Cubic

I was recently on the Microsoft Developer Network website (aka MSDN) looking at some API documentation. Many of the more popular APIs have code examples so the developer can see example usage rather than have to try to understand every nuance of the API before using it. The particular API that I was looking to use had an example, so I made the unfortunate decision to look at the code. The example was a turd. It wasn't a polished turd. It was just a normal, run-of-the-mill turd. The code had HANDLE leaks, memory leaks, and a bunch of other critical issues. It looked like it was written by a 20 line Norris Number programmer (aka newbie). Being rather bothered by this, I set out to learn how Microsoft produces its code samples. According to one source I found, the company hands the task off to interns. So, sample code that a whole bunch of other programmers are going to simply copy-pasta into their own code is being written by amateur programmers. Nothing could possibly go...

Starting a new Certificate Authority is a time-consuming, expensive, and difficult task. It is also annoying to set up and maintain SSL/TLS certificates. So I completely understand what Let's Encrypt is trying to do. Their goal? Free, functional SSL/TLS certificates that are easy to create, install/deploy, and even keep up-to-date. What's not to like about that? Well, it turns out there are some serious problems with this up-and-coming Certificate Authority (CA). I'm going to list the issues in order of concern: Doesn't solve the problems of storing roots in the browser or global trust issues. A U.S.-based company. Browser support/acceptance. Sponsored by Mozilla. Other, publicly traded, corporate sponsors. A brand-new, relatively untested, and complex issuance protocol (ACME). Limited clients (Python bindings only) and no libraries. Linux only. Each of these issues in detail: For the first issue, even though it is all we have got (Update Aug 2017...

GitHub is a great tool. It enables software developers to work together on open source projects. That's pretty awesome. However, it also unfortunately exposes your personal life to the entire world. It is easy to look at the history log of commits for any given GitHub user and identify their schedule...to an incredibly creepy level. Using GitHub histories, an attacker can identify when you are probably awake, asleep, at home, and at work. They can also identify habits such as what days of the week you tend to commit code. As well as what days of the week you never commit code. Which days and months you commit the most code and which days and months you do not as well as the frequency of commits. All of that information can be used to derive your physical location in the world, your religion, your favorite sports team(s), and your relationship status with your significant other (if you are on good terms or not, having sex or not, etc). And possibly your hobbies and genera...

Let's say you import a library from Visual Studio 2012 or later into your project in an older version of Visual Studio (e.g. Visual Studio 2008 or Visual Studio 2010) but now get linker errors: error LNK2019: unresolved external symbol ___report_rangecheckfailure referenced in function ... error LNK2001: unresolved external symbol ___report_rangecheckfailure ... Sad day. Especially since you don't really get a say in how that library is being built. Your options are: Upgrade your version of Visual Studio. That includes going through the whole project upgrade cycle. We know how well that usually goes. Recompile the library yourself. Sad day turns into sad week. Hack it. The function __report_rangecheckfailure() is called when the /GS compiler option is used. The option enabled buffer overflow security cookie checking, which, in this day and age, is a good option to have enabled. Unfortunately, that causes problems with older versions of Visual Studio. Let...

First, watch this CBS 60 Minutes special on the Social Security Administration's Death Master File: The ultimate hack, from a blackhat/rogue government perspective, is the one that has significant negative impact on the financial stability of a country and...no one can figure out who is responsible. The Death Master File meets all of the prerequisite criteria: Large quantities of data? Check. Has significant financial consequences for anyone who gets into it? Check. Individuals can't readily find out if they are on the file or not? Check. Relatively easy to add anyone to the file? Probably check (e.g. plop some malware on funeral home computers and get remote access to adding entries to the file). Takes years to get off the file? Check. Has recurrent consequences for the rest of the individual's life? Check. No way to track additions back to the original source? Check. The head honcho at the Social Security Administration doesn't really care about...

There is a TON of broken code out on the Internet with lots of programmers who enter the world of TCP/IP socket development and think they have figured out how to write socket code. They then disseminate their broken code to others who, in turn, disseminate broken code to other people. One of the most egregious problems plaguing the world of software development today is the use, or abuse, of select(). Today, you are going to contribute to fixing this problem once and for all by reading what I have to say and then ingraining it into your brainz. There are two types of file descriptors/sockets/what-have-you: Blocking and non-blocking. Sometimes referred to as synchronous and asynchronous. If you are using select() on synchronous sockets in your code, you are doing it wrong! select() is ONLY for asynchronous sockets. Think of it this way: A synchronous socket is you telling the OS that you know the exact order of operations on that socket (e.g. POP3) and are willing to wai...

This is a mostly tongue-in-cheek response to RFC 6455 , which defines the WebSocket protocol, which I recently built a client for and can be found in the Ultimate Web Scraper Toolkit . Certain things annoyed me. Dear WebSocket, FTP called ( RFC 765 , circa 1980) and wants its text mode back. Please return it to the nearest Internet Engineering Task Force (IETF) member as soon as possible. You may have shined it up a bit with UTF-8 , which was basically designed on a napkin. Of course, Unicode has never had any implementation problems with it whatsoever . Ever . Your masking key is for clients only and not even being optional for servers defies the core Internet tenet of being liberal with what you accept, strict with what you send . Technically, both are peers and therefore both are clients of each other since you are, after all, bi-directional and the client could easily function as a server after the connection is established. Because this has absolutely never ever ...

Man-in-the-middle, or MITM, is a specific attack whereby an attacker injects themselves into the communication stream between a recipient of a message and the sender of that message. The most common example on the Internet is between a web browser and a web server. I am not disputing the necessity of verification in that example despite being nearly impossible to detect (e.g. generation/issuance of rogue but legitimate-looking certs to law enforcement ). Last-hop MITM defense is an essential component of SSL security even though it is nearly impossible to detect rogue certs. However, server-to-server MITM defense is far more dubious. Let's suppose I am an attacker for a moment and I find a way to inject myself between two servers in your web application (e.g. web server and database server). What is my behavior? Dumb attackers will simply take the low-brow approach and try to access the communication stream in a continual fashion, which seems to be the use-case that's b...

I recently reinstalled Windows. Portable Apps shaved off a ton of time during the reinstallation process. It is awesome to return to the DOS days of computing on the modern desktop where each application is self-contained as all applications should be. However, during my reinstall, running the Portable Apps updater at first resulted in the message, "The downloaded copy of ... is not valid and can not be installed. This could be due to an incomplete download or other network issue. Please try running the updater again when complete." Re-running the updater resulted in the same message. There's something about repeating the same thing again and sanity that could be said here. I eventually resolved the problem after I realized that I hadn't run Internet Explorer before. So I ran IE for the first time, got through all of the dialog boxes and then shut IE down. After that, the Portable Apps updater worked great. I've always half-figured that IWebBrowser2 w...

I am in the process of finishing up a reinstall of Windows on shiny new hardware. During my adventure, one of the pieces of software I've been needing to upgrade or replace for some time has been Photoshop. I've got CS3 Extended (picked it up for about $300 as an upgrade from 6.0) and, while it serves its purpose, the bugs on newer versions of Windows are incredibly frustrating (even for someone like me who rarely uses it). Adobe Creative Cloud is a non-starter for me for a wide variety of reasons that have already been beaten to death elsewhere on the Internets. I fire up Photoshop about once every 3-4 months, so $120/year is pretty absurd. $1,500+ for CS6 is completely bonkers. Photoshop Elements also doesn't have the feature set I need. Here is what I depend on in order of most-used: The color picker in Photoshop. The active response while dragging sliders around and the ability to select specific hue, saturation, and brightness values. The ability to copy a...

Are you ready to return to the 1980's? Uh...me neither. But this post will take you back. And your head will hurt thinking about what I've done to the Internet. Today, I was looking at this logo on the PHP website trying to figure out why it was so distracting: And then, after digging around for a bit, I realized that the image was larger than it looked: Then I realized that the browser was resizing the image to the smaller size. And then I realized that the first image looked a bit anti-aliased, which reminded me that a lot of web browsers will use bicubic scaling to resize larger images. I then realized that this behavior could be abused when applied to a 1-bit alpha channel. Such as the 1-bit alpha channels like those found in GIF images. GIF is one of the oldest image file formats. It was invented in the late 1980's and is still used on the Internet today for some animations. One of the areas it has traditionally been weak in is transparency. PNG ha...

Two of my least-favorite open source products are Postfix and anything that interfaces with it. I use Postfix and Dovecot extensively and still find new annoyances with both of them. My major gripe is the lack of a simple package in Ubuntu that simply asks questions and then automatically does stuff based on the answers to set up a working mail server. The objective of this post is to show a simple setup of Postfix and Dovecot for Ubuntu 14.04 LTS to enable command-line scripts on a box on a local network to send e-mail to itself and then retrieve those e-mails over POP3 using a normal e-mail client. This is NOT a full-blown e-mail server setup. It is a notification message drop with POP3 access. The e-mail client will only be able to retrieve e-mails from the box (not send them), which completely eliminates the possibility of the box accidentally turning into a remote mail relay. First, install Postfix and Dovecot: sudo apt-get install postfix sudo apt-get install dovecot-...

Programmers dread the "code review". This is where the programmer sits down with his or her peers and their peers bash their fellow programmer's code - and, in not so many words, tell the programmer that they are a terrible person. The code review is about ego boosting/ego crushing disguised as a quality assurance practice. Well, that's what happens in a lot of code reviews and, when it happens, it is a form of bullying. The word "review" implies that the code is being judged: Review: "a formal assessment or examination of something with the possibility or intention of instituting change if necessary." Judged: "form an opinion or conclusion about" or "give a verdict on someone." Also, the code review involves not only judgment but the peers are the jury and executioner in some sort of twisted intervention: Intervention: "an occasion on which a person with an addiction or other behavioral problem is confronted...

I've been testing a beta product called the Encrypted File Storage System (or EFSS) in a production environment for a while as an offsite backup solution. I'm only backing up 200MB of compressed data, but it works very well. Most backup solutions rely on pushing or pulling the data across a network. EFSS puts data to be backed up into an emulated file system locally and transparently encrypts and compresses the data. Each 4KB block of data has a timestamp associated with it, which makes incrementals over a network blazing fast - faster than anything else I've used. Yesterday I was monkeying around on my server and removed a few installed packages that I didn't need any more. Unfortunately, removing those packages caused a critical configuration file to become corrupted. I then fired up the EFSS command-line shell and mounted everything except the last 24 hours of incrementals and exported the configuration out to the file system. I did an eyeball diff, checked ...

Okay this isn't so much a guide on how to write a PECL extension as it is to discuss my recent experience in writing a PHP extension, publishing it, and documenting it. My hope is that by reading through the struggles I went through, that others can benefit. Writing an extension for PHP requires serious skills and patience. Extension writing is a complex macro dance and really requires good planning to pull off successfully. In my case, I wanted to introduce native named synchronization objects into PHP. This is something I've felt has been missing from the language for far too long and I didn't see anyone else doing work in the area. The first thing I did was write a cross-platform library in C++: Cross-platform C++ library Writing a C/C++ library as a proof-of-concept is a good start to writing a PHP extension. I highly recommend it. Developing a separate library allowed me to work out most of the kinks in the logic apart from the Zend engine. After I solidi...

I've recently been exploring the world of FreedomPop on behalf of a friend who is going through a really rough patch in his life. FreedomPop sells WiFi hotspot devices that supposedly get 500MB of data per month for free. The only thing to pay for is the device itself, which will set someone back about $50. It sounds awesome, but that's really all it is. The old adage, "If it sounds too good to be true, it probably is" definitely applies here. This plan is marketed as 500MB of data per month for free "forever" (the 'forever' is implied). Even 3 years of use (i.e. until the lithium ion battery wears out) would be enough to help my friend out in a significant way. I was willing to play guinea pig for this interesting service because I also have some potential use for it. So, I went and bought the device, which set me back a little over $50 (after tax). Then I waited. And waited. And waited. And waited some more. And pretty much forgot ab...

I run Windows 7 Ultimate, full Aero effects, and Firefox. The most recent update of Firefox to version 29.0 resulted in yet another redesign of the tabs. This redesign is very unfortunate because it makes the text completely unreadable. I have some very choice words for the Firefox developers about their general competence, but that's not what this post is about. This post is for the average user that this garbage release was foisted upon. I've been running the fix for about a week now and, while not perfect, it is much better than not being able to read the text on my tabs at all. Go here: https://addons.mozilla.org/en-US/firefox/addon/white-to-gray-gradient/ Click "Add to Firefox". Done. That's the best theme I could find that balances readability, usability, and some semblance of elegance.

My current office chair I use at home that I bought a decade ago for about $100 (it was on sale) is starting to fall apart. One would hope that innovation over a decade would result in improvements. First off, the office chair you sit in probably looks like this: If you are lucky to work for a really nice employer, you might get one of these: Oooh...armrests! You know what the ironic thing is? Neither of those chairs were designed to be sat in, yet they cost just as much as (if not more than) a decent chair. Those chairs exist due to some insane thought process that managers and executives get nicer chairs to sit in as a person moves up the corporate ladder. I'm sorry, but that's just cruel. If you are going to sit in a chair for 6-12 hours a day, then it had better be comfortable to sit in regardless of who you are. Sitting in the wrong chair for hours on end can and will result in regular headaches and/or migraines (I'm speaking from personal experience ...

A few topics came up on my radar recently that questioned whether or not AdBlock Plus is a security risk because several websites are now asking users to disable it for their website and claimed AdBlock Plus is a security risk. That got me thinking about why I really run both AdBlock Plus and Ghostery. I trust both plugins because they do their job VERY well, are generally trusted products by millions of people, and, most importantly, are open source software. However, the reason I run these tools is not the usual "ads are annoying" or "privacy is important" reasons that I see bandied about. I run them because NOT running these tools introduce security vulnerabilities and serious performance degradation into the web browser stack and those using ad servers do not follow the law. Here are a few reasons as to why you should be running *at least* AdBlock Plus: Ad server operators are notorious for running any ad, including ads that deploy malware. It is not ...

Update May 30, 2017: As per OSI, this license has some insurmountable issues. I have retracted the proposal for OSI inclusion as a result. If you used this particular license in any work, I highly recommend moving to a pure MIT license as soon as possible for software and CC0 for other works. Other than government entities in some countries, it would seem to be impossible to avoid copyright and place any given work into the public domain while offering sufficient protection of the original author from spurious lawsuits. I view this as a serious failing of copyright law and thus the real source of the problem is copyright law(s) not allowing for simple public domain dedications by members of the public. There are valid scenarios where public domain dedications are legitimately necessary for the furtherance of the common good. Therefore, only if the law changes would a simple public domain dedication option become possible. Even Creative Commons Zero (CC0), with its best attempt ...