Martijn on Dual_EC_DRBG

Good friend Martijn Grooten (twitter, blog) and chief editor at the Virus Bulletin was at Athens for a day or so yesterday and was kind enough to make a presentation about Dual EC DRBG and the possible involvement of the NSA on it. The event was hosted at the Hackerspace. It was a scientifically balanced presentation with a cool explanation of how elliptic curves are used in such cases and what kind of risks this entails.

Pizzas after the presentation were curtesy of the Greek OWASP Chapter.

Racket on the Mac

Since I’ve bought “Realm of Racket” I thought that I should install Racket on the Mac. The last time I seriously looked into it it was still called PLT-Scheme.

My first choice was to use a homebrew formula. Unfortunately this requires XQuartz and I did not feel like installing it too.

My second try was to compile it from the source. ../configure –disable-gracket && make worked, but make install failed. I really did not bother with why. I just wanted to install it and play around. This was not an installation for a lot of users after all.

So I got to download the precompiled Mac binary from the web site. 364M later it was all installed and happy.

Let’s see now if I’ll go through the book top to bottom…

PS: I remembered that I owned the eBook from this Ruby Rogues episode.

ERROR:gitosis.serve.main:Repository read access denied

[ I write this for I found the solution applied to my case at the 3rd link of the 2nd page of my Google search. I had never gone beyond the first page for years. ]

So there was this gitosis repository that lived on an Ubuntu server that had to move to a CentOS one.

Thankfully EPEL still carries gitosis and I did not built it from the source. I copied over the files and was done with it.

That is until I needed to change access to one of the repositories to add a user. Said user was denied any kind of access with:

ERROR:gitosis.serve.main:Repository read access denied

There are plenty of reasons for this occur (examples), but none seemed to fit in my case, so I brute forced the search results. And at the first comment that was posted on the third link at the second page Google came up with, the solution was found.

# cd ~gitosis/repositories/gitosis-admin.git/hooks/
# ls -l
total 48
-rwxr-xr-x 1 gitosis gitosis  452 Sep 11  2011 applypatch-msg.sample
-rwxr-xr-x 1 gitosis gitosis  896 Sep 11  2011 commit-msg.sample
-rwxr-xr-x 1 gitosis gitosis  160 Sep 11  2011 post-commit.sample
-rwxr-xr-x 1 gitosis gitosis  552 Sep 11  2011 post-receive.sample
lrwxrwxrwx 1 gitosis gitosis   61 Dec 21 09:53 post-update -> /usr/share/pyshared/gitosis/templates/admin/hooks/post-update
-rwxr-xr-x 1 gitosis gitosis  189 Sep 11  2011 post-update.sample
-rwxr-xr-x 1 gitosis gitosis  398 Sep 11  2011 pre-applypatch.sample
-rwxr-xr-x 1 gitosis gitosis 1578 Sep 11  2011 pre-commit.sample
-rwxr-xr-x 1 gitosis gitosis 4971 Sep 11  2011 pre-rebase.sample
-rwxr-xr-x 1 gitosis gitosis 1239 Sep 11  2011 prepare-commit-msg.sample
-rwxr-xr-x 1 gitosis gitosis 3611 Sep 11  2011 update.sample

Yeah, you’ve guessed it by now:

/usr/share/pyshared/gitosis/templates/admin/hooks/post-update

did not exist on CentOS but

/usr/lib/python2.6/site-packages/gitosis/templates/admin/hooks/post-update

did. Fixing the symbolic link fixed the problem.

/* Oh what fun it is to chase bugs into the night */

“Hack like it’s the last day of your life”

Hack like it’s the last day of your life, cuz one day it will be.”

I had a neighbor who studied Movie direction. He told me that their final project was a movie that they would have complete responsibility on it, from the script to the final cut. They were advised to work on it like it would be their last movie, even though it was their first. Their teacher wanted them to do so for two reasons: Because for most of them that would be their last movie and he wanted them to put their best. And also because if this was not their last movie, they would never know which one would be, but they still had to put their best on the current project.

My neighbor had a career in the Health sector but he was always proud of his movie, even though very few people actually saw it. He had done his best.

PS: Just like Sid (whose death prompted Wim Remes‘s tweet), my neighbor is also dead.

EuRuKo 2013 – a few days after

A bit more of a week has passed, so let’s put my notes in order before memory and other notes hide them away.

Euruko →
Euruko →

From the very beginning this seemed it was going to be a good conference. And why not since by entering the venue I bumped into a close friend from the 1990s whom I had not seen for a few years due to unusual circumstances.

The day began with Matz giving a keynote. And a keynote it was. It contained memories from his first Sharp computer to switching to Pascal and then to Lisp and explaining why Ruby was influenced by it. Sapir-Worf hypothesis was also included since Matz as a person who loves programming languages tried to make us all design our own domain specific language. He made the (to the point) remark that every program that we create is in fact its own programming language with which we communicate with the system and direct it to do anything we want within its abilities. Matz urged us to become language designers (remember that every interface to a program is a language) by starting with a limited domain, locate patterns, solve problems in this domain and then expand. Perfection is the enemy of the designer he said, so he also found room to squeeze the Pareto principle in his keynote, just to make sure that one is not lost in details instead of delivering a result.

Picking from the keynote and the Lisp legacy Pat Shaughnessy continued with functional aspects in Ruby and his adventures of learning Haskell in order to make a comparison and learn something new in the process. Best lines for the talk were that “memoization is just another name for caching” and that in Ruby lazy evaluation is in fact lazy enumeration and one has to keep this in mind.

Konstantin Tennhard continued with his work with Ruby and NLP. He covered a lot of aspects of NLP and how it is done and work he did with the help of JRuby and OpenNLP which I had not head of until then. He also described a gem he has built and gave examples of its usage. I guess NLP people will find this work interesting.

One of the best presentations I’ve ever watched that include Mathematics and Programming was done by Xavier Noria. How common is it that you get to hear about a proof that the square root of 2 is irrational, about the continuum hypothesis, about set theory and stuff like cardinality of a set in a Ruby talk? By his sharp remark that “programmers are so used to integers and floats that they forget the use of rationals” he went on and gave a real life example demonstrating this as an application for a betting site. Arbitrary precision and no cent lost. One pointer though. Next time that you have ZF in your slides at such a conference, translate it.

Arguably the best presentation of Euruko 2013 for me was the one by Grzegorz Witek and Simon Kroeger. They came with a real life example that Unicorn could not handle due to high load, need for many deployments per day and requirements for the fastest user experience, showed alternative plans (Puma, Reainbow, ZBattery, Thin) and why these were not follwoed thtough and how they reached to picking the commercial version of Passenger Phusion to do the job and how well it did it. A “We did it and this is how” talk where you can only admire someone with a working production setup that brings money home.

Chris Kelly walked us through parts of the source code (and macros needed to understand how Ruby works) for MRI and how garbage collection works in general and especially in Ruby 2.0. Frequent mentions to “Ruby under a microscope” were made.

Hey did you know that an ISO standard for Ruby exists? It is ISO/IEC 30170:2012 and it is a hybrid between 1.8.x. and 1.9.x. This I learned from Koichi Sasada who proved live that when you have something to say, not knowing English well is not a barrier because the audience is willing to hear.

Rubinius was the subject of Dirkjan Bussink. He explained the design behind it and that it is a good choice when number crunching is in order. Rubinius people aim for concurrency, multicore and optimization for the common case so that the programmer does not have to deal with much outside the environment of his program. He closed his presentation with a few programming mantras that are always worth mentioning like “Be nice; write type stable code”, “Write small and simple methods” and “Always benchmark your code”.

Benjamin Smith talked about rails engines and how locating patterns in the codebase and implementing them as engines helped refactoring the code for a client with a small team while the main team was working on the product. If you are into locating patterns (and you should be) when the video is put online you must watch this. As he put it “In the long term engines work out” as long as you avoid circular dependencies between engines. You can read a lot about this stuff at the rails Archives.

Many times I’ve said that Redis is the kind of software I wish I had written. So when Javier Ramirez talked about it I could not miss it. It was a general introduction for Redis to the audience and I think everyone left the room with a clear understanding of what it can and cannot do (including pubsub).

Unfortunately I missed Steve Klabnik‘s talk on Functional Reactive Ruby but from the sound of clapping it must have been a hit. I did not watch a few more presentations and the lightining talks due to other engagements and am waiting for the videos to upload so as to complete the experience.

All in all the experience of the conference was excellent, the Jazz concert great, the volunteers did a great job and in the chosen Eurovision style of presenting the conference: 12 points guys.

PS: For those interested, EuRuKo 2014 will be held in Kiev.

memcached.pl – An (incomplete) implementation in Perl with persistence

From the memcached FAQ:

How can you list all keys?

With memcached, you can’t list all keys. There is a debug interface, but that is not an advisable usage.

I was working on some stuff with MIMEDefang, Cache::Memcached and memcached at $work and stumbled upon just that. I wanted to check what exactly was going on while developing. About two hours after reading the informal text protocol specification for memcached, I had a crude working implementation of set and get in Perl and keys stored in a BerkeleyDB hash so that they could be inspected by external tools like makemap and postmap.

I’ve cut a lot of corners in this implementation, like:

  • the delete queues are not implemented (yet)
  • no check is done whether the inserted value is of the declared length in bytes
  • an inserted value cannot contain a \n
  • It is not demonizing yet

Give it few nights and enough interest and I think that I may fix those too. So anyway here is the project page and code:

https://github.com/a-yiorgos/memcached.pl/

I hope it is useful to at least one more person.

While writing these lines I came up with: Sysadmins do it in Perl, Devops in Python. I do not know how true people may consider this, but indeed Python would have been a much better choice. Oh well, next time.

Gambit REPL

I try Gambit Scheme almost once a year, therefore I am a casual user at best. It may be because Racket comes with a fullfilling environment and a book. But now with Gambit REPL on the iPad, this is going to be more frequent. It reminded me the days of LispMe and the Palm IIIx years ago.

Update: A few days later I wondered whether there exists a good calculator for the iPad. And then it struck me: I already had a Polish Notation one: The Gambit REPL.