give you what you ask for and nothing else. You don't expect the service provider to develop an intelligence about your needs. They should just serve you and get lost. This is totally fine from your perspective. But the service provider thinks this way, he gives you what you want now and then collects information about whatever you ask him. Later when you are unsure of what you want, he suggests you with something based on the information he has. You are really happy that the provider is able to assist you. Now here comes the question of privacy, how do you trust the provider? What if he gives the information that he possesses about you to someone else, thereby revealing your personal self.

Not just google, the internet always had privacy concerns right from the moment it started growing (for example, the exponential growth of the size of facebook privacy policy over the past few years). If you have been following news, Google China Controversy has been a central point of talk (even in indian news channels). Google has always been criticized for not respecting the users privacy. There has even been a group of google employees who quit google and formed their own search engine with literally 100% privacy (Visit Cuil Here).

After a really long time, google has introduced the concept of secure search. First and most important of all, secure search does not imporve your privacy relations with google. Privacy issues directly between you and google remains the same. Its just that, intermediate nodes between you and google will not be able to capture any information about you. Google made gmail secure by default earlier this year and now search is secure too. And google is also looking of making search compatriots like (image search, video search, etc.) to be secure soon too.



Google secure search operates in https://www.google.com. There is an interesting point to note about this URL. I will come to that in a while. Before that, I will talk about a point that secure search can cause. Academic institutions and companies block certain websites (most of the academic institutions block urls with words facebook, orkut, etc.). Now that google secure search is introduced, it can bye pass the filters set by the network administrator. For example, your network administrator says, dont allow any queries containing the word "porn". Now this filter fails while using secure search as the query is encrypted, it never matches the filter.

A simple solution to this problem is to block secure search as well. This means the network administrator will have to block any URL that starts with https://www.google.com. This solves the aforementioned problem. But here comes the funky point about the URL i was talking about. Google uses the same url for all the websites that are being authenticated by a Google Account (gmail, orkut, youtube and almost all the google products). If you had noted before, gmail's login page URL will start with https://www.google.com/Accounts followed by some other stuff (if not just goto gmail's login page and see it now). So, if the network administrator decides to block all the URL's beginning with https://www.google.com, then the users in the network will be denied access to almost all of google's services.

Nevertheless, google has thought of this problem only after the launch of secure search and is aiming to fix it by moving secure search to some other domain (something like secure.google.com may be). Here's a link to the post in google's official blog that talks about this issue.

UPDATE: Google has fixed this now and have moved their secure search to https://encrypted.google.com :-)

This post was just to explain the funky problem that google has caused the network administrators all over the world (especially in academic institutions like PSG Tech :P). Comments welcome as always :-)

-Vignesh

IRCTC and the TCP/IP Protocol Stack :-)

"Indian Railway Catering and Tourism Corporation (IRCTC) is a subsidiary of Indian Railways that is responsible for handling catering, tourism and online ticketing operations of the indian railways"
- Wikipedia.

We all know IRCTC as we see it whenever we book a ticket, we drink tea/coffee in a railway station, etc. In this post, i am going to talk about one of the ever existing nightmares of indian train travellers - Tatkal ticket booking.

Indian railways has a famous system known as Tatkal (which in sanskrit means instant) reservation scheme which allows us to book tickets two days before the departure of the train throughout the year. This is like the golden gem for last minute planners. Oh this seems great, i can book a ticket two days before? Of course its not as simple as it sounds and there are loads of hassles around. Since tatkal bookings open only two days before the date of departure of the train, bookings are opened by 8 AM (IST of course :P) and you might by now be thinking, 8 AM - No big deal. I can be in the railway station booking counter by even 7 AM. You're still not doing good as there are many people who are already in the booking counter queue waiting from 3 or 4 AM in the morning or probably from even the previous night (yes, it happens!).

Ok, so the booking counters are flooded by persons on morning, i even have a better way now, i am a very modern person, i don't go to the booking counters and stand in queue for booking rail tickets, i just boot up my system, point my browser to irctc.co.in and voila! I have the ticket booked in a matter of seconds. Well, this process seems to be fairly trivial and simple. But unfortunately there are even bad hassles involved in this process.

First of all the website itself. People who travel a lot by train might always be cursing the government website irctc.co.in for screwing up their last minute travel plans almost all the time. The website server is either down (meaning the website is unaccessible) or doesn't provide service as expected (which is an obvious requisite). The following is the timeline of what generally a layman does for booking a tatkal ticket in irctc.co.in:

• 7.45 AM - Open all possible browsers (internet explorer, firefox, chrome, safari, opera, etc.) and login a session in every browser


• 7.46 AM to 7.59 AM - Try to fill in some fake forms and keep all the sessions active by clicking on some link or the other so that you don't get the "Sorry your session has expired, possible reasons are...". At this timeline you might also see the "Sorry e ticket can be booked only after 8.00AM" alert message frequently


• 8.00 AM - With all tension and hurry, type in all the travel details (probably in the quick book form) and click on "Go" to just see the loading mouse icon or more probably the "Service Unavailable" error page


• 8.00 AM to 8.15 AM - After lots of refresh in various browsers, at last you have seen a blue color page in one of the windows and in excitement you type out all the travel details and after encountering a few more "Service Unavailable" error messages, you might at last get until entering the payment gateway credentials (yet going beyond this point is still a question mark)


• 8.15 AM to 8.30 AM - Totally unexpecting it, either you have got the "Service Unavailable" error message again or there are no more tickets available in the train you wanted


• 8.31 AM - You spend a minute grumbling and scolding irctc.co.in website and think of it as yet another tatkal booking attempt that failed and you look for other alternatives (most of the people goto www.kpntravels.in by 8.32 AM)

Second of all, even if the website was really good and if it could offer everything travelers want, the load that is built on the irctc.co.in webserver is enormous during the 7.55 AM to 8.30 AM period. Hence, booking a ticket online now, becomes a matter of luck.

For people who don't get how it is about luck now, let me explain further. Consider you are in a bar wherein a bartender gives away drinks to random people. There are way too many people than the bartender can handle and the bartender does not have any intelligence and hence he simply gives away drinks to random people as long as it is available. Thus, if you are lucky enough, you'll get a drink. The same is the case here where the bartender is the irctc web server and your ticket booking requests are the requests made to the bartender for drinks.

And one more thing about this online booking is that there are agents available in various parts of the country who assure that they can book a ticket for you. I'm still not sure how that is possible violating the pigeon hole principle ( simply stating - according the pigeon hole principle (probably a stricter version of it), if there are only x tickets available, only x persons can travel but there are quite easily much more than x agents all around the country ). So that is one glitch that if you can just pay how much ever extra the agent asks, are you sure you'll be travelling on the required train? The answer is no. I have seen many cases where the agents too fail to book a ticket for you in the required train (and you're forcefully redirected to kpntravels.in again or may be to jetairways.com if you are rich).

Ok, so whats the point in all this? The point i wanted to say is, today (not exactly today, sometime in the past few days) i came up with a dry thought of doing something so that you can escape the threatening "Service Unavailable" error messages. Now going back to the bartender example, the bartender does not have any intelligence and hence you think you can do nothing about it. But what if you can slip in an extra few bucks so that bartender is sure to give you the drink before its done. Ok, this is fine for the bartender example, but how do we bring this into picture with a web server in the place of a bartender?

Seems impossible !! Thats when my TCP/IP knowledge kicked in and made me think about the flags in a TCP packet (non technical people [or even some technical people :P] might not be able to follow this, but read on as i'll try to give another simple example later). Yeah, if you are a networks expert, you might have probably guessed the thought that i had in mind by now. There are eight bits allocated in a TCP Header that are known as flag bits. Our hero (i mean the one we are interested in) is a flag called URG flag or the URGENT flag. As the name suggests, this flag helps us to override the routine queuing done by the TCP/IP stack of the operating system.

Hey stop all this crap. I dont get a word. - Ok, let me give an example again. Consider a courier service office where they receive many parcels of letters daily and process them in the order they arrive (i.e.) a parcel of letters coming in by 7 o clock will be processed before the parcel that came in at 8 o clock. Now, there is a special override for this that if a parcel carries a red flag in it, then it will be processed immediately irrespective of the time it came in.

This is the same kind of scenario that i am talking about. The operating system's TCP/IP stack processes all the packets (requests sent by you to book tickets) in the order they arrive except for the only exception that is the packets with URG flag set will be processed first irrespective of the other unprocessed packets (requests sent by others to book tickets) in the queue which had came in earlier. A question might be raised here that what if the other requests also has the URG flag set (or what if all the parcels have the red flag in them) ? The answer to this question is, as long as people/agents use only a web browser to book tickets, there is no possibility that the URG flag will be set in the packets that are sent from the browser as it is disabled by default. Also, i think this might be a good approach as it is in the transport layer, it is not possible for the application to override this behavior (because this is the behavior of the TCP/IP protocol stack of the operating system).

So, my high level idea is that, there could probably be an application developed, that simulates the web browser in requesting the irctc web server (maintaining login sessions, etc) and at the same setting the URG field in every packet sent. For TCP/IP experts, of course there are implementation issues like where will the urgent pointer point to and much more which can be answered only when such a system is implemented. (And yes, i have plans of implementing one such system).
Ok now what? As usual, any comments are welcome. And anyone who could go ahead and implement such a system in a jiffy are welcome to do it. For more details, pings are always welcome.

P.S.: I really enjoyed writing this post as everything was getting into its place with a great flow and i love the way i have organized this post. :-)
-Vignesh