Christoph’s Blog

Rants, discoveries and subtleties that my children should never learn about

Security by Obscurity isn’t necessarily bad

without comments

Time and again I find myself in a hot discussion with others who claim that security by obscurity is a bad thing. SbO means gaining safety by hiding things. Don’t get me wrong - I love open-source software and although I have never taken a look at the Linux or Firefox source code I trust it way more than Windows and the Internet Explorer (that are even less functional). But it’s with no doubt harder to find security bugs in something that you can’t look into. Playing around with different HTML pages thus finding ways to exploit the application is surely harder with the IE than by analysing Firefox’ source code. And what about your password? You are hiding your password from me. Does it make your data safe? Or the PIN code of your credit card? Or why do people run a knockd to protect access to their servers? Those are just various degrees of security gained by keeping information to yourself. I don’t think there is much difference in whether the secret is a password or some piece of code.

In my humble opinion there are hardly any cases where security is not gained by obscurity. With PGP for example. I believe in mathematical one-way functions. My passwords are way safer in a PGP-encrypted file than by putting them into a file at /usr/lib/nobodyfindsme.so.3. And even with PGP you could argue that it’s just knowledge that someone else does not have that protects your information. But my PGP passphrase is way more complicated than my usual account password. And the private key it protects is insanely large. So I consider these to be an acceptable security measure.
The discussion arised when I received complaints that the source code of the CGIs used for mentors.debian.net was not made public. When I tidied up the code and published it finally I suddenly found a secret password in the code and quickly removed it.
mentors.debian.net hasn’t been hacked in years but now that the sources are publicly available I fear for that a tiny bit. The next projects that will be made open-source will be available publicly right from the start so that people may rather help me close security bugs. It would at least make me feel better.

There is but one argument that I would agree upon: it’s silly to rely on SbO.

Written by Christoph Haas

December 2nd, 2007 at 5:05 pm

kate isn’t just a NOTEPAD.EXE for KDE

with 3 comments

I’ve been a VIM lover for at least a decade. Nothing beats it at doing complex text editing. Surely it’s not intuitive (although I frequently claim that VI stands for “very intuitive”) but no other text editor can so quickly repeat the last action or reformat a paragraph or insert text at a certain column in every line etc. I am very fast with it and happily ranted at IDEs like SPE, Eric or WingIDE for having such a bad text editor. They were more like a NOTEPAD.EXE that allowed you to navigate with the cursor keys and insert text where you are. But I have to admit that IDEs have a lot of advantages like code completion (vim doesn’t understand Python - not even with omni-completion), templates or dealing with your repository software.

I love cryptic hardcore tools because once I understand them I’m very fast in accomplishing tasks. But even after a decade of using VIM I don’t really understand its configuration or some more advanced features properly. Recently I tried to tell a Python file that I simply like the textwidth to be 100 by adding

:vim:set tw=100:

at the end of the file. No idea why that didn’t work. The command worked well when typed manually.

In addition many basic features like editing multiple files at the same time became a chaos quickly. Multiple buffers? Nah. Tabs are nice but after a certain amount of open files you have to use the arrows to find your file again. Syntax coloring is nice but customizing it is a pain. VIM is great for editing single files and I will always use it to work on DNS zone files for example. But since I develop Pylons (a Python web framework) applications I have to deal with many open files and complex Python code. I tried “pida” which is very promising but is still lacking. For example it doesn’t remember the window panes as I want to have them arranged and find myself moving around things every time I start it up.

I wouldn’t have expected to hear myself saying that vim is not good for all tasks. I had always condemned editors for not being vim and wasn’t open for all the features that I was missing out. Currently I’m trying out “kate”. I had expected it to be a stupid text editor like NOTEPAD.EXE or joe but although it looks similar it is very powerful. Some things I like about it:

  • Handles multiple open files in sessions gracefully (even shows which files have changed)
  • Shows indentation levels in source code (no more guessing where a Python function ends)
  • Text completion (no worse than what vim can do)
  • Closing brackets automatically
  • Split views
  • Syntax highlighting for all types of text files I care about
  • Proper Python indentation handling (vim doesn’t even add an indentation level after a line ending with “:” unless you use dirty tricks)
  • Code folding
  • Snippets (finally I don’t have to copy/paste templates from my knotes any more)
  • Commenting/Uncommenting of lines without :s/^/#/ magic

Kate doesn’t do all things that vim can. But the common tasks are made simpler and more comfortable. No idea if it will be my new editor. But it appears like other text editors besides vim are also worth being tried.

Written by Christoph Haas

December 2nd, 2007 at 3:47 pm

Posted in Find, Programming, Pylons

Fun with the GEZ

without comments

Rumors say that I’m a pessimist. That’s definitely not true. Surely after a hard day at work I know how to cheer me up. And of course the evilest things are the most fun. I once heard of a guy in a pub who was pretty drunk, stepped on a table, threw his backpack around and yelled “for Allah”. Uhm, yes, that was in the dark ages when everybody was on steroids about terrorists blowing up the planet. But there is a more evil thing that you can do if you are lucky to live in Germany. (And as opposed to the pub action it doesn’t even make you sleep in jail.) Germans have the GEZ (GebĂĽhreneinzugszentrale) that is responsible for collecting charges from everybody who is watching TV. Those fees are supposed to finance TV and radio stations governed by public law. They are so avid for money that their organisation works similar to a secret service. They get their information about the people from half-legal sources. They have agents everywhere trying to trick people into paying fees. And they are even a private company (even when being commissioned to collect fees by the government). Basically everybody hates the GEZ and telling others that you work for the GEZ is the shortest route to finding a fresh brick in your car’s window every morning. Funnily they have a website where you can opt in. Do I really have to mention that there is no way to opt out? And of course they don’t verify who opted in. Imagine what happens if you accidentally opt in someone else… ;)

(Don’t get me wrong. I think that the publicly-operated TV stations are worth their money when looking at all the junk that’s on TV. But the modus operandi of the GEZ is so weird that I hope the european parliament will quickly kill it.)

Written by Christoph Haas

February 20th, 2007 at 12:29 am

Posted in Rants

If only I had studied partially… err… partials

without comments

I have to admit it. Like millions of people everywhere I wasted my best years sitting in dusty lectures learning about 20 year old technology. (The technological elite of this country seriously learned from books where they talked about green CRTs and that color tubes are about to be invented… and that was in the 1990s.) The evilest lecture was called “theoretical basics of programming”. You learned about concepts that you would forget the instant that the semester ended. It was just a pretence to throw out half of the students. At least I had expected to learn something about programming. What did I learn? LISP, Assembler and Modula-2. Those languages are arguably not very useful. Okay, I understood the difference of functional and imperative programming languages. But later in my studies I found myself with no knowledge about object-oriented programming or at least C.

Last week most of my “master of computer science” arrogance suddenly dropped to zero when people in #pylons told me about “currying” and “partials”. I assumed to be an educated programmer but a dozen people flooded my IRC window with supportive comments like “that’s one of the most common paradigms besides recursion - didn’t you know that?“. Neither the Wikipedia page nor Pythons PEP309 really made sense at first. But now I understood the principle and it has already come handy…

A partial is just a function with preset parameters. Imagine that you have a function that takes a certain number of arguments. And you need to call that function time and again in your program. You may discover that one of the parameters always needs to be set to a certain default. How do you do that? Well, usually you pass that parameter along with every function call. With a partial you create a new function from the old function with certain parameters set. Say you have:

  • myfunc(foo=42, a=3, b=51, c=58)
  • myfunc(foo=42, z=12)
  • myfunc(foo=42, j=’hello world’)

You can create a new function with that foo=42 parameter already set:

  • myfunc2 = partial(myfunc, foo=42)

Now you can use that newly function and don’t have to care about foo=42 any longer:

  • myfunc2(a=3, b=51, c=58)
  • myfunc2(z=12)
  • myfunc2(j=’hello world’)

This may look ridiculous. But I already found my first use case for that. I needed to set certain arguments and then passed that newly created function around. Another part of the program would then just execute my function with the parameters I gave it
while adding further parameters.

The word partial is not very descriptive. But the word currying makes a lot more sense. You start with an empty pot on your oven and add ingredients (parameters). No idea if that’s the right metaphor but at least that tastes like I can remember that. :)

Getting back to the topic: my mentors at university tried to persuade me that studying is a good idea because you learn a lot about concepts that come handy for your job later. While I tend to believe that partially… why do I work with studied mathematicians and physicians in a network administration department? And most Ph.D.s I know at my employer create slideshows and emit buzzwords. Wasted time I tell you.

Written by Christoph Haas

February 19th, 2007 at 11:55 pm

Posted in Open-Source, Work

Joy and pain of patch panels

with 2 comments

I must admit it: when it comes to OSI layer 1 I plain suck. We built a house and the most important thing of course is making it get a proper structured cabling. (I assume that some freaks invented the cryptic number EN 50173-1 for it so they wifes don’t discover what useless thing they spend their money on.) Thanks to the generous loan of a coworker I could test my new patch panel and the sound of that centuries old device when displaying FAIL sounds like the ringtone of Marvin from the Hitchhiker’s guide. I can still hear my friend who helped me set up that cabling and milling slashes into the wall… “Don’t make the cable hanging out of the wall too long or it won’t fit in there when the wall will be concealed.” So the CAT6 cable was just 10cm short which makes it close to impossible to get that wires into a network jack in the wall. The first 8 jacks were hard… just the last one worked at once. Telegärtner are easy to get into the wall but try to get the 16 wires through the back of the jack without selling your soul. AMP jacks are hard to install into the wall (the song “if I had a hammer” came to my mind) but at least my LSA+ tool easily made it connect the wires. Just don’t make me start about the minimal bending radius. That jack hardly fits into the wall even when the CAT6 cable is creased pretty badly. I don’t know which optimist wrote that specification but if you intend to install network jacks into your house your best bet is to just use an LSA+ tool to connect the wires and use extreme force to press the jack into the wall. If your network tester tells you that you have short-circuited wires then you likely have squeezed wires into the metal casing when tightening the screws (shame on you). Otherwise if the wiremap is just b0rked then check the cabling at your patch panel. Connecting those 9 jacks made me have nightmares about that. Now that everything works I think I’ll try to never touch OSI layer 1 again.

Written by Christoph Haas

February 19th, 2007 at 11:31 pm

Posted in House