Explore Sign in Sign up
Echo Reply
Computers, Science, Technology, Xen Virtualization, Hosting, Photography, The Internet, Geekdom And More

Some Things Just Have To Be Compiled

Published on Oct. 19, 2008 at midnight by XC

I have a random problem, in particular random numbers. I am working on a re-write of SRCE to fortify things a bit .. and get rid of a lot of ugly code that was introduced when I wasn’t actively managing patches.

Humans are the best source of entropy to get random numbers.. the amount of time that lapses between each of your key strokes when you write a paragraph is a very valuable source to obtain random numbers. If you correct spelling mistakes, even better .. the number of mistakes that you make (judged by how many times you backspace) is gold. Other stuff works too, such as a sampling of ambient noise from your microphone.

When SRCE authenticates, it does not send any part of the key. Rather, the client issues an AUTH request with a number corresponding to a random line in a key file. The server then returns its own random number .. both parties can then agree on which two lines of the same key can be used (with salt) to determine the Blowfish secret. The client can optionally send a ‘hint’ that it actually has the key with an AUTH request via a SHA hash of the entire key, or the server can do this (both is a bad idea). The idea of SRCE is to provide reasonably good security without a public key.

The problem is, generating (strong) random numbers takes time, connections need to be instant.
The easiest solution is to gather a ton of entropy at compile time by asking the user to type randomly, build a table and include it in the rest of the build.

Category: Programming
|
Read More

Mad Scientist Meets Lvm2

Published on Oct. 1, 2008 at midnight by XC

Sometimes we’re fortunate enough to really enjoy what we’re being paid to do. That’s been the case for me this week while working on a replacement for the ‘lvm’ command for control panels and other underprivileged things to use.

Most people who write programs that must operate on logical volumes do it in a very ugly way, via the system() or execv() family of calls. Sure it works, but its clunky, forky and (if your not careful) downright dangerous. Surprisingly, most people don’t realize that a C library (liblvm2cmd) exists to make this process safer and more elegant. While the library is very basic, it does provide a simple reusable interface to lvm2 and a semi-intelligent callback.
The library is more or less just a compilation of everything in lvm2 tools/ sources, with a header exposing enough functions to register a callback and reach the various command entry points with some arguments. This is cool, because whatever you change in lvm2 itself (i.e. output print format) is automatically inherited by the library and can be statically linked. This means being able to get done what you need to get done without touching the default system lvm.

The result is neat, you can write your own ‘lvm’ exposing only the parts of lvm that you absolutely must. For instance, making ‘lvm’ setuid 0 just so some web control panel can talk to it is just insane.

Phase 1 of my plan is done, I now have a ‘safe to setuid’ lvm executable with quite a bit of logging and auditing support.

Category: Programming
|
Read More

Interesting Internationalization

Published on Sept. 18, 2008 at midnight by XC

I’ve been having a rather enjoyable discussion with Lorenzo Bettini, the author of GNU Gengetopt and Gengen. If you are not familiar with Gengetopt, its a tool that simplifies generating the code required for programs to accept options. I talked about gengetopt a while back on this blog.

The discussion surrounds support for internationalization, which simply means a program printing output in whatever language your system is using. A very popular means to accomplish this is the GNU gettext library, or its counterpart in various other operating systems. Disclamer, if you do not care about C standards and common UNIX programming, this post will probably bore you to tears. However, your welcome to read on if only to discover how much I value life in boring geeky flavors
Recently, while working on HelenOS I found the need to implement getopt. I’m working on something a lot like busybox, but from scratch. Rather than re-invent the getopt wheel yet again, I dove into the source code of GNU getopt as well as the various *BSD implementations to find the one that was easiest to port. One thing that stood out at me was that most implementations declared error strings and formats as static, English strings.
A week later, a proposal to add gettext support came across the gengetopt mailing list. I voted to not include it because the resulting output would be at best mixed, as error strings in basic C89/C99 libc are hard coded, usually in English.

Category: Programming
|
Read More

Should Law Be Taught With Programming?

Published on Sept. 18, 2008 at midnight by XC

It has been a long time since I’ve seen the inside of a class room. In school, my primary major was criminal justice. I was programming since high school, so I took some programming / computer courses because they were easy credits. I’m really glad that I got some exposure to law (mostly, how to read law) because in this day and age you really need it.

Trademark law, software licenses, patents, intellectual property .. some people make a whole career out of understanding these things (I think we call them lawyers). However, your average programmer is confronted with all of the above very frequently.
Until Google comes up with some kind of killer editor that reads your code as you type while searching its patent database in real time for possible conflicts, every programmer needs to know how to search for and read patents. Thankfully, some progress is showing on the patent reform front as some of the most obnoxious ones are invalidated as prior art. But others remain and lurk .. for instance, the former DEC (Digital) holds a patent that the Ext3cow file system violates. I’m sure it will never be enforced, but it illustrates my point.

Trademark law is another big one. For instance, Firefox and Xen. Both projects are free software, however the use of the name is very restricted. If you modify even one line of code in either program, you must name it something else in order to distribute it. Furthermore, you can not use their logos on modified versions.

Category: Programming
|
Read More

Why I Hack At New Operating Systems

Published on July 30, 2008 at midnight by XC

I have been asked several times why I prefer to work on HelenOS instead of the Linux kernel or GNU programs.

The answer is simple, working on something new is more fun and I don’t like assigning my copyright to the FSF. Today I have been working on porting my brain dead shell to HelenOS, which has a very limited libc.

During the process the build broke .. ugh oh, no strdup() .. so I wrote strdup() and sent a patch against the userspace libc. What does this do for me? It makes me a better programmer while enjoying what (used to be) a hobby again. I had a lot of fun studying Helen’s vfs server (its a microkernel OS) and sending patches to make it work as-is.

I guess I just flock to projects that do not hope to gain ‘big industry’ attention and venture capitalists. I like projects that want to do something innovative for the sake of doing it .. not to get rich.

Category: Programming

Add An –Inpath Option To Your Programs.

Published on Feb. 7, 2008 at midnight by XC

If your writing a program that is designed to run on any modern computer, please consider adding an –inpath option to your program, or -Z as a short option, just to signal that your program ran. Here’s why:

Many other programs need to know if your program exists in the system path. Save a lot of people time, trouble and effort of writing code to recursively search said path to find out if your program is present and executable. Most C libs come with inherent memory leaks, don’t make us use inherent search functions, don’t make us write our own stuff.

–inpath switches should exit with a status of 0, regardless of the EXIT_SUCCESS macro. This saves malloc()’s, contiguous cache and a whole lot of headache.

A good example is here:
Lets say I’m writing a CLI that gets an env variable named EDITOR to find out what editor you want to use. When I call getenv() to fetch EDITOR, I should be able to issue a system call + –inpath to get a result of 0. This lets me know, the user was sane and set the variable correctly, else, do something else.

Otherwise, I have no choice but to over-malloc() needlessly, robbing your computer of precious contiguous memory space for no good reason. What fun is that? If your program is not in the system path, well, duh, its not going to return what I expect. I can even test against EXIT_SUCCESS to make sure I’m testing it right.

Category: Programming
|
Read More

Php/Saas Slowing Core Gnu/Linux Development?

Published on Nov. 2, 2007 at midnight by XC

A colleague asked me a rather interesting question today, “Is PHP and other scripting languages luring quality developers away from working on core GNU/Linux components?“. I had to put a bit of thought into the question before I answered it.

Essentially, his question was, if it weren’t for so many FLOSS web applications, would more developers be working on more importantly needed components of the GNU operating system and / or Linux kernel development? In other words, would GNU/Linux be at the front of the desktop race if so many developers did not focus purely on web applications?

I really don’t think so, and here’s why:
Most people who work strictly with forgiving interpreted languages (such as PHP) do so because they are not comfortable with the strict rules of ANSI C. PHP (and others, like Ruby) allow a programmer to just ‘make it work’ very quickly. The same people might not be very productive in a pure C setting, where they have to make their own structures, use pointers, strict types of variables, just to name a few things.

If you took all of the developers working on, say, x-y-z shopping cart and said “Ok guys, now your working on gnash, open office and KDE”, many would be completely lost. Some of them would learn, I’m sure rather quickly and start producing good patches in very little time. I don’t think that would be the norm at all, however.

Category: Programming
|
Read More

Why My Programs Are Usually Bourne Bash

Published on Oct. 10, 2007 at midnight by XC

Many things that I write and release freely start out as bash scripts. While working, I rely heavily on bash. Many people have e-mailed me to ask “Why don’t you use python? Why don’t you use perl? Didn’t you know that PHP was useful as a scripting language?” To those folks, I can only answer a question with a question and answer:

Q: How many system integrators does it take to write a program?
A: 12. One to do it, eleven to tell the one who did it how he could (or should) have done it.
I need to take many things into consideration when I write a program:

What is the programming skill level of those who might need to modify or debug whatever it is that I’m writing?
How much memory do I have to work with? Can I get by with something ‘forky’ that calls other programs notorious for over-malloc()’ing their way to dirty pages?
How much am I getting paid to fix whatever this program is fixing? Many times, I’m paid a quoted price and need to have it ‘fixed’ within x amount of hours.

If it runs on a computer, it delights in breaking while you are trying to sleep. Nearly every self-respecting GNU/Linux system administrator in the world can figure out a semi-well commented bash script. They can also (usually) find their way around perl, sometimes they can find their way around python. PHP is huge for scripting unless your using something like Roadsend (with bigloo) to produce a sensible ELF executable. The point, I don’t want a phone call at 3 AM to fix something trivial.

Category: Programming
|
Read More