Skip to content

Secure programming

28-Mar-07

Programming is a complex task, and it’s even more complex when you add security to the equation, there are lots of manuals on the Internet, and books on amazon that deal with secure programming, mostly they either geared to web developers or C programmers. What has prompted me to write this is the fact that I’ve been tasked with working on a application that will be used to performance test a system, now this little tool needs to simulate 1,000,000 transactions, everything is OK until I see the code.

The first thing out of my mouth was WTF! I’m not very good at this programming stuff I’ll admit it up front, but what I saw was disturbing. I can not show you the code, because well I’m bound by NDA’s. Nn a few hours of reading I found out the following:

  • Authentication routine is completely and utterly useless.
  • There are several exploitable buffer overflow.
  • Memory leaks, that make Niagara falls look like a dry pond.
  • String format vulnerabilities.
  • Among many others.

In short this a good example of how not to code! All the above issues could have been solved with simple common sense tips:

  • In a routine, always check that the parameters passed, are what you are expecting, do this before anything else. Most Java programmers that I know suffer from this.
  • Make sure that the buffer being passed to your method is of the correct/expected size before doing a strcpy() or strncpy(). Here is a little well known fact, strncpy() is safer than strcpy(), but it’s not safe from misuse, so double check the size/length of the destination where strings are being copied, specially if they’re passed as a parameter to a method, typo’s, miscalculation can make your code vulnerable to a buffer overflow, or in a better case corrupt your stack.
  • Don’t malloc a static variable inside a method, that is going to return said variable, just don’t! ….. alright I’ll explain the reason is very simple, you cannot free the variable, because you need to return it, so the caller of the method needs to take that responsibility, in some cases it might be the only way to go, and you document it, so you don’t forget to free() it, but if it’s not imperative don’t do it!
  • Do not down cast, casting a long to a short might seem exciting, but there are some things that you shouldn’t want to do, or find out why you shouldn’t do it. If you know what you are doing, then you do not need to downcast, if you don’t know what you are doing then I suggest: You walk away from your keyboard slowly.
  • For the love of God, I know you are smarter than me, I admit it, but please, please, just because you got an A on your algorithm class, does not mean you can take a MD5 Hash, slice it in sequence of 8 bits, compress it to a 8 char string using a pad, and expect it to be secure. If you are spending the CPU cycles generating the MD5 hash for pits sake, use the damn hash!!! While established you are smarter than me, chances are you are not smarter than Bruce Schneider or Donald Knuth. Slicing a hash using the above method as a password encryption mechanism, is a open invitation for deep anal probing by the l33t in this internet world. If you don’t know why it is insecure, think about it for a bit, you’ll get it, believe me If I found it you’ll understand it.

There is another trend that annoys me greatly, it has nothing to do with security, it’s just most programmers, do not put their name and date on the code they’ve just written. I can forgive not putting your name specially if you are not proud of the code, or if it’s company policy, but the date of creation and date of modification? It is quite useful specially when you have to track down a change.

It’s been a while since I blogged, but hey I’m sure I was not missed.

Filed in programming, technology | | Comments (3) »

Metaprogramming (The one true editor?)

03-Feb-07

Metaprogramming, is in some circles a lost art. When I started programming one of the first thing I was asked to do, was to make a program, that would modify it’s own code base dynamically, depending on a set of rules (the rules could change over time, and the program should be smart enough to conform) I don’t have to tell you this was a very hard problem, so my boss gave me the first major advice I have ever received: “Use the right tool for the problem”, at that time the right tool was Lisp –not because it’s the best language, but because it had the resources needed to solve the problem in a fast and painless fashion.

Forward to 2007, and very few software engineers, have written metaprograms, and even less know about metaprogramming. The truth is that most of the code I write for work “Simulators” have the ability to modify thy self, on command. Why in the world you ask? Simply because we have a very stupid chain of command, and usually what they say they want, it’s not what they really want, so given, that I am a lazy bastard, I use metaprogramming to my advantage.

Now, I can’t tell you how many times, I’ve seen some of my co-workers, curse our (bosses|users|clients), when they realize, they just wrote x lines of code that it’s not needed, and they have to write (* x x) in minutes. I feel for them, I really do.

What does all this have to do with editors? Well one of the main tools of a programmer (the main tool actually) is it’s editor. Today we have editors or IDE’s that specialize in certain languages, or technologies related to a language, and you see how some developers jump from one to the other clumsily, this reminds me of something my dad always told me when I was growing up (and religiously tell his grandchildren still) “Johannes factotum” That translates to “John does all”, or more colloquially “Jack of all trades, master of none, though ofttimes better than master of one”, another of his favorite quotes is “A chisel and hammer in the wrong hands, destroys in the right hands with get David“.

It does not matter what your tools are, if you can solve the problems at hand with them. In my particular case my programming editor, because of today’s demands needs to be a “Johannes factotum”.

I’m not saying specialised IDE’s are bad, I for example think eclipse is a very good IDE, and they are working to become a “Johannes factotum” tool. In my opinion a good editor or IDE should be able too:

  • Metaprogramming friendly, meaning you can change or add features or trigger certain logic, in a programmatic form.
  • Source code management tools, to make your life easier.
  • Addition of new language syntax, should be easy to add or modify (by & for) the user specific need.
  • Re-factoring easy and painless
  • provide the ability be it programmatic or by built in feature of code snippets, and templates.
  • Do not get in the way of writing code.

If you look closely an editor that posses a powerful configuration language you can do all of the above, even if it’s not a default feature on the editor, making it extensible by you. There are other features that are important to most users, I find them distracting, some are built in, into my editor of choice, others can be added with a few lines of elisp code, some of those features are:

  • Code completion.
  • Error detection.
  • Automatic syntax correction, or the code clippy as I call it.
  • Wizards

You might be thinking, you are contradicting yourself, you said: “use the right tool for the right job” how can one editor be the right tool for all languages or jobs? Well one editor can be the right tool, if it’s flexible enough, that you can add the features necessary for the work at hand. I prefer one editor, because It let’s me concentrate on the problem at hand, I don’t have to be going back to the help menu, to find out how to activate this or that, or have to learn different key schemes, I make my own, that are comfortable to my hand and easy for my brain to remember.

I’m not saying: “X” is better than “Y” that’s for each individual to decide on their own, my goal here is to make you think a little about your choice, and why it is your choice.

Is it because everyone is using it? or maybe because it looks cool? or maybe it’s the standard in your work place? or I don’t care about extensibility I am an X programmer and I want an X editor? or maybe I prefer to use specialized editors for the language?

If you feel comfortable and productive using the tools you are using, that’s good, but if you find a tool that makes you more productive, and comfortable, don’t set it aside just because everyone uses “X” and you will be mocked if you use “Y”.

I’m mocked mostly every day for my choice, and frankly I don’t care, It helps me get the job done, and that’s because it does not get in my way.

This not meant to bring a flame war, this is not a “Y” is better than “X” post, it’s about I like “Y” because of this and that. Don’t tell me what you don’t like or what you don’t use or why you don’t use it.

That said. What are your tools of choice and why? Do you metaprogram?

Filed in programming | | Comments (2) »

Prototyping

17-Jan-07

Prototyping is not a new concept, nor the sole domain of computer science; it’s one that’s been used outside the computing field, even before computers ever existed. It is a try and tested way of working, that concentrate on moving forward, with the premise, that the result, will be revised and even re-written if deemed necessary.

Prototyping, let’s the programmer find and solve problems, that were not factored into the implementation of the application, it is mostly done using tools that are not as time consuming, as the target tool to be used,.

In music, composers usually make a orchestra sketch with the lines that each instrument part, they do this because it is easier to work with than an orchestral score, and because it affords the composer flexibility to play around with different instrumental combination. When they are happy with the sketch, they will then start working on revision, and yet again everything might change, until he’s satisfied with the outcome.

In computing, we don’t tend to prototype as much, there are others but I leave you to add them and comment on them, but we usually take one of two roads:

  1. We do a formal design, and implement it.
  2. We hack until we get what we want.

This options are not good or bad, it all depend on what we are doing; but those two are potentially inefficient.

With the first option, you might find yourself in the middle of your implementation, and realizing there is a fundamental mistake on the design, that makes everything you’ve done until now useless trash.

With the second option you might find yourself hacking away and loosing sight of the main goals, and the outcome is no where near, what you intended to achieve.

With prototyping, we can actually find the problem in the first item, sooner, giving us time to either re-design or work around the problem, adding new features we overlooked, etc. With prototyping we avoid the problem in the second item because we are working towards a goal, with the aid of a sketch design, our goal is to make our prototype be a functional representation of what are design, or goal is, while at the same time confirming it’s viability.

Prototyping is a good proposition, given that you have enough time to do the prototype –you need to factor this in, when setting deadlines. It is also important to have a good grasp of the tools you are going to use to build the prototype, because the goal is to build it fast and as bug free as possible.

In my experience the best languages for prototyping are scripting languages. It does not matter what language you use, as long as you have a good grasp, this bear repeating, don’t do a prototype in a language you are just learning, do it with the tools you already know and comfortable with. There is nothing wrong in prototyping in a non-scripting language, as long as you can do it fast, and you know your way around it.

So to conclude, the benefits of prototyping a problem are:

  • A better outlook of the problems and their solutions.
  • You get to test the design, in a fast non-obtrusive way.
  • Helps in bringing the number of bugs down.
  • Helps making the code writing faster.
  • Gives you a demo to show the client.
  • Helps you see the big picture.

For a better more detailed explanation check out: Pragmatic Programming site.

Filed in programming | | Comments Off

Martin Luther King Jr. Day

15-Jan-07

Today, were released by Stanford University’s King Paper Project, a collection of writings that documents Rev. King thoughts from 1948 to 1963.

Martin Luther King Jr. was a very important figure for me. At high school I read some of his sermons, and was introduced to a sane, coherent interpretation and implementation of Christian thought and life.

Rev. King, is an example for all Christians to follow, not being a conformist christian, defending those too weak to defend themselves, all while dealing with violent opposition, and never surrendering to fear, or threats.

Christianity, has broad history, some of which is rather grim. Rev. King was a ray of light amidst a very dark world, a man who stood up, not in arms, but in peace.

The following quote is an extract of the published text.

“Any religion that professes to be concerned about the souls of men and not concerned about the city government that damns the soul, the economic conditions that corrupt the soul, the slum conditions, the social evils that cripple the soul, is a dry, dead, do-nothing religion in need of new blood,” King preached in 1962 to his congregation at Ebenezer Baptist Church in Atlanta.

It is my hope that his message of peace, and social justice, one day become a reality.

Filed in books, thoughts | | Comments Off

To Gmail or not to Gmail, that is the question

15-Jan-07

I have a mostly hate relationship with gmail, the only things I love –like is the more accurate term– is the storage, and the free pop3, that’s it. I know, gmail is the best web email client around right now, I know they have done much better than their competition, but they are not better than an email desktop client.

In my case my email client is mutt, I’ve been using it for so long I don’t remember. I pair it with procmail, I’m in email heaven.

So why do I use gmail? The answer is simple and yet complex; where I live the bandwidth is very limited, and expensive. There is an issue with blackouts, yes we get a couple of hours of blackouts daily, so I can’t host my own blog, and email, even though I own a more than capable server. So, in my case there is no way around it, I use gmail pop3 service, and very rarely do I login to the website.

I hear you saying, no, gmail is more than that, you get the ability to search your emails by different search criterias, and you have labels, that are so much better to the stupid mail folders, and filter rules. I can search for email in mutt, just as you do it in gmail, even better, I can implement my own search application and call it from within mutt, and I like having mail folders. I do think labels are a very good idea, and make navigating and handling email easier in gmail, but I don’t miss them at all when using mutt.

So, you are a google hater then? Nope. I’m not a google hater, in fact, I quite like google reader, I use it a lot, go figure. I also like google groups, and google search of course. I do think google is, a dangerous proposition when it comes to privacy (yes, I’m paranoid). I don’t care much for the archiving they do of my emails, but right now it’s a trade off I have to live with.

So there, that’s why I’m not a “gmail is the gratest thing since slice bread” proponent, and see google as whole, with mild trepidation.

Filed in technology | | Comments (17) »

Users vs. Developers (Users are Stupid)

14-Jan-07

I can’t tell you how many times, I’ve heard a developer, shout those words; with a additional words for color and effect. I admit, I’ve had my share of user issues, and to be perfectly honest, most of the times, it was not because they were stupid, in fact it’s the complete opposite. The problem and I believe most of us in the software field share this problem, is, requirements, users can talk about features, they can talk about cool ideas, but most, can’t tell you in a coherent fashion, what they need.

The approach I have used in the last couple of years, have been to go over the tasks that users do in a daily basis, I try to understand fully, before moving on to the features that are not part of the day to day routine, but that are sporadically used. It is only after the above requirement is met, that I discuss enhancements, and cool features, etc. It’s important to spend time with them during their work day, taking notes of what they do, and how they do it, and try to find ways of making them more efficient without sacrificing ease of use.

It is imperative for us to understand, that software, is a tool. It might be a work of art for us, but for the users it’s a tool, that exists for a purpose. If a tool doesn’t do what the user needs, then there is no two ways about it, it’s bad, and they will move along. I for one have done this numerous time, in my computing life. I have gone through, some very cool editors, ide’s, you name it I’ve probably tried it. All of those tools had strengths, but for my need, they either were overkill, or just to bloated and slow.

If we, that are knowledgeable, go through this ordeal to find a tool that meet our needs; how can we be so deluded to think our software, is the panacea our users have been craving?

Talk to your users, put yourself in their shoes, learn their business model, ask them what their vision for the future is, plan for scalability. Don’t try to make the application they will be using in 2 years, make the application they need, to do their work now. This is a sound business model for the developer, if you did your job well, come 2 years they will be ready for your uber cool enhancements, and guess what, you will be ready to implement them in efficient and correct manner.

There are your PEBKAC cases, still you should never call them stupid, you need them, as much as they need you, in fact you need them more. Imagine a world, where everyone could develop their own applications, fix their own computer issues; that is a world where you, flip burgers for a living.

Filed in programming, technology | | Comments (2) »

Free Solaris 10 DVD’s for x86 and SPARC

14-Jan-07

Sun is giving away Solaris 10 and Sun Studio DVD’s for a limited time only.

If you ever wanted to try out Solaris, or use their development tools, sign up, and start coding. I hope this is not the last we see this type of initiative from Sun, as it’s good in all fronts; marketing, publicity, and it’s an unobtrusive way for potential users to try the tools.

Filed in technology | | Comments Off

Faith

14-Jan-07

Faith, it’s not dependent, or limited to religion.

It is a complete and free entity, capable of being exercised with out the need of religion, or facts.

When we talk about faith,‭ ‬be it conscious or not,‭ the word‬:‭ “‬religion‭” creeps in;‬ ‭religion, is a human endeavour, and to some, is the basis of faith.

I believe, that faith is a vital part of human nature, it is tightly coupled with our being, however, it is not our creation, it’s a quality that we all posses.

Faith, is one of the cornerstones of humanity, it is an essential part of free will; without faith the human life, is void of hope and meaning.

There is often confusion between faith and hope; to some the difference are very clear and distinct, to others it’s just a blur. I think faith and hope, are related; related because hope is a emotional state that feeds on faith.

Religion, with out faith, is myth. History, has shown us, how people have migrated from one belief system to another. How complete religious foundations have disappear, and in all cases, people stopped believing in one thing, to believe in the other.

Faith, is “Believing”; believing in someone –yourself perhaps–; in something –a object that brings you luck. It matters little if you believe in: God, science, fairy’s or what not. What matters, is that, one way or the other you “believe”.

Filed in rambling thoughts | | Comments (1) »

Still alive; keep alive

14-Jan-07

Been a while since my last post. I’ve been quite busy, reading a lot, having interesting “philosophical quasi-scientific” discussions with a few very smart friends. I don’t know how they put up with a silly a person as me.

I’ve been reading a few books, of which I hope to post my review in a few days. My to read queue is getting larger every day; I really should stop adding more books to it, but what the heck life is short, and there a few things better than reading a well written book –well maybe writing one.

I’m planing on writing a few think pieces. As usual I know nothing about nothing, so don’t be surprised, if or when, I end up with my foot in my mouth. I’m working on the first piece, the idea is to create a discussion, not necessarily a scholastic discussion, so it’s of no relevance to me what your qualifications are, I know mine leave a lot to be desired, so hopefully everyone who feels the need to speak up will do so.

Filed in personal | | Comments (1) »

The Last Question

28-Dec-06

It was some years ago that I read “The Last Question” By Isaac Asimov. I didn’t fully understand it, I spent quite a while with a dictionary. I remember spending the rest
of the day thinking about it too.

Today I stumbled upon it in the intraweb, and after reading it, I realized how this work has influenced me. I had no idea. I also remember it was the cause of me visiting the principal office for the first time –not the last– I refused to read “Hong Kong Phooey” on the grounds it was silly kids stuff.

In case you have not read it, –and didn’t notice the link above– here is the link to the story, enjoy, “The Last Question” By Isaac Asimov.

Filed in sci-fi | | Comments (1) »