Cubic

For the past month and a half, I've been delving deep into C++ land, wrestling with the intricacies and annoyances of writing cross-platform code. My biggest gripe with the major libraries out there is that they all have a 'string' class and then proceed to use their 'string' class everywhere, which basically means that if you want to use a specific library, you end up using all of it. I also wanted to push the performance envelope to the limit, which means putting storage on the stack instead of the heap. At any rate, check it out: Cross-platform C++ Snippet Library My favorite class is Sync::TLS, which implements a temporary memory allocator that outperforms system malloc()/free() by a factor of up to 19 times! When I saw the stats, my jaw hit the floor and I drooled a little. It was awesome. I was expecting for Sync::TLS to get crushed soundly. I'm also rather happy with the little UTF-8 library that's included. A minimalistic Unicode implem...

...WHY?! For Outlook 2007, Microsoft removed the embedded Internet Explorer engine for displaying HTML e-mail and dropped in some half-baked solution. From Word. Apparently, the same engineer (an idiot) who thought that margins and padding in 'div's were bad (because Outlook is now pretty much incapable of that) also decided that support for blinking text is good. The ancient, decrepit 'blink' tag isn't implemented, so how does one accomplish this atrocity? With 'text-decoration: blink'. That's right, the same engineers who could have spent their time figuring out how to space things out on a screen with margins and padding, instead wasted those precious moments writing CSS support for blinking text. Sigh. Okay, so HTML e-mail is bad to begin with, but good software developers don't implement stupid stuff until more important things are implemented. Please prioritize what is important. Got it? Cool.

The question constantly comes up. It is a sticking point and everyone has a different answer for new C and C++ developers. There was even a stop-motion animation created once upon a time to explain them ( Pointer Fun with Binky ). They are just one of the reasons that a lot of developers are cutting their teeth, so to speak, on other programming languages (but there are other reasons as well). C/C++ pointers. I've given a lot of thought over the years on the best method to explain C/C++ pointers in a way that can be more universally understood. Even if the programming language you are using doesn't have pointers, understanding pointers helps gain an understanding of how the underlying hardware operates behind the scenes to execute code. In other words, they are still relevant to you. A lot of what I'm going to say involves gross oversimplifications of several concepts, but the goal is to understand how pointers work as succinctly as possible. First, we need a gr...

I ran into this comment the other day on the Internets: If you think that driving a car with reversed turn signal and wiper levers is bad, try driving a fork lift which slams into reverse every time you hit what would normally be the left turn signal. That is not the scary part. I have known numerous forklift drivers that got so used to using the lever to switch from forward to reverse throughout the day, that at the end of their shift they would get in their stick shift car with it in first gear, start the car, turn on the left turn signal, look over their shoulder, release the clutch and drive into the car in front of them. Life Lesson: Never park directly in front of a fork lift driver. I'm sure there is a reason for the lever to be conveniently placed at that location, but, if the bigger picture is taken into account, this is a pretty good case of UI design that results in expensive damage to property. Car insurance providers should take a look at this scenario to see ...

About a year ago, Microsoft released version 4.5 of the .Net Framework to the world. No one really cared much but every programmer out there should. Why? Lurking in the shadows of that release was THE solution to our multithreading woes. If you've ever done multithreaded programming, you know three things: 1) Multithreading is painful. 2) Multithreading is messy. 3) Multithreading is painful. Multithreading is even harder in a GUI environment because most GUI libraries will crash (and crash the whole application too) if a programmer tries to do operations on the UI from another thread. So, the programmer ends up having to write a ton of plumbing to get back onto the UI thread after completing a multithreaded operation to do UI stuff. In addition, multithreaded programming requires thinking outside of how programs and programmers are really wired to think: That is, we think sequentially. The solution that needs to be ported to every programming language we care abo...

After spending a LOT of time researching, waiting, more researching, and almost giving up on WiFi, I've finally figured out a secure enough WiFi setup that I think has a pretty good chance of standing up to scrutiny. It is called EAP-TLS and it is serious Kung Fu (aka REAL security). Unfortunately, to implement said Kung Fu, the protocol requires a RADIUS server. And, to get said RADIUS server at an affordable price, FreeRADIUS is needed and therefore Linux is necessary. And the easiest Linux to use is (usually) Ubuntu. But, after scouring the Internets, I've also determined that there are NO good tutorials on setting up a basic FreeRADIUS EAP-TLS system at home under Ubuntu 12.04.2 using the apt-get packages for FreeRADIUS. This, therefore, is the definitive guide mostly cobbled together from a number of different sources. I'm assuming a half-decent understanding of Linux command-line editing, a fresh installation of Ubuntu Server 12.04.2 LTS on a computer on the n...

Earlier today, I had a "free heart attack" when a new thread showed up on the PHP Internals list: [RFC] more secure unserialize() I love serialize()/unserialize() because it is nice and easy to use. Unfortunately, with ease-of-use comes greater responsibility. In this case, it is important that users can't submit their own serialized data structures to the server. When the server calls unserialize(), it expands out any data type, including objects. Upon destruction of an object, __destruct() is called by PHP automagically, which then executes whatever code is in there. The "free heart attack" I mentioned earlier came from the fact I send serialized data to the SSO client in the encrypted cookie. Fortunately, a look at the encrypted cookie code revealed I had been using json_encode() and json_decode(), which allowed me to breathe a sigh of relief. For now. This just goes to show that security is a moving target. Or, if you are a cow, it is a moooooo...

I've been looking for an alternate to find + grep under Linux so that I can do similar queries to 'findstr' under Windows such as: findstr /sic:"my_function" *.php Recursive search for PHP files containing the string "my_function". The typical response to "how to search for some type of file containing some text" under Linux is usually along the lines of: find "*.php" -exec grep -H "my_function" {} \; Not only is that cryptic and longer and more difficult to type, it fires off a new, separate process (grep) for every PHP file it finds. I've seen a zillion incarnations of the above. Every time I run that, I end up waiting ten times longer than I would have waited for 'findstr' for the same operation. find + grep performance is terrible. So I said to myself today, "Hmmm...maybe grep has the solution already?" Lo-and-behold, it does: grep -nir --include="*.php" "my_function...

If you are in the mood for a not-so-boring "technical novel" (there apparently is now such a thing), may I recommend reading this lovely 730 page book: Engineering Security by Peter "Long-Winded" Gutmann Reading it does require a level of technical expertise and understanding of how SSL/TLS, SSH, IPSec and a number of rather boring protocols work to truly appreciate what he has to say. For those who don't have the time to read 730 pages, I'm going to summarize: Security, or at least the average programmer's understanding of it, is...severely lacking. We've had two decades to figure out how to not screw up security and, yet, we still find new, extraordinarily stupid ways to do so. The real problems are a lack of accountability in software development and that anyone can own a computing device without any training whatsoever. The book then proceeds to attempt to describe fixes for the problems, but I'd wager that around page 50 or so, mo...

Extremely important update: The technique described in this post has been directly confirmed to extend the block size of any symmetric cipher to any desired length by Bruce Schneier himself - he is one of the leading crypto experts in the world. Ladies and gentlemen, we have a winner! On the other hand, the other aspects of this post remain untested, so keep that skepticism handy. However, this post is good news in the event of a major cryptanalysis breakthrough that breaks multiple widely-used and trusted algorithms. Stay tuned...hopefully more good news to come! Before I begin, I need to preface this with the fact that I don't consider myself to be a cryptanalyst. Coming up with a new cryptographic algorithm that is deemed strong is hard to do and really takes a team of people. I know enough to be dangerous. Therefore, what is presented here is to be viewed as merely a theory to extend the block size of any trusted symmetric block cipher without modifying the core algor...

That is the question I've been asking myself lately. Mailing lists used to be a staple communication mechanism on the Internet. Now nearly all of the mailing lists I'm subscribed to are very quiet - still have 10,000+ subscribers on most, just no one seems to use them. The distinct trend I am noticing is that people are forgoing mailing lists and using quick question and answer sites like Yahoo! Answers and StackOverflow to get the answer to their questions. (Or using the Facebook commenting system or Twitter - but that depends on your friends, connections, and followers). Experts Exchange used to hold the position and used to do quite well but then shot themselves in the foot by putting annoying barriers in the way. People went back to mailing lists after that fiasco. Unfortunately, there are two significant problems with the Q&A websites out there that mailing lists solve and StackOverflow is demonstrating the problems quite well. The first problem is community ...

When I set up my Postfix + Dovecot + MySQL installation, I wanted GMail-like filtering for my domain. GMail allows you to do 'youremail+whatever@gmail.com' and it will automatically be delivered to 'youremail@gmail.com' with the label 'whatever'. From there, it can be filtered into the folder of your choice. I figured something similar would be very useful when registering on websites where I'm not necessarily wanting to use a mailinator address but do want to track whether they sell my e-mail address or not. Well, I thought doing the same thing would be useful, but more on the difficulties I've encountered with special characters like '+' in a bit. In MySQL, I have 'virtual_aliases' and 'virtual_users' tables. If I remember correctly, Postfix first attempts to find an e-mail address in users, then aliases, then tries again without the extension specified by 'recipient_delimiter'. To set up Postfix with a 'rec...

I'm a big fan of portable apps. They aren't exactly useful as they were intended on a USB thumbdrive, but put them on a regular hard drive and they blow the installer based versions out of the water. One of the big, missing portable apps is an Apache + MySQL + PHP combination. Well, today, I've resolved that issue: Portable Apache + MySQL + PHP for Windows I built the core of that in about 24 hours of work. It took me another 72 hours before completing this application because I needed this: CreateProcess() API for the Command-Line I had to develop that because Apache refused to run in the background (not as a service) detached from the console. Do you ever get the feeling that sometimes you have just dropped a nuke on a fly in terms of problem solving? With the second application, I totally got that feeling as I was developing it. Anyway, I hope you get a lot of use out of these nifty tools!

Dear Google, Facebook, Twitter, etc., I've got a nice, ready-to-use Single Sign-On system on my website. I've implemented a couple of providers (Google and Facebook) and, during my interactions with users and developers online, I've come up with a short list of a few things that I see as things that are must-haves that you need to change about your services to make it easier and more sensible to integrate with. First, I should be able to pass a couple of URLs to your server that will display two links on the page where the user authorizes access for my application. Specifically, links to Terms of Service and Privacy Policy documents. These are legal documents and, without them, they open up the possibility of legal liability for the service that you are providing authentication for. Not having them defeats the purpose of providing the sign in service in the first place. A Privacy Policy or similar document also affords the perfect location for users to see why I...

GitHub is pretty awesome. It represents just about the perfect balance of everything software developers have been longing for, which sums up why it is popular. But there is a victim: Changelogs. Before GitHub, the "changelog" was the mainstay of software releases. It told users of a particular piece of software what was going to go horribly wrong should they upgrade to the latest version. It was the primary form of communication between the developer and users of a given piece of software. It tended to be highly technical but an observant user could identify potentially problematic areas of the software and test those areas in their environment before deploying. 'git' encourages fast, quick changes along the lines of "release early, release often". GitHub, based around git, is therefore directly affected by any side effects of git. Development becomes more of a stream of consciousness rather than blocks of development with set milestones and a ...

There is something emotional tied to every purchase we make. We spend time deciding which option is best, maybe check out review sites, and, at some point, cross our fingers and hope that the purchase decision is correct. Of course, a percentage of the stuff we purchase will end up, for all intents and purposes, be total duds. There is a threshold of expense that determines how far we will go to make a dud somewhat tolerable to work with. When it comes to computer technology that tends to be expensive, we are willing to waste hours on the phone with technical support just so we can get back to our lives. So, where is this post coming from? Well, back a couple years when netbooks were all the rage, I saw an opportunity to pick up a cheap Linux box via a Dell Mini 9 pre-installed with Ubuntu. It was $200 and I had plans for it and it has come in quite handy a few times for purposes I never really intended for it. It would have been a worthwhile purchase except for one little te...

Every computer comes with what is known as a BIOS (Basic Input/Output System). The BIOS contains startup and basic execution code that runs code before the CPU is handed control. In essence, it is the key piece of software on the computer that makes a computer start up in the first place. Occasionally, motherboard manufacturers will release new versions of a BIOS, usually to correct manufacturing defects. Flashing the BIOS is a rather dangerous, but sometimes necessary operation. Doing this is also usually much more complex than it needs to be, which not only acts as a deterrent but also vastly increases the possibility of something going horribly wrong. Before you go any further, heed this warning: Flashing a BIOS can brick your motherboard no matter how careful you are! Read everything two or three times and have a plan of action and a backup plan if flashing the BIOS fails spectacularly. There is a right way and a wrong way to flash a BIOS. The wrong way is to do it fro...

A lot of high-profile hacks have been in the news lately and various tech journalists are trying to sort through how to fix the problems of weak password selection and password storage that are rampant. While I have technical solutions to the problems , you, the user, are at the mercy of most programmer's whims. However, there is something you can do about it. Once you know what to look for, you can identify websites that have weak password storage mechanisms behind the scenes. Today, I'll show you how to identify those websites that are storing your password incorrectly so you can contact them and educate them. There are several common ways that passwords are stored: Plain text. Encrypted. Hashed. Salted and hashed. 'bcrypt'-style (bcrypt, scrypt, etc). If you use a tool like KeePass, you will run into quite a few websites that store passwords in plain-text and possibly encrypted with a single key. The programmer thought "15 characters is plenty ...