Author Archives: Xexyl

The Perfect Fallacy

Posted on by

So, if you’re a person who likes to think, you may wonder what the title ‘The Perfect Fallacy’ could possibly mean. Indeed, there’s many interpretations. Among those I can think of, are the following :

  • A fallacy that is perfect; it can’t be anything but a fallacy and it is described in a perfect way.
  • An oxymoron: how can a fallacy itself be perfect? It actually can’t be if you look at it in these terms.
  • And what about: perfectionism?

Well, for anyone that knows me enough, they can probably guess that I don’t mean the first. Although all of them can be interpreted literally (and I am very very literal; take things from word value rather than context), the first one isn’t really possible (see the second one). Now, as I love puns, word play in general as well as being satirical and sarcastic on multiple levels, the second one ‘could’ be it. Is it though? Not exactly, and those who know me will know why: I’m very much a perfectionist, to the point of it defeating my tasks (often enough which equates to more than it should; indeed, if perfectionism is stopping a single thing from being done, its too much).

So, let’s take a definition of perfect from Merriam Webster:

a: being entirely without fault or defect : flawless <a perfect diamond>

b: satisfying all requirements : accurate

So, with the first two definitions/meanings, it is seen that you can literally mean something else from the first. But is b) really all that perfect? Accurate doesn’t really mean perfect. This is especially true if you think of accurate as a percentage. A perfect (pardon the pun) example is: how accurate are you at typing? What about how accurate are you at declaring an animal by its foot print? Looking at it this way, you can see accuracy it isn’t exactly the same thing – you may be 100% accurate in activity X, Y or Z, but that’s not guaranteed.

So, realistically, perfect means flawless. To be perfect means you have no flaws and no faults, and you make no mistakes. The list goes on in ways you can describe it.

With that said, it does kind of push the ‘practice makes perfect’ claim rather ridiculous. But let’s put that aside, because that’s not what I’m trying to get at. I’m most certainly not trying to say you shouldn’t practice, or you shouldn’t try. You should practice the things you need to be good at, and you should try your best. Some say you shouldn’t try but you should only do. However, its worth pointing out that this would depend on the person and the specific thing they are referring to. I’m pretty sure I couldn’t lift 200 pounds even, for example. I wouldn’t get it it off the floor and I would likely strain my back (or feel like a complete idiot for trying it knowing full well I should start out smaller and work my way up to it).

And that’s the key: you need to work on your skills, work on your abilities. Improve upon them.

Question is, why am I writing this? What made me think of this? I think I thought of it  as I know I am often critical of certain things but the irony is I’m both a perfectionist and I know full well I am NOT even close to perfect  (and in actuality, no one is perfect). I for example am critical of a lot of Microsoft’s decisions. Sure, they may be valid but you know what? They aren’t perfect and that by itself is perfectly (there goes the puns) acceptable. And something else is, they are a very successful company. No matter their flaws, they have a lot of customers and make a lot of money. In that way, they’re successful. They might not be the best with other things, but as a friend I recently talked to (since 2005 last I heard from them) used to always say: You can’t have it all. Truth right there.

As for why I’m writing this? It’s really simple: I feel that we ALL can improve. That includes me by a great deal (and I admit that fully). I also wanted to touch upon the above paragraph: that no matter the mistakes someone or some group makes, it is OK! We as humans are not perfect. Actually, I’m glad of that. If you think about it, any thing that is perfect cannot be improved, so what’s the point? What would you do after you became perfect? You certainly wouldn’t be improving yourself.

Case in point: No one is perfect, and that’s a strength; it is NOT a weakness. If we were perfect, and we had everything we wanted, what would we then gain? Nothing. We might even get overzealous or arrogant and ruin our image.

It might seem ironic that a rather extreme perfectionist is writing this. But you have to remember I’m a very logical person (hence why I really enjoy programming and other computer related things). If you ever think you’re having a perfectionist episode (so to speak), then try to fight it. Put it this way: if you have to have everything perfect, then you’ll never have anything AT ALL. What’s the point in that? I know for me I’ve far too often not finished things because of REALLY stupid things. These stupid (and I do stress really stupid) include the following:

  • I couldn’t think of a “perfect” name for a function in a program. This one gets me a lot, and far more than I’d like to believe.
  • I can’t think of a “better” or “perfect” name in ANYTHING – not just a program.
  • I couldn’t think of a “perfect” way to write something. It’s not like I’m even an English major, so why should I care? I know I write well, and that should be enough. The point of language is to get a point across – to here we go: communicate. Its not to sound smarter or better than someone. It is to communicate. You show how you are through not just words but also ACTIONS (more so the latter I would say).
  • If I lose something I’m writing, then I don’t write it all. The reason? Because I know (laughable really that I “know” that) I can’t write it better. In fact, if you think about it, it could be a lot better. It could open up a new thought… or a new way of working on something. (And if you think about it – some of the most important inventions were accidents and that includes medical discoveries. Imagine that: a scientist discovering something by accident and it being more important than other things he set out to discover intentionally).

That’s only a small portion of things that stop me cold in whatever it is. That itself is a huge flaw/problem with me. The fact I’m not perfect does not matter. What does matter and is a huge problem is that I try to be. I’m not. No one is.

In short:

The Perfect Fallacy is both an oxymoron and also not an oxymoron: being perfect actually IS a fallacy which means it isn’t an oxymoron (as being perfect is a fallacy and impossible). Yet, at the same time, there’s no such thing as being perfect, so surely its an oxymoron (perfect versus fallacy – they’re opposing terms). Take your pick, but if you can think in logical terms, and see the bigger picture (and in colour) then you can see how it can be both at the same time.

As for not being perfect, that does not mean you shouldn’t improve or learn something new. It means you can get better and better. No matter how good you are, there’s likely someone better than you (This also applies to illness; no matter how bad you are off, there’s others who are much worse). Practice does not make perfect but it does something even better: it makes you a better and ever improving person.

So yes, practice your skills. Improve. But never let yourself get to the point where you think you’re perfect or you think some other person is perfect. When you get to that point, or try to get to that point, the game is actually lost because its impossible to get to the end. It’s a maze with no end and the start makes little difference. In fact, the maze is quite a long, convoluted and infuriating one. Lots of puzzles to solve, lots of obstacles, yet when you get around them 10 more show up – ad infinitum.

C / C++ Type Casts Continued

Posted on by

In a fairly recent post, I discussed how to find C style casts (as opposed to the C++ style which is intentionally more ugly than the already ugly C style) in a source file. But as I noted some days after writing it, it had some limitations. In my head at the time it made perfect sense because I was actually looking for Pointer to type casts. But that’s fairly limited, as there’s other types of casts that exist and are perfectly valid.

So, I’ll now discuss a few things related to the previous post.

  • Type Casting
  • C/C++ type casting
  • Workaround to find all C type casts

(The irony is: C++ style casts that are more ugly are probably far easier to find than their C counter parts. The reason is its more restrictive – see section on C/C++ type casting)

Type Casts

So, firstly, what IS a type cast? It’s very simply a way to interpret one data type as another. In C it looks and acts very much like a function. In C++ is looks more like a template function. In any case, they should usually be avoided when possible. But the keywords are when possible: it’s not always possible. One such time comes to mind: socket handling uses some casting (side note: I noticed a couple mistakes in the binding IPv4/IPv6 socket code I showed a while back and I just fixed those [includes a memory leak being plugged up]).

C/C++ Type Casting

A type cast in C is in the form of:

(type)expression

type can be a pointer to type in which case it would be (type*) or (type *). Note also that if expression (which could be a variable – or not) is NOT a pointer but you’re casting it TO then you should give the cast an address instead – that is to say, &expression.

Now, in C++ they look differently. Yes, you can use C style, but its not recommended as its less type safe, and that is a bad thing! Imagine casting type A to type B when they are 100% unrelated and have different types of data, different members and so on. It’s just not as safe. Sure, it might ‘work’ but that does not mean it really is working properly or as best as it can. Also keep in mind undefined behaviour and implementation defined behaviour. Those two terms can bite you hard when you are vulnerable! In short, don’t rely on C style casts in C++ programs because there’s less protection: it’ll cast whatever it is to whatever you cast it to without a warning. The fact that more recent versions of gcc and g++ warn you more than they used to is good: its best to fix a problem at compile time than at runtime (you don’t want a corrupted stack example – that gives you barely anything to work with).

Now then, C++ type casts have the same form, only there’s more than one kind of cast.

reinterpret_cast<Type>(expression)

dynamic_cast<Type>(expression)

static_cast<Type>(expression)

const_cast<Type>(expression)

Now, I could explain these. But because its been done far better than I could do elsewhere, and it being an absolutely excellent resource for C programmers who want to shift to C++, I’ll refer you to The C++ Annotations. HIGHLY recommended reading! In particular, for the C++ casting types, see here:  The C++ Annotations’ Chapter 3.5: A new syntax for casts.

Workaround to find all C type casts

Okay, so now that I maybe have explained things better, let me return to the original point. Because a C type cast is very much like a function – both in functionality and look of the call, it is actually difficult to search for them and only them IF there isn’t a restricted search. By restricted, I mean for example the previous command I showed: type to pointer casts are simple to find. If you know you only used type to pointer casts, then you’re fine with the post I referred to earlier in this post.

If you know its only types like int, char, or double (or float) then its also easy. You can just specifically do something like:

grep "(int)" file.cpp

However, what if you don’t know all the casts you might have. You could have some pointers and the original command would find those. But what if others exist but you don’t even know the basic type? For instance, you might have some (char) and (char*) as well as (MyType) and (MyType*) – yet not realize those are there.

You basically have to either:

  • Know the types (be very familiar with the code); or
  • Realize that you may have to look for any function call (as in syntax of). This would indeed fine casts. It’ll also find other things such as if (…) and while (…). You could choose not to show those, but then what if you have a cast in those (a common thing is something like switch((int)*input) which in essence means you need (if you want to use C++ style casts) look for ALL code that looks like function calls.

You can however make it a bit nicer. Firstly, you shouldn’t have a type that is only one character. You also shouldn’t have types that begin with a number or an underscore (in fact, depending on your compiler that isn’t even possible as per the standards – though you can have variables that start with _’s you shouldn’t generally do that as they are considered reserved). The former – a number – cannot begin the name of anything in C or C++ (and for good reasons).

So, with those facts being said, we can do a few things :

  • Make sure it starts with a lower case or upper case letter. After that a number, an underscore or any letter as well as certain characters (say *) can follow. It must be at least two characters also.
  • And the above must be surrounded by parentheses.

What we come up with is the following :

 

grep -En "(\([a-zA-Z][a-zA-Z_*&]+\))" *.c

The above says search for the pattern (between the “‘s) in any file that ends with .c in the current working directory.

Basically, we start out by the open parenthesis that is required before the rest. Then, we start a backreference (this is important: try without the \( and the \) if you’re curious what you’ll match instead. In fact, I suggest it if you’re unfamiliar: it’s quite different results because you’re matching more). Then, we say find (after the open parenthesis) a letter a-z or A-Z. The [ and the ] are also important. That’s allowing ranges – i.e., [a-zA-Z] means match ONE character that is in the range a-z OR A-Z.

Next, recall that it shouldn’t be one letter for the type. So, we search for:

  • any letter of any case – that’s the a-zA-Z part
  • an underscore – the _ part
  • a * – for pointer casts
  • a & – this is for the C++ concept of references. In C & has two meanings (unless I’m forgetting some): address of (e.g., &var) and bitwise AND (e.g., 1 & 10).

As for the + after bracket ( the ] ), that means match at LEAST ONE of the characters we searched for. With the two expressions, it means display any line that has two or more characters between ( and ). Yes, this does mean you could potentially see function calls such as :

 

fclose(fp);

How do you prevent printing that? Well perhaps the easiest way (yet less efficient way [especially if you have many you want to mask]) :
Pipe the command to another grep with the option -v, e.g. :

grep -En "(\([a-zA-Z][a-zA-Z_*&]+\))" *.c | grep -v "fclose"

Two other commands worth mentioning while I’m discussing regular expressions. Lookup ‘awk’ and also ‘sed’. They are incredibly powerful. In fact, you could call them grep with additional features. For example, the following three are equivalent :

sed -n '/test/p' *cpp
grep test *cpp
awk '/test/' *cpp

Why would you use sed or awk over grep? You might want to actually edit the output in place or the file in place. Or you might want to only change a word/pattern if another word/pattern is found on the same line. Again, sed is one such solution. Or you might want to only print out certain fields (eg with awk) as opposed to the whole line.

Note that there’s entire books on awk and sed, and some would say they’re a complete language even, so I’m not even going to attempt to explain them, but I do use them quite a lot. Very useful utilities.

DNS BIND Serial Numbers

Posted on by

Although many more (than in the past) use nsupdate(1), I still edit named zones by hand (read: I’m too lazy to RTFM when vi(m) allows search/replace through the entire file, I don’t deal with huge zones, and the zones I do deal with are not often updated anyway). Now, as any one who has dealt with DNS will likely know, there’s a concept known as the serial number. Of course, many may know of other kinds of serial numbers but I have no interest in those kinds.

The basic principle is that it is a way to know if a zone has been updated (when the serial is incremented then the name servers know its been changed [once its loaded in the master nameserver]). The format is the following:

YYYYMMDDXY

The YYYYMMDD is obviously the year, month and day of the month. The XY (which might be better referred to as XX – you decide) is the part of the serial that says which update it is. In other words, the first change for the day can be 01, the second 02, all the way to 99 (though it should be noted that if you’re doing that many edits in a day or even close to that many – what you’re doing is doing something wrong!). In fact, I have this vague (and this may be a false memory) memory that it goes up to 20 maximum. But even still, 20 is too much if you ask me (and likely most if not all other DNS administrators).

So, what happens IF you go over the value or you cleverly play around with it and add more digits? Well, while it may or may not be fortunate that its an actual number (as in integral) and not a string – and therefore you have a more limited number range, you can fix it. You can also fix it if you (like I did the other day – at a time when I should probably not have been editing I might add!) accidentally change the number to either a number you meant to put else where or change the wrong digit entirely. I don’t recall what I changed the number to the other day except that I put it at least a few days in the future.

So then the next time I looked at it and wanted to make a change, I see that it’s actually a day ahead (I think the date was 27 instead of 17 and I checked again the 26). Well, thankfully I remembered playing around with this before.

The fix is very simple. The integer that the serial is stored in is of type unsigned int which means its minimum is 0 and its maximum is 4294967295. So, when an unsigned integer overflows, it will be reset to 0 and start over. In other words, if you make the serial 4294967296 it’ll go to zero. If you set it to 4294967297 it’ll be 1, and so on.

Understanding that is the key: simply set your serial in the zones to 4294967296 and do a :

rndc reload

If you have logging enabled you should see the serial is reported tohave gone backwards. That’s what you want: now you can set it to the proper serial and restart or reload named (rndc reload or service named restart).

It’s really that simple. The only time you might need to change that number is if your system’s maximum is higher. I think that unlikely in a standard Unix and Linux machine however. The point is in any case this: you overflow the serial so that it goes back to zero. Then you set it to the proper serial.

Search for C Style Casts in One Command

Posted on by

(Update 2011/01/08: I just realized this. When I was doing this, it was related to pointer casts. Therefore, I think I should point out this is more for casting something to a pointer of some type. The other – a basic or primitive type is a bit harder because other things can match the pattern as its less restrictive. Still, it is possible to work around that in various ways).

During development, if you ever have or had to work with C code, you’re likely to find the old style C type casts in a program’s source code. This is code that looks like :

(int*) 0

What does that mean ? It means interpret 0 – disregarding what it really is – as a pointer to an int. What is so wrong with this ? Well, its not type safe. There’s many reasons this is bad, and while it may be ‘OK’ in a C program, it still has risks involved. This is why C++ has a new style for casts. I believe its even made so ugly because its an ugly operation so it makes one (hopefully) think twice before using casts. In most cases you should not need casts in C++ because of the way its designed.

However, assuming you need to cast, you should use the C++ style casts. They are more safe, can check types (say, dynamic_cast) and in general much safer overall and therefore more sane. That’s not to say you _should_ use them, but if you have to, they are a better option than the C style.

But, that being said, a lot of code out there is full of the old style. If you’re working with C++ you should use the new type. However, most would say its hard to spot. However, a basic regexp (regular expressions are very powerful indeed) can find ALL casts in all files you target that are of C style.

The command below will show you all files with all C style casts, regardless of spaces between the type and the *, and regardless of spaces after the close parenthesis. If its any surprise, yes, this is for Unix and Linux users. The command, grep comes to your rescue. Assume that you have a bunch of files ending with .cpp that you would like to check for C style casts, in the current directory. Then all you have to do is :

grep "(.*\*)" *.cpp

Do I have to explain it ? Okay, here we go :

grep is the command. When you quote something in the shell it can have different meanings. There’s also different types of quotes (single quotes, back quotes [the grave accent - `], etc.). They all have different meanings and its best to simply try looking at the particular shell’s man page (manual). So, in this case what we’re actually saying is :

  • The first ( is the opening brace of the cast style itself.
  • The .* means we want any character and that pattern is matched repeatedly (simplified this explanation – there’s other articles and sites entirely dedicated to regexp’s s they can become very complicated!).
  • The \* is saying we literally want to match a * (instead of using it as a pattern matching character). That would be the pointer notation in the cast.
  • The ) closes the cast.
  • The *.cpp means grep should look in every file with a name that ends with .cpp (in the current directory).

An example file that looks like :

(char *) 0
(char *)0
(char*)0
(char*) 0
(int **) 0

And a run of the above command on that file :

grep "(.*\*)" test.txt
(char *) 0
(char *)0
(char*)0
(char*) 0
(int **) 0

One more quick note about the "’s even though I already said to check the manual. If we did not have them, you would get an error that looks like : bash: syntax error near unexpected token `(‘

In other words, they are necessary.

In any case, it really is that simple to find C style casts. I imagine there could be more complicated casts, but if you understand regular expressions, then you can find them fairly easily (or at least as not as hard as it may seem).

30 Years In One Night

Posted on by

So, although a lot of this year was rough for me, there’s definitely some important and positive things in this year, too. I’ll reflect on this as I think it is inspiring and it’s always something to keep in mind – no matter how hard or bad things seem to be, good can come if you let it.

In I believe it was August of this year, my favourite band Metallica announced four very special shows for Metallica Club members only. The reason is that in October of this year, it would be 30 years of the band. So, to celebrate, they gave clubbers the chance to win tickets to one, two, three or all four shows. The shows would be December 5, 7, 9 and 10. Now, I’m very thankful and fortunate to have won the first night. I’m especially lucky as I actually lost the ‘four pack’ drawing (meaning you pay $19.81 for four nights) and then I also lost the first drawing of individual nights. Well, I thankfully won Night 1 in the second chance drawing. So, for $6 plus $2.50 for convenience, I got a ticket. I actually ended up spending more as I was allowed two tickets.

So, on December 4th, my brother, my brother’s fiance, my mom and I all went up to San Francisco. The very first time for me, and oh what a reason to go there! On the 5th, my brother and I ended up being on our feet for 15 or more hours. We got in line (already quite a line) at around 11:45 in the morning. The venue did not let us in until 6:30 and the concert did not start until 8. Further, we didn’t get out until after 2am. Well worth the sore legs and sore everything, however. Lots of laughs both inside the venue and out.

During the last song, their common closure Seek and Destroy, balloons were dropped from the ceiling. I caught one and later realized there was a coin in it. I got the large green coin (green was the colour for Night 1 – each night they had a different colour). My brother was given two by someone (If I recall from Australia) – one large and one small. My brother asked me if I wanted the small one and I was thankful and indeed did take it.

The night was absolutely incredible and something I will never forget (unless I get dementia perhaps…). It was a memorable experience and the most important experience in my life, for sure, as they mean so much to me and have helped me in so many ways.

A bit about the show:

First, ‘testimonials’ by a bunch of people, including Beavis & Butthead (that was really neat to see, and I remembered them always [especially Beavis] liking Metallica). Then, the comedian Jim Breuer hosted a Metallica trivia contest. That was really neat to see. Then the Soul Rebel Brass Band played. That was actually really cool. Also opening was Apocalyptica – yes, the cello Metallica cover band. Then Metallica came on stage. They actually opened with The Call of Ktulu! Following that, many other cool songs, including three songs never played, one never released:  Carpe Diem Baby was played for the very first time. Then, they played a song never released called Hate Train. And later in the set, (along with Brian Tatler and Sean Harris of Diamond Head !!) they played Its Electric (never before played live until Dec 5 of this year).

I got some nice items there, and I have a picture of some of them (all but the 4 poster set I bought too, but have not hanged anywhere yet).

Speaking of 30, it’s near my 30th birthday too, so that’s another neat aspect of this (it’s less than 2 months away). In addition, this year was the 25th anniversary of the tragic loss of Clifford Lee Burton – the second bassist of Metallica that lost his life in a bus accident in 1986. Thank you Cliff for your beautiful music, your inspiration, and influences you had on the band and the fans, from the bottom of our hearts. Thank you also goes to Ray Burton (Cliff’s father) who was at the first night and spoke of Cliff there too. That was awesome.

So, with that said, that’s how 30 Years can possibly fit into one night. Technically it was a week long celebration but I only had one night, so for me it was one night.

Remember, no matter how hard things are, there’s good somewhere to be found. You just have to look hard enough and stay strong. As the back of the coins say, 30 Years Strong! There was a time I never thought I’d reach 30 but I’m basically there, and that is something HUGE.

And now for the things I got while at the show – minus the four poster set:

30 Year Anniversary Memorabilia

30 Year Anniversary Memorabilia, Night 1 (5 December 2011).

Microsoft’s Irresponsible Failures

Posted on by

I admit it: I am very critical of Microsoft – especially when it comes to security. But, that’s partly because of all the things I’ve seen over the years; their attitude towards security is not just shocking and scary. It’s downright irresponsible. We ALL have to make the best of security issues. We will never be perfect – no one is. Not me, not even Dennis Ritchie was perfect. No one is and that’s fine. But to IGNORE issues when it effects so many people is just wrong. How many systems are compromised that are Windows based versus other systems? A lot more, I’d say. And you know, that’s not because flaws don’t exist in other operating systems. It’s not because there aren’t other systems. It’s not because there’s not exploits for other systems. I assure you, there’s a lot of flaws in many other operating systems. Observe the following facts.

  • The first worm to exist (or one of the first and is certainly considered the first one and most notorious one in those times) was designed to effect Unix based operating systems! Known as the Morris Worm, it targeted rsh/rexec (long history of security problems and should not be used for years now), sendmail, finger and weak passwords. Those are Unix programs and services (minus the last one which is a human failure).
  • A remote hole or flaw in a Unix/Linux system can often lead to root access (that is, the administrator account, for the Windows folks out there). Yes, this can happen in Windows but often it was that the system crashes or other possibilities too (which these could happen in Unix/Linux too, but its more likely the former).
  • I remember YEARS ago (well over a decade ago) of Unix/Linux malware.
  • Macintosh operating systems have had pretty significant malware too!

So WHAT is the REAL problem? The problem, I would say is twofold :

  1. When something is (no offence to any Windows users – it’s not all of them) “dumbed down”, it makes it easier to use. Clearly the point. However, the fact is when something is so easy to use, it means you don’t have to learn much or as much, which means you’re more unaware of things, and that means more likely to become a victim of a flaw or attack in the system. It’s kind of like, for a rather realistic example, what do you do if your brakes in your car aren’t working or even if your gas pedal gets stuck? Do you turn the key, or what? You SHOULD learn this, but that does not mean you will; after all, something may be a newer phenomenon. But if you’re experienced, say with a computer system, you can trouble shoot and figure things out much more easily.
  2. Secondly, it’s not all the users fault (despite my quote you may see from time to time on this site): Microsoft has truly shown ignorance, outright stupidity and simply put they do not always even care enough to fix a problem (which I’ve written about before).

So what am I getting at with this article ? Windows 8, which is not even out yet. What IS out is something they are at least considering. Picture passwords. WHAT?! Check this…

Once you have selected an image, we divide the image into a grid. The longest dimension of the image is divided into 100 segments. The shorter dimension is then divided on that scale to create the grid upon which you draw gestures. To set up your picture password, you then place your gestures on the field we create. Individual points are defined by their coordinate (x,y) position on the grid. For the line, we record the starting and ending coordinates, as well as the order in which they occur. We use the ordering information to determine the direction the line was drawn in. For the circle, we record a center point coordinate, the radius of the circle, and its directionality. For the tap, we record the coordinate of the touch point.

There’s more to be found on their blog, which you can find at http://blogs.msdn.com/b/b8/archive/2011/12/16/signing-in-with-a-picture-password.aspx

The funny part, is they actually do the mathematics for password combinations versus the above, and what does it say? Look here :

The analysis of the number of unique PINs is trivial. A 4-digit PIN (4 digits with 10 independent possibilities each) means there are 104 = 10,000 unique combinations.

When looking at alphanumeric passwords, the analysis can be simplified by assuming passwords are a sequence of characters comprised of lower case letters (26), upper case letters (26), digits (10), and symbols (10). In the most basic case, when a password is comprised strictly of n lower case letters, there are 26n permutations. When the password can be any length from 1 to n letters, then there are this many permutations:

…

For instance, an 8-character password has 208 billion possible combinations, which to most people would seem amazingly secure.

 

Unfortunately, the way most users pick passwords is far from random. Left to their own devices, people use common words and phrases, names of family members, and so on.

 

So, because most users choose insecure passwords, you’re thinking this is going to be any better? Wow, stupidity sure is potent. Unless you require a certain amount of gestures, it’s not going to be better, despite what your math comes up with. Add to the fact that any modern system can allow MORE THAN 8 character passwords! But even then, well, even Graham Cluley got it right. Note: I some times don’t even agree with him, and have in the past criticized him about some things. Who is he? A top security researcher at Sophos security (that’s an antivirus and internet security program company). And what did he say ? Let’ see…

“With normal password entry, what you’re doing is asterisked on the screen,” said Mr Cluley. “With this gesture input, folks may find it easier to see the movements you are making.”

And he also added something else of importance :

It just might be better if an operating system encourages stronger passwords, and that includes checking against a dictionary file (Unix has done this for years!). Look:

[cody@triangle src]$ passwd
Changing password for user cody.
Changing password for cody.
(current) UNIX password:
New password:
BAD PASSWORD: it is based on a dictionary word
New password:
BAD PASSWORD: it is based on a dictionary word
New password:
BAD PASSWORD: it is too short
passwd: Have exhausted maximum number of retries for service

Now, firstly, note that in Unix/Linux systems, echo is turned off completely for password entry. So, the first line I typed is ‘passwd’ to change the current user’s password. Then, I type in my current password. This is checked to decrease the possibility that I left the console unattended and some donkey is trying to change my password. Then, I typed ‘dictionary’ for the first time. What happened? Ah yes – based on a dictionary word and is therefore NOT ALLOWED! The next two times? ‘test’ (w/o quotes). Yes, simply test. And look, its too short! Imagine how hard that is?

So, basically, what we have here is that Microsoft once again is being irresponsible security wise. Why? Are they stupid? Blind? Ignorant? All of the above? I don’t really care. The only thing I care about is they are being irresponsible and once again they seem to believe they can just ignore simple steps to help with security. Whether someone is breached by this or not, is irrelevant: the fact is IT IS INSECURE. At least, if anything, don’t SHOW on the screen what’s being done. Either way, when you ignore security, or miss something obvious, then you increase the risk for someone to get compromised. And what happens with that? OTHERS who they don’t even know SUFFER. You have spam botnets, you have DoS and DDoS attacks, you have scanners going across routers to servers… worms eating bandwidth… and so on.

Lastly, I wanted to say one thing before some wise person tries to claim something about this concept of gestures compared to keyboards. They might mention keyloggers and then say, the gestures are immune to it. Sorry to burst your bubble, but nope, its not immune at all. You can determine where the cursor is, you can change it, you can always do at the low level what the user is triggering at the high level. This is why you can trigger ctrl-alt-del event and the operating system can too (in addition it acts upon it). What the user can do, the system has to interpret and do it.

No matter which way you look at it, this is a foolish move (pardon the pun). It’s also amusing (minus the possible security implications) – they try to justify it because users use weak passwords. Fact is, users will use weak gestures too. Humans are the weakest link in the chain. And, if they argue that it has to be X-Y number of gestures, then why the heck can you not do the same for passwords ?! Exactly my point. I get the feeling they only care about sales, and with an “innovative” thing they are possibly going to get more interest (not that they don’t have enough already).

Debugging Without Debug Symbols

Posted on by

The other day I came across something really interesting that I had never heard of. Indeed, upon a quick search, it seems this may be a little known trick yet incredibly useful to (at least) me and (maybe) others. To be fair, the symbols ARE generated. However, they are not in the binary itself.

What if you could somehow copy the debugging symbols to a separate file, remove them from the binary and then add a link in the binary? Well, the binary size will decrease by a lot.

Here is an example of file sizes, in a program I’m working on (its in C++). I had already optimized header files for decreased binary size, made constant strings extern linkage. The reason I make it extern linkage is simple: in C++ if you have a constant (e.g, a const std::string) in a header file, it is linked per file that includes it. This can potentially increase object file size quite a lot. This increases the binary size as a whole. Now, before header file optimization the binary size was approximately 11MB. After the optimization, I decreased it down to 7.7MB with other code added (quite a difference if you think about it). Still, a similar program in C was only around 3.5MB (both programs with debugging symbols created by the gcc/g++ -g option).

I knew there was an option in the strip(1) command to discard all but needed symbols, and I had this memory that there might be one such option for only needed debug symbols. However, I found something even more useful. This is perhaps why its less known than it could or should be, but it actually refers to the objcopy(1) command. Interesting thing is, it has exactly what we need with respect to moving debug symbols out of the binary and into a separate file, and then adding a link to the binary.

To simplify things, I’ll say that the executable file is ‘program’ and its in the current working directory (CWD). The following three commands will do exactly what you need (assuming you did compile with debug symbols in place) :

objcopy --only-keep-debug program program.dbg
objcopy --strip-debug program
objcopy --add-gnu-debuglink=program.dbg program

Now, after that, you have an additional file called program.dbg (which you could have named whatever you want). However, the original binary I said was 7.7MB? Well, even more code added, and the file size is actually 2134533 bytes, or in other words, 2.1MB. Very nice. Now, as for debugging?

You run the debugger the same exact way. What you’ll see is something like the following :

Reading symbols from /home/user/program…Reading symbols from /home/user/program.dbg…done.
done.

As you can see, the debugging symbols are read in yet the binary size is a lot smaller. Is it perfect? Well, that depends on your definition; if you require debugging possibilities, then it’s about as close as you’re going to get. If you don’t, then there’s no point in compiling with debugging symbols anyway (especially if you have the source that you could compile with symbols if the time ever arises). So, in short, it as perfect as it can be. Some may not be bothered by larger files, and that’s fine. But I can think of several uses for this, and that does not even include the fact the memory space in RAM will be smaller.

Quines in C

Posted on by

So, this morning at about 5:30 or so, I was looking at the page (on Wiki) for the ZIP file format. I came across something that if I’ve never heard of, at least not in this context (or I certainly do not remember it). I found the concept fascinating. Indeed, I’ve heard of archives including archives, whether itself or not. Yet, I never thought of the difficulties in a computer program printing out its exact source code as written in the source file.

I would think this is a fascinating thing for anyone who has ever touched a programming language. Why? There’s many reasons, among them :

  • You use quotations and other symbols when printing a string. So, how do you print the quotation as a quotation all the while printing out the way you generate the output? For example, take the following snippet of code :
    printf("hello world");

    How do you print that text out exactly without using the ” ? And if you use the ” then you have to close it (matching quotes) and then you also have to display the exact instruction as in the source. If you escape the ” (say, \”) then you have to also display the \” too.

  • The same for quotations applies for new lines: if you print out a new line, you also have to both print a new line but you also have to show the exact source that tells the computer to do that!

However, note that it is cheating (and destroys the challenge) to read in the source from a file. What’s the point in that, really? Okay, so I can think of one possible addition to increase the challenge, but nevertheless, its still not a quine and indeed its cheating!

So, on one of the pages I was reading about quines, I see the following C snippet. As they point out, and is observable, it has a few problems. First the source, then I’ll point out the obvious (or to some perhaps not so obvious) issues:

main(){ char*p="main(){ char*p=%c%s%c; printf(p,34,p,34); }"; printf(p,34,p,34); }

If you compile and run that code, you’ll get a warning (on compiling – still compiles though) and it’ll print out what the source is.

So what’s the problem with such code? Well, two big glaring issues are:

  1. There’s no #include directive for the C preprocessor. This means that when the compiler reaches the function printf, you’ll get a warning like this:
    quine.c:1:103: warning: incompatible implicit declaration of built-in function ‘printf’ [enabled by default]

    It’s not a terrible problem, but its still not standard compliant code.

  2. Then, the other issue is something that Microsoft is particular bad about: main has no return type (though, in the case of Microsoft its worse; they define it as void, at least in the past; main MUST return an int to be compliant with the C standard and its undefined behaviour otherwise. Even if it works on your system, its still not proper working code and is STILL undefined). In the case of the code above, it simply ignores the return type. It’ll implicitly return, but it’s still best to be explicit. In the case of no return type (not even void) it’ll default to int but if you are following the standard gcc will give you a warning.

Now, even though that is incorrect code by the standard, it does have a benefit. That benefit was give me a challenge to resolve those issues and also even print out new lines.

The trick? It’s really quite simple (though it may take a bit of time to sort it in your head). You either think from the inside out (e.g., like you might if you’re writing a somewhat complex pointer declaration) and/or you have to match the printed part to the location it would be in the actual source.

Here’s what I came up with and the actual test to see if it works out :

#include <stdio.h>
int main(){ char*p="#include <stdio.h>%cint main(){ char*p=%c%s%c; printf(p,10,34,p,34,10,10); return 0; %c}%c"; printf(p,10,34,p,34,10,10); return 0;
}

The test is simply this :

gcc -o quine2 quine2.c
./quine2 > quine.out
diff quine2.c quine.out

Output is nothing, which means there is no difference at all. If there was any difference, including a single character differing, then it’d show that. It could even be removing a tab followed by a new line and changing it (at the same line number) to just a new line, and it would show it!

I’ll explain a part of the code that may not be immediately clear now :

What is the %c and %s and the numbers all about ?

Okay, %c means substitute the corresponding parameter as a character. %s is the same only it is considered multiple characters (technically a ‘\0′ terminated series of char’s). Then, the 10 and 34s? 10 is the decimal code for a new line character ( in C its the same as \n ). The 34 is the character code for the double quotation mark, i.e., “.

So, in the final printf in the code, it says the following :
printf(p,10,34,p,34,10,10);

  • The format specifier is ‘p’. That’s what we already defined right before it.
  • The first 10 is new line character after the #include <stdio.h>
  • The 34 is the first ” that we want to print.
  • The next p though, what is this about? Well, we want to print it out too (else the program isn’t a quine)!
  • Following that, the 34 prints the matching/closing “.
  • The next two tens print out the new lines at the end of the file.

So what IS the output of quine.out ? It’s the source of the program, exactly as written :

#include
int main(){ char*p="#include %cint main(){ char*p=%c%s%c; printf(p,10,34,p,34,10,10); return 0; %c}%c"; printf(p,10,34,p,34,10,10); return 0;
}

So there you have it. A rather fun exercise that forces one to use their brain for a moment, and do a fun and unique challenge!

Using ‘cat’ to Unzip a Multipart ZIP File

Posted on by

Some times I’ve downloaded a multipart zip archive in the form of ‘archive.zip’ and ‘archive.z01′. The file ending with .zip is the end of the archive. Now, the problem is twofold:

  1. If in a graphical environment (e.g., KDE) and using a specific archive program (e.g., ark), the said program may have a problem extracting the whole archive – it only extracts the first portion. Further, when opening the other part in ark, it doesn’t detect anything.
  2. The command line ‘unzip’ program does not support true multi-part archives (yet, anyway).

So, the question is, how do you solve the problem and get ALL files from the archive? Well, if you run unzip on the file (archive.zip), you might see something like the following :

Archive: archive.zip
warning [archive.zip]: zipfile claims to be last disk of a multi-part archive;
attempting to process anyway, assuming all parts have been concatenated
together in order. Expect "errors" and warnings...true multi-part support
doesn't exist yet (coming soon).
file #1: bad zipfile offset (local header sig): 4
file #2: bad zipfile offset (local header sig): 11002712
file #3: bad zipfile offset (local header sig): 47375652
file #4: bad zipfile offset (local header sig): 94779768
file #5: bad zipfile offset (local header sig): 138492430
file #6: bad zipfile offset (local header sig): 181433878
file #7: bad zipfile offset (local header sig): 218303439
file #8: bad zipfile offset (local header sig): 266120089
file #9: bad zipfile offset (local header sig): 290391174
file #10: bad zipfile offset (local header sig): 335149943
file #11: bad zipfile offset (lseek): 393650176
file #12: bad zipfile offset (lseek): 434380800
file #13: bad zipfile offset (lseek): 481607680
file #14: bad zipfile offset (lseek): 515162112

After that, it does indeed extract some of the files (like ark). Because of this, I get a feeling ark is a graphical front-end to the various archive programs. In any case, it does give a clue to the answer. It assumes that the archive is concatenated (what ‘cat’ is short for) together. So, therefore, the multi-use program ‘cat’ comes to the rescue.

You do the following command, adjusting it to refer to the files in the proper order. Since the .zip one is claiming to be the last, you want that to be the last one. Just do something like this then :

cat archive.z01 archive.zip > new_archive.zip
unzip new_archive.zip

Indeed, you’ll get errors and/or warnings. However, you get something else too: the files you wanted and that means all files from the archive. If there were three parts, then the commands might be:

cat archive.z01 archive.z02 archive.zip > new_archive.zip
unzip new_archive.zip

Basically, ‘cat’ will spit out the files in the order you give it. Then, the > means redirect (creating and/or overwriting) the file to the right of it, in this case ‘new_archive.zip’. There’s more possibilities, and you can even use cat to simply display a ascii file to the screen (or multiple files). In any case, with the above, you would now have a concatenation of the files in the new file. Then you run unzip on that file, and all is good. For more information on ‘cat’ see its man page (e.g., at the command prompt type ‘man cat’). The technique used here can be used in other similar cases (I once needed to split a tar file [archive created with the program 'tar'] to multiple parts and later recreate the archive in full though admittedly that one was a bit more involved) too.

In Memory of Dennis Ritchie

Posted on by

About an hour ago I heard the tragic news of Dennis Ritchie’s passing. Feel free to pass by this, but Dennis Ritchie was a huge inspiration to me. I may not have known him personally, but he has touched my life in more ways imaginable. He was an incredibly brilliant person, and a great mind is now gone from this world. In spirit, however, he will never be forgotten… not if I can help it.

Who was he? He was the creator of the C Programming Language, and one of the creators of the Unix operating system – the original from AT&T Bell Labs. Given that C is among my favourite computer languages, and Unix (and its derivatives) is absolutely my top operating systems for computers, his work is rather important to me. To those who don’t use either, or only one, well, just know that without Unix, the Internet as a whole may not be what it is today. Indeed, the people of Bell Labs that created Unix are very important for the Internet. At the time it was made, it was one of (if not the) first NOS. The OS indeed stands for Operating System. What does the N mean, though? Network. This was vital for the Internet (“network of networks”). What is such a thing without networking capability? Absolutely nothing. Besides being networked, it is also a multi-user (more than one user can be logged on at the same time, including the same user more than once) and multi-tasking (more than one process running on the computer at same time, albeit one program will be operating at a time) operating system. It is used to this day, and its derivatives more so (the Linux kernel is a free version of Unix).

Since Unix was written (or needed) to be powerful, flexible and extensible, there was one other issue to be resolved: it had to be portable (read: possible to run on different platforms). Originally, Unix was written in the assembly language. And while it is a powerful language, there’s a couple problems there.

  1. It is not portable. Different processors have different instruction sets, and therefore different assembly instructions.
  2. It’s not as easy to maintain, it takes a lot more code, and it is harder to read – especially if you are unfamiliar with assembly entirely.

The benefits of assembly (being its fast, efficient and closer to hardware) do not outweigh its cons, and therefore something different was needed.
The solution would be a new language: C – which was a “new” B language. So, back to the whole point of this history book: Dennis Ritchie designed and wrote the C programming language and Unix was then programmed in C by the team: Ken Thompson, Dennis Ritchie, Brian Kernighan, Douglas McIlroy, and Joe Ossanna (and others I’m sure too). The ones that are more known are: Brian Kernighan, Ken Thompson and Dennis Ritchie. One of the well known styles of the C programming language is in fact K&R – which stands for Kernighan & Ritchie. Clever, I know. Although the current standard is beyond K&R C (which had some things to be improved, definitely), it is well known by pretty much every C programmer (and likely C++ programmers that never touched C).

And although there is far more to the story of the Internet, make no mistake: C and Unix are a very important part of it and both are very relevant to this day. Note that this was all in the late 60s to early 70s, too, so the very fact they’re both still around in an age where things are outdated almost as soon as it reaches the shelves, is highly impressive. Without a portable Unix operating system, the Internet as it is known may not be what it is.

I didn’t know Dennis, but I am indebted to him. I think the world is in many ways, certainly those who are on the Internet. Dennis Ritchie, rest in peace and thank you ever so much for your wonderful creations, your dedication and work at Bell Labs, and even for making this world a better place. In short: thank you for C, Unix and all the work you did that helped the creation of the Internet and the services that run on the Internet.

Steve Jobs of Apple

Posted on by

So, I just saw that Steve Jobs, founder and former CEO of Apple, has passed away. While its known I don’t like Apple as a corporation, what is also known (to those who know me) is I won’t disrespect human life. So, here’s some thoughts – positive thoughts – about Steve Jobs and indeed Apple. Have I lost my mind? No, I really don’t think so. I think I just don’t like some of their ways but that doesn’t mean they didn’t bring any good or that Steve Jobs is a terrible person. In fact, I think quite the opposite.

First, although I disagree with blocking of recording of live music (which Apple applied for a patent on one of their phones and a technology that does try to block recording of any live event) full on (it should be up to the band, frankly), I will say that Steve Jobs has helped both the music and video/movie industry. How so, is that Apple’s hardware is more often than not taken advantage of by the entertainment industry – video and sound alike. That’s a HUGE thing to many people, myself included. Thank you Apple for helping the music industry and the graphics and video industries.

Second, I have fond memories of the Apple IIe computer. I loved some of the old games with the not so “great” (compared to today’s possibilities) graphics. Sure, there’s other old time computers I have memories of, but I won’t lie: the Apple IIe is one of them and that was Apple’s computer.

Third, a big corporation with such technologies and capabilities, brings innovation (or as much as is possible when proprietary) and jobs (pardon the pun). It also brings competition, which brings new and better things along the way (including from themselves, e.g, the Apple IIe is nothing compared to today’s Apple technology). And hey, I have to give them some credit for using a Unix based OS for their MacOS X and onward (even if they did make it hard[er] to compile programs).

Lastly, Steve Jobs was human. He also happened to die way too young in today’s world. I lost an aunt to cancer. Many people lose loves ones to cancer, and its a terrible disease and its even terrible to watch someone lose their strength, their will, themselves, as it progresses. I really wish we were more advanced with health care, and indeed cancer treatments, but sadly we are not. We just need more time and work, but sadly many more will die before that time comes. Here’s something interesting, however, and something on the positive end in a way. Anyone familiar with mustard gas? Yes, that’s what the Germans used in World War 1. Well, back in the 1950s, they actually used mustard gas in cancer. How is this positive? Well, its positive that we’ve moved away from that and to something more sane. Sure, chemotherapy and radiation are not exactly safe. Indeed, it actually is killing the cancer cells (at the same time it sadly is killing the person too). But, remember, not everything comes overnight. Remember that many things that we have today (e.g., anaesthesia for that painful surgery you might have to go through one day) didn’t always exist. Same too with anti-emetics (anti-nausea) and many other things that many people rely on. At the same time though, mustard gas was doing similar to what chemotherapy and radiotherapy do: they are killing the person (and thus cells in the body). However, what we have today is far from perfect – but it’s all we know at this time.

(As an aside, please, if you’re against medical research, keep it to yourself. Please. Too many are dying terrible deaths due to government or whoever else trying to stop medical research or even medical care. It’s fine if you do not want medical care, but please don’t try to prevent others from getting healthcare. It’s vital and you yourself would not be alive today if it were not for medical care. Don’t believe me? Then go look up the plague for one example of many diseases that wiped out many many people and that likely includes ancestors of yours.)

Binding Sockets to IPv4 and IPv6

Posted on by

Although I’ve not really documented it here, I have another project that I work on. This particular project is a network based program. Yesterday I decided to finally migrate from the old socket API calls that have been obsoleted to the new calls. One thing with Linux (and possibly other environments) is that when you call bind() multiple times to bind the socket to a port on different addresses and specifying that BOTH IPv4 and IPv6 is allowed, is you very likely will get an error.

The error is that the address is already in use.

So, how do you resolve it? Well, firstly it helps if you know why it is happening. The reason is this: an IPv6 IP can have an IPv4 address as part of its address, in the form of ::ffff:127.0.0.1 as an example. Now, many operating systems allow for IPv4 traffic on an IPv6 socket. So what happens if you go through each address? Due to IP mapping, you end up binding the same IP more than once which is an error.

So how do you fix it? Well, one way is to prevent it the mapping with an #ifdef .. #endif check. You might want to see if you have this #define in your headers, but the linux systems I’m aware of and that are up to date should have this. So, as long as you have IPv6 connectivity, you likely would have the #define too.

It goes something like this (first the fix, then a full example) :

#ifdef IPV6_V6ONLY
 int v6only = 1;
 if (ai->ai_family == AF_INET6 && setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, &v6only, sizeof(v6only)) < 0) {
   close(fd);
   continue;
 }
#endif

It basically sets an option on the socket (when it’s address family is AF_INET6) that says do not use mapping: IPV6_V6ONLY – or in other words, do not allow IPv4 addresses on a socket in the IPv6 address family.

A full fledged example, can be found here. Note that it is NOT a full server. It only demonstrates an example function that creates sockets and binds to a specific port on each address in the system. It is in C and not C++; I had it in C++ initially but took out the application specific code and made it C; it’s easy enough to convert to C++ anyway).

Note that error checking is done but may not be the most ideal way of handling it. It just continues to the next address (if any). You could for example change it to return an error, exit the program, or whatever else you need. The main point is how you get the addresses of the system and how you bind them.

Jules Verne: Scientist or Author?

Posted on by

So, I just noticed an interesting science project. The general idea is below, and more can be found at the BBC – Magnetic Mysteries of Earth’s core.

To understand what form it might take under the extreme conditions at the centre of the Earth, Professor Kei Hirose set himself a seemingly impossible challenge: recreate the conditions of the core in his lab at the SPring-8 synchrotron near Osaka, Japan. After 10 years of trying, he has finally succeeded.

He has created an incredibly powerful vice using the tips of two diamonds. Between them he has pressurised a sample of iron-nickel to three million times atmospheric pressure and heated the sample to about 4,500C.

Under these extraordinary conditions, the crystal structure of iron-nickel alloy changed and the crystals rapidly grew in size. “We may have very big crystals at the centre of the Earth, maybe up to 10km,” says Hirose.

These crystals would all align “like a forest”, says Hirose, pointing at the poles.

Also mentioned in the article, is my favourite author: Jules Verne. Why, is because in one of his novels, _The Journey to the Centre of the Earth_, he describes the centre of the Earth as having growing crystals (among other things).

I said for years that Jules Verne was way ahead of his time. It seems far more so, now, as the article I mentioned (above) shows. I’ve read several of his books (I’m sad to admit I never got around to all of them) and I want to highlight upon some things that I remember from reading the books, years back. It’s not just seismology though. It’s other types of science, too. Also travelling methods come to mind. He was ahead of his time in quite a lot of different things, and as more time goes on on Earth, the more it shows. And when he wrote about these things, he described them very similar to how it ended up being. I find that fascinating. It says a lot about many of the positive features of the brain and the imagination.

For example, as I recall, in _20,000 Leagues Under the Sea_, Captain Nemo had something very much like electricity in his submarine. Firstly, the novel was original written in 1870, and what? Submarines? They weren’t invented at that time, and they certainly were not in wide use until the next century during World War I. Yet, then there’s another interesting thing: light in the submarine powered by his form of electricity, which also wasn’t in existence. The light bulb was introduced and demonstrated in 1879 – roughly 9 years after 20,000 Leagues. Sure, it was an old idea, but as I recall it, the similarities in both systems – they were shockingly close. It’s been years since I read it, but this is only one such book and similar idea to our life these days.

And although I cannot remember other examples in detail, I do recall many things sounding very much like life in the 20th century (when I read his works). And now, it seems like he may have been partially correct in his book _Journey to the Centre of the Earth_.

What’s also very interesting, is that one of the Linux distributions I am familiar with and use on a daily basis (Fedora Core) – the next version is in honour of Jules Verne. I was excited to hear that but now more so.

In short, Jules Verne was a fascinating person, a very imaginative writer, and to those who like to read and have not read his books, I highly recommend them. If you’re curious, my favourite of his is somewhat of a sequel to 20,000 Leagues Under the Sea. It’s a fascinating book full of adventure, science, survival as well as (not surprisingly) mysteries. The name? The Mysterious Island. I did also like 20,000 Leagues a lot (and had to read it when I realized the link to it and The Mysterious Island). I enjoyed the others I read, too but those are my two favourites.

As for how I was introduced to him, I have to thank my father. Although we’re not close, one thing I loved doing with him, is we each (on our own time) read books he suggested (that he read when he was younger), and then we talked about the books. That’s one of the few very fond memories of my father, but I’m happy to have that, for I may not know of Jules Verne or certainly not have enjoyed his books. We also enjoyed something together. I also, as I recall it, heard of a place I’d like to go to visit at some point, here in California. I think it was during discussing something with my father about The Mysterious Island, that this lake came up: Mono Lake. It could have been a different book, or it could have been both. It’s been too long since it happened. Regardless, it sounded really interesting, and I hope to go some day.

Thanks also go to the BBC for yet another inspiring and fascinating article that brings light to something interesting in the world, new or old or in this case, a bit of both.

Phishing Botnet Uncovered/Discovered

Posted on by

Update: Moved the IP list to somewhere else to keep this place clean. If you’re curious about how many, when it was done, where they claim to be coming from, then see the list here.

Here’s a brief explanation of why I wrote this and am doing this (in short: I saw it and I find it obnoxious and I want others to realize the problem and make sure they don’t become part of it too).

So, this may actually be an ‘already known’ botnet. I don’t know, and frankly I don’t really ‘care’ if it is or it isn’t. It’d probably be best if it isn’t, but I’ve not seen this before, so I figured I’d write about it as an alert in case it is new. Besides, phishing is a low act, and I don’t think anyone deserves to be a victim of it, no matter how far out it may seem. Simply being gullible does not mean you deserve to have your identity stolen, for example.

So, anyway, this morning when I looked at my logwatch email I saw the following (among other things, of course) :

3 Reject HELO/EHLO
31 Reject unknown client host

I then looked further to see the supposed hosts. Most however, were fake domains (not too surprising). What makes me think it is a botnet, though? Basically, the domains don’t exist, they seem random, the connection attempts were done around the same time – within a day – and it comes from different countries. They also claim to be from the same email, and they obviously are trying to phish or cause major issues, given the address’s domain: irs.gov

To the non US folks, that’s financial and in particular tax, related agency of the US.

Note I do not check all the domains, but of the ones I checked, none (not too surprising given the names) exist. hall.com (just checked) does but I suspect it was randomly selected and it most certainly is not that IP that matches; that IP is from India; hall.com’s owner is in the Netherlands.

So, in any case, be on the look out – whether you’re an admin, an ISP or an end user. And remember, security is never fully obtained, but you do have to remain vigilant as possible and never assume things are as they appear – especially if your senses are telling you something isn’t right.

Do note that those domains listed do NOT MATCH THE IP – the IP is the SOURCE and it is the IPs THAT IS FRAUDULENTLY CLAIMING to be from those domains. The domains – most likely don’t exist – that do exist, are innocent. The IPs mentioned are the only problem, and likely just compromised machines who don’t even realize it (if it is a botnet it is almost assuredly this).

Fixing Bacula Database Manually

Posted on by

So, yesterday I decided to update my server. I had backed up things – not just daily backups but extra back ups. The main problem was the down time as I timed it wrong – I actually started the operation shortly before I had to leave for the day. And although I did get it back up, I did not get certain things up, web server included. But, what I did not anticipate, is having to fix the backup database. What happened and how I fixed it, is below.

Firstly, I use Bacula for my backup purposes. Pretty nice program. However, not only did I have to update the version, I had another problem with the database: a new field in one of the table ‘Job’. This prevented any data restoring from happening with an ugly error. So, firstly, to update the version I did the following (ignoring any warnings) :

 

/usr/libexec/bacula/update_mysql_tables

This allowed me to use the program ‘bconsole’ – which is, upon restore command, gave me the following error:

22-Jul 07:28 bacula-dir JobId 0: Fatal error: sql_get.c:311 sql_get.c:311 query SELECT VolSessionId,VolSessionTime,PoolId,StartTime,EndTime,JobFiles,JobBytes,JobTDate,Job,JobStatus,Type,Level,ClientId,Name,PriorJobId,RealEndTime,JobId,FileSetId,SchedTime,RealEndTime,ReadBytes,HasBase FROM Job WHERE JobId=106 failed:
Unknown column ‘ReadBytes’ in ‘field list’

I definitely had a problem. Not one I had foreseen. However, I thought of a fix. Firstly, since I had the backup of the mysql databases anyway, I’d drop the bacula database, create a new bacula database to find the proper structure. Then reimport the old database and alter the Job table to be the same. Would it work? Based on the error, I was missing a column called ReadBytes. So, after making a clean database, I discovered it should come after JobBytes column in the Job table. So, I did the following:

alter table Job add column ReadBytes bigint after JobBytes;

And then the restore worked fine. Sure, you could say this should not be necessary. But it was a major OS update and so I’m not surprised some things came up. And perhaps if I let it backup the database in addition, it wouldn’t have been a problem. I don’t know, and I don’t really mind, either. I backup mysql databases anyway, so I didn’t feel the need to let it do an additional backup. And since simply adding the field fixed it, I see no harm. It also brings to mind that no matter what you anticipate, other things can go wrong – or right. It doesn’t really matter what they are. What matters is how you approach them and how you resolve them. In my case, a bit of thinking and having been mostly prepared, allowed me to fix the problem.