security in obscurity

It didn’t make all that much sense to me. Why did the team write their own bug tracking application when they could have either purchased one or used an open source solution.  I guess the team felt that only they were creative enough to create a good bug tracking application.

Not created here

I never really liked the application, not because it had a tendency to slow down the process but actually because of the poor usability of the application. I am not certain where all of the textual comments were stored but the developers simply stored all attachments as files on a samba file system that was also shared. Just to keep up security or secrecy all of the files had the attribute of hidden and and read only.

I knew how the attachments were saved as did my IT colleagues also knew how the files were saved. If you wanted to retrieve the attachments it was actually more convenient to access the files directly.

During the beginning of the project there was a lot of external consultants and a number of there were also aware of this little back door.

No good deed goes unpunished

Once the project was finished everybody left but a few years later a few of them came back including John who is now an auditor. I was speaking with my colleague Kenny when I found out that John had been in touch and was asking about how we used to access these files. Kenny is a nice guy and reminded John exactly where the files were located. Kenny being an inquisitive guy asked why exactly did John need this information. The answer was too cute.

I am writing a report about weaknesses of the systems here

This is a weakness that none of the average user would ever have been able to find or to utilize. I put this story out of my memory because up until very recently Windows Explorer would display which files existed even the hidden ones. A few key presses and you could even search for the hidden attachments.

This was a nice little backdoor but you can always use the application right? Nope, some big brain wrote the application front end using MS Access about a decade ago and for some reason they couldn’t get it to work using Access 2013. I am in another group so it isn’t clear what my old group is now doing but they are still creating these hidden files.

I needed a file and could not use the application nor windows explorer.

Security in obscurity

The problem is that Windows itself is plenty willing to tell you which files exist if you ask correctly.

The simple command prompt, cmd.exe, will blab either overtly or covertly what it finds.

Name Description
dir This will do the directory listing of the normal files but when you give the /ah parameter will will display the files with the hidden attribute.
attrib I believe that this program has its roots in the DOS operating system that windows was built on top of.  This command will show all the files in the current directory and what attributes are set (archived, read only, system or hidden)

These are actually pretty direct but I was surprised that simply pressing the tab key in my command would display each file in the directory including those that were hidden.

 

I supposed that you could simply use the dir command to display all files that were hidden but it is possible to make our own command to display all the files regardless of their hidden status.  this is done using a few lines of powershell script.

All you need to do is to have the following line as a power shell script.

myfind.ps1
Get-ChildItem . -recurse -force

This will display all files in the current directory as well as all files in any subdirectories.  This is a neat little trick considering the files must be hidden for a particular reason but it is very easy to find the files anyway.

powershell -file myfind.ps1

Showing everything was actually the entire purpose of this script but it is also possible to filter this list of files down to only the hidden files.

myfind2.ps1
Get-ChildItem . -recurse -force  | where-object  {$_.mode -match "h" }

This script actually will find the hidden files that are in the current working directory as well as in any subdirectories.  This isn’t so helpful as it only lists those files but it is possible to take this to the next step and copy those files elsewhere.

myfind3.ps1
get-ChildItem c:\mysourcedir -filter *.*  -force | where {($_.extension -eq ".txt" -or $_.extension -eq ".text")} | Where-Object {$_.mode -match "h"} | copy-item -destination c:\mydestinationdir 

The only problem for this tiny script is that the files are copied but they retain their hidden attribute.  I am fairly certain that you can remove this attribute with some more clever powershell code but I couldn’t find it.

In the end I reached out to DOS history to clear this hidden attribute.  The good news is that powershell scripts can call other programs in addition to these cmdlets.  My final script copied these files and then used the DOS command “attrib” to do the clear.

myfind4.ps1
get-ChildItem c:\mysourcedir -filter *.*  -force | where {($_.extension -eq ".txt" -or $_.extension -eq ".text")} | Where-Object {$_.mode -match "h"} | copy-item -destination c:\mydestinationdir 
attrib -h c:\mydestinationdir\*.*

 

Not so secret after all

I actually realized that part of the reason I cannot see these hidden files in the windows explorer is because I have a new computer and have forgotten to change my computer settings to display hidden files.

https://www.lifewire.com/how-to-show-hide-hidden-files-and-folders-in-windows-2626085

With these changes back in place you can even search for files hidden or not using the windows explorer tool.

All of this points to the fact that you cannot use windows hidden files as any real security measure and security in obscurity may work for a while but eventually someone with time on their hands will find all your hidden gems.

Posted in security | Tagged , | Comments Off on security in obscurity

Reuse a Pi – Air printing

When the Raspberry Pi came out I went a but nuts and ended up getting a few of them.  I did give some away and did create some projects but unfortunately not all of my RasPi devices were a complete hit with the family.

Eventually they got unplugged and ended up in a small box, and yesterday that small box fell over.  I don’t have enough people interested in ancient Rasberry Pi computers – they are simple model A and B pi’s.

The raspberry pi has been out long enough that there should be a few new projects that these devices could be put into. The first project seemed to be a no-brainer.  My wife wanted to print to the printer from her iPad but was unable to.  It is possible to make this happen by using the common UNIX printing system or CUPS allows a server to act as a print server.

CUPS uses the internet printing protocol (IPP) for managing print jobs and printer queues.  Despite the how obvious this solution seems it was actually created in 1997.

Step 1 – Install operating system

The only thing that was not immediately clear was if he old pi’s needed an old raspbian distribution or if a new distribution image could be used.

There are two different ways to determine this.  The first is to download the latest distribution and give it a try.  However, apparently my SD cards have a “use by date”.  I suspect that this is the casee as my old sdcard worked for a short time and then had some odd behaviors.

Everything did work just fine on a new SD card.  This information is also available from the Raspberry Pi forums as well.

The process of actually installing the operating system to a SD card is pretty well defined.  This is especially true for raspberry pi organization.  For more information on installing the operating system check out their guide.

I used the most current Raspbian that was available from April 10th 2017.

Step 2 – Install and configure Cups

Note: It would be a good idea to ensure that your printer is supported before trying to setup this solution.  In my case, the color laserjet CM1312nfi MFP was not in the list.  I did feel lucky with this printer as I have installed cups before on LinuxMint and I did not have any problems.

Always a good idea to ensure that your repository is up to date before starting.

sudo apt-get update
sudo apt-get upgrade

Install the cups software

sudo apt-get install cups

Configure cups

The first command is to add the pi user to the printing group (lpadmin) so we do not need to use sudo.  The next command is to make cups available to the other computers on our network.

sudo usermod -a -G lpadmin pi
sudo cupsctl --remote-any
sudo /etc/init.d/cups restart

Once we do these commands we must restart the service so the changes to the configuration file are used.

Note: The cupsctl command simply modifies the /etc/cups/cupsd.conf configuration file. The changes are actually quite small, but just to make sure nothing is lost I would recommend that you use the cupsctl command.  The changes are highlighted at the end of this post.

Test Cups installation

This is just a matter of pointing your browser to the Raspberry pi that has cups installed.  Specifically both the machine and port.  When you do that, you should see a screen that looks similar to the following.

Setup a CUPS printer

The entire process from this point is really quite easy. Simply click on the link for Adding Printers and Classes.

At the beginning I checked to see if my printer was supported (https://www.openprinting.org/printers) and my exact printer was not in the list. However, I have had a lot of luck with HP printers so I went ahead anyway.

I tried the “Find New Printers” option but it did not find my network printer so I simply tried to add a new printer.  CUPS did manage to see more printer information relevant to my printer.

Step 1

 

          

Step 2                                                                                        Step 3

 

 Step 4

Step 5

In step 3, as my exact printer model was not in the list I selected “HP Color LaserJet Series PCL 6 CUPS(en)” as my model and continued.  The printer appears to have been installed for CUPS.

In order to give this better test, select “Print Test Page” from the Maintenance drop down to generate a test page.

 

Step 3 – Using the newly setup printer

Well, there is really not much to say here.  In my experiment after setting everything up printing was super easy.  I just picked up the tablet and from an application, safari in my case, I pressed the print symbol and saw that my printer was an available option.

 

Printing from Apple Phone, IPad or IPad Touch
https://support.apple.com/en-au/HT201387

When reading up on this there were a couple of things that other people said might be necessary.  In order to publish the printer name I might need to install avahi.

sudo apt-get install avahi-daemon

I did not have to install avahi in my case.

It was also mentioned that after setting everything up you might need to wait about 5 minutes for the printer name to be disseminated across the network. I suppose I did wait for a while but I cannot say how long.

Also, apple does provide pretty good possibilities for windows computers as well.  The protocol that they use to disseminate the printer information is bonjour.  They even make available a client for your windows program so you can take advantage of this as well.

https://support.apple.com/kb/DL999?locale=en_US

 

Original cupsd.conf

#
# Sample configuration file for the CUPS scheduler. See "man cupsd.conf" for a
# complete description of this file.
#

# Log general information in error_log - change "warn" to "debug"
# for troubleshooting...
LogLevel warn

# Deactivate CUPS' internal logrotating, as we provide a better one, especially
# LogLevel debug2 gets usable now
MaxLogSize 0

# Only listen for connections from the local machine.
Listen localhost:631
Listen /var/run/cups/cups.sock

# Show shared printers on the local network.
Browsing On
BrowseLocalProtocols dnssd

# Default authentication type, when authentication is required...
DefaultAuthType Basic

# Web interface setting...
WebInterface Yes

# Restrict access to the server...
<Location />
 Order allow,deny
</Location>

# Restrict access to the admin pages...
<Location /admin>
 Order allow,deny
</Location>

# Restrict access to configuration files...
<Location /admin/conf>
 AuthType Default
 Require user @SYSTEM
 Order allow,deny
</Location>

... rest of file follows ...

Changed cupds.conf 

LogLevel warn
MaxLogSize 0
# Allow remote access
Port 631
Listen /var/run/cups/cups.sock
Browsing On
BrowseLocalProtocols dnssd
DefaultAuthType Basic
WebInterface Yes
<Location />
 # Allow remote access...
 Order allow,deny
 Allow all
</Location>
<Location /admin>
</Location>
<Location /admin/conf>
 AuthType Default
 Require user @SYSTEM
</Location>

... rest of file follows ...
Posted in programming | Comments Off on Reuse a Pi – Air printing

safe computing – weak case for weakening encryption

You cannot strengthen the weak by weakening the strong.

William J. H. Boetcker

This quote has been often misattributed to Abraham Lincoln.  This is actually a very relevant thought with the respect to economics.  Indeed you cannot improve everybody’s lot in life by taking from the economically strong no matter how well intentioned your goals are.

I think that this particular quote is even more meaningful with respect to improving privacy and encryption.

Some of the forward thinking political types think that in the very near future all communications will be using encryption.  They also believe that this will destroy the ability of governments to gather intelligence of evil doings.  The “Five Eyes” are at the minimum hoping that silicon valley can find a way that will support the interests of privacy and security.

The desire of these countries sounds very positive but to some ears that sounds like creating a solution that will allows the “protectors” to read encrypted solutions in situations when it is “important”.  This last sentence when properly parsed will actually mean that some backdoor will exist to allow the governments of the world (and any really clever hackers) access to your communications.

That wouldn’t be so bad except the history of man is full of situations where people abuse their positions of power.  Who wants to send out private communications knowing that some government wonk, perhaps your ex-husband, could access your messages with the universal iPhone decryption key.

That would be worrying enough but the world is filled with malicious players.  People interested in looking at more than little text messages you sent to someone special.  They would be taking advantage of weaker communication standards to eavesdrop on our financial transactions.

Weak encryption solves problems. Right?

Every time I read about governments wanting weaker encryption I think back to a specific Dilbert cartoon.  The pointy haired boss is explaining about earnings reports and how they need to be smooth for lazy analysts – the same is true for encryption.  No encryption or easily breakable encryption makes it a lot easier for security agencies to examine messages.  Yet does this really catch more plots?

Weaker standard encryption doesn’t mean that attacks will then be caught before they take place.  People can only be caught doing bad things if they are in constant communication about their plans, someone is listening in and important details are being shared.  Wouldn’t this have helped for some of the terrible incidents that have occurred in the past such as 9/11, London bombings, or Madrid bombings?

Having no encryption at all might not have made any difference at all, assuming that any encryption was used for those incidents.  In the spy novels, action adventure books and other thrillers the bad guys don’t coordinate these things long distance.  Sure, the big boss might know that a special unit has a given mission at a certain location but that is usually it. There is no communication.

Terrorist groups, well the really successful ones, appear to plan an attack and then let that unit deal with the details of the attack.  They don’t appear to be remotely controlled by their organizers.

Recent digital access is an anomaly

It is only the last twenty or so years that the masses have been sending emails and cat pictures through the ether to a recipient.

In the distant past it was possible to listen in on the telegraphs that were being transmitted.  In the recent past it was possible to have phone conversations, and it was also possible that they could also be listened in on.  However, for most of the last 100 years it has not been possible to have a permanent exact replica of every message sent or received so that they can be replayed and stored for future use.

This relatively recent access has been most undoubtedly incredibly helpful for the security services and it is understandable why they are addicted but this is not the normal state over the last century.  The ability to retroactively look through a previously encrypted phone is probably more desirable for prosecution in a case after the fact to help prove intent.

Even if all phones were unencrypted, the issue of bad people using prepaid phones would make the argument moot.  Clever criminals and terrorists would use these phones for very small transmissions of reasonably innocuous messages.

A case of Hubris

It is pure hubris to believe that only the existing security services of the large countries are capable of creating a method or cipher that cannot be broken.

Do the security services really believe that if they weaken the encryption solutions that they are the only ones who can come up secure solution?  Of course not every code slinger can create a flawlessly secure solution but there a lot of different types of other known solutions that can easily be used.

substitution cipher

public key cryptography

one time pad

Steganography

It would obviously be much easier for less talented criminals or terrorists if their Apple phone or Android phone had built in end to end encryption but any of these other methods could be used to keep secrets.

These methods are all known by the authorities so they would only keep secrets for a certain period of time but depending on the situation the secrets might only need to be kept long enough to do bad things.

Cryptography is not a secret

The internet is full of information about encryption but it isn’t even necessary to go to those lengths.  You can purchase books from Amazon about encryption.  I started to count the but there were so many books to choose from.  They all looked pretty good to me.

Besides, people are creative when trying to find a method of keeping secrets.  Good methods can be developed by prisoners much to the chagrin of their keepers.

 

Oh, here is the original quote in context.

You cannot bring about prosperity by discouraging thrift. You cannot help small men by tearing down big men. You cannot strengthen the weak by weakening the strong. You cannot lift the wage-earner by pulling down the wage-payer. You cannot help the poor man by destroying the rich. You cannot keep out of trouble by spending

William J. H. Boetcker

 

Posted in Soapbox | Tagged , , | Comments Off on safe computing – weak case for weakening encryption

just making it – revisiting my cube

Some time back, I had a fair amount lot of free time.  I spent the time working with a friend Mikhail in the evenings to create my own LED cube from scratch.  It was actually quite a bit of fun, the electronics was not overly complicated with most of it being done by a Raspberry Pi. It was fun to see both the hardware and the software side by side.

raspberry pi powered cube

The problem with that particular cube was using the Raspberry pi.  The Raspberry pi is a great platform but it is a computer and it needs time to start up the operating system and more importantly it needs to be shutdown in an organized manner.

The Raspberry pi is an awesome little computer but the startup and shutdown times are my main problem.  I only have a few hundred lines of code that needs to be run so I don’t need a four core 1.2 gHz computer, only need a few megaherz.

Arduino to the rescue

The first release of the Raspberry pi was in 2008 at 900 mHz for 35 dollars was truly amazing but it wasn’t the first of this type of hardware for do-it-yourself electronic projects.

I actually was never involved in the DIY electronics when the Arduino came out but I think that the Arduino was pretty much the pioneer of this space.  The Arduino was not only hardware but it was open source hardware.  The fact that it was open source helped it to expand and multiply into the number of models that we see today.  Well, being open sourced helped but also due to the release of ever increasing sophisticated processors from ATMEL which powered these Arduinos.

Today it is possible to get what is essentially little computer that is not much larger than a couple of postage stamps.

This “advanced” processor is running 20 MHz and contains 32 KB of program memory. Not quite the latest gaming personal computer but it is similar to the original Apple ][ personal computer, but it is more than enough to pass the commands to the cube to switch leds on and off using the I2C protocol.

New Hardware

The Raspberry Pi supports I2C but the Atmega328 does as well.  The I2C protocol is just a matter of two lines – a data line and a clock line.  As far as the hardware was concerned, all I needed to do was to connect the data, clock, power and ground to the Arduino atmega328.

On the software side, I was pleasantly surprised at actually how easy it was using the Arduino libraries to do I2C and to convert my code over.

Sure, I did have to make a number of small changes but the process was pretty painless.  Replace my printf statements with Serial.println statements but the main changes were connected with the I2C protocol.

The libraries to do this were part of the standard development environment.  The class that you need to use is the Wire class.

Old Code

   bcm2835_i2c_setSlaveAddress(cathode);
   char cmd2[] = { IODIRA, 0x00, 0x00 };
   check_retcode(bcm2835_i2c_write(cmd2,sizeof(cmd2)));

New code

   char cmd2[] = { IODIRA, 0x00, 0x00 };
   pi_i2c_write_command(cathode, cmd2, sizeof(cmd2));

The pi_i2c_write_command is my own method but it simply does call the three methods (beginTransmission, write, endTransMision) that are required in order to send an I2C command.  Only five lines of the twenty six are required, the rest were used for monitoring the program while it was being ported.

void pi_i2c_write_command(int device_address, char cmd[], char len)
{
  int idx = 0;
  if (debug != 0)
  {
    Serial.println("begin pi_i2c_write_command\n");
    Serial.print("address ");
    Serial.println(device_address, HEX);
    Serial.print("arguments ");
    Serial.println(len, DEC);
    for (idx = 0; idx &amp;lt; len; idx++)
    {
      Serial.print(cmd[idx], DEC);
      Serial.print(" ");
    }
    Serial.println("\n");
  }

  Wire.beginTransmission(device_address);
  for (idx = 0; idx &amp;lt; len; idx++)
    Wire.write(cmd[idx]);
  Wire.endTransmission();

  if (debug != 0)
    Serial.println("end pi_i2c_write_command\n");
}

arduino powered cube

 The Problems

I did have one small problem while porting my software that was really an oversight. Before you try and transmit any data via the I2C bus you need to initialize it first with the a call to “begin”.

Wire.begin();

If you don’t make this call, none of the subsequent calls do anything.  In my haste, I did have this line but it was in the wrong spot in my initialization code.

My code does have comments but it has been a while since I was using the 23017 16 bit I/O expander.  So I did have a few questions how it worked exactly.

While doing my debugging I did read up more about the chip and I do have a few clarifications that describe the code’s behavior.

register Description
IOCON This register is used to set various configuration options on the chip. The two most interesting as far as this program goes is the BANK (bit 7) and the SEQOP option (bit 5).

The BANK bit changes the addresses of the various registers.  When BANK=1 then the address for IODIRB is 0x01 but when the BANK=0 then the address for IODIRB is 0x10.

The order of the registers is more interesting in conjunction with the SEQOP register.  The SEQOP=1 allows the chip to write multiple bytes sequentially.  When the BANK=0 then the register pairs are next to each other.

IODIRA

IODIRB

These registers are used to set the direction of the I/O. The IODIRA register controls the direction for first 8bit port (PORTA) and the IODIRB register controls the direction forthe second 8bit pot (PORTB).
OLATA

OLATB

These registers are used to set or clear the latches for the two ports.

The other important detail is that the current flows to the various LED’s (via the I/O expander) when the anode (layer) is set to on and the cathode (column) is set to off.  This sounds exactly what you would expect for lighting up a LED, power goes to anode and ground goes to cathode.

Posted in programming | Comments Off on just making it – revisiting my cube

interrogating your code – dipping your toes into java’s reflection

Perhaps the coolest programming language ability that I was never allowed to use was reflection in Java. Why? Well, thats another story.

What exactly is reflection? Well, reflection is a set of low level methods that can be used to inspect code while the program that is doing the inspecting is running.

This puts the program in a very unique situation where it can interrogate objects that it is working with. Thus the program can then make decisions based on what information it finds on the class that it is inspecting.

This makes it possible to inspect an object to see if it contains a certain method. This allows your program to make the decision which method to use if multiple valid methods exist. One, perhaps somewhat contrived, example of this would be that your program could check and see if the new 2.0 version of your method existed.

Method method = null;
try {
    method = financialCalcObj.getClass().getMethod("calcBreakEvenV2", null);
}
catch (Exceptione ex)
{
    // not really an error, use standard method
}
try {
    if (method == null)
        method = financialCalcObj.getClass().getMethod("calcBreakEvenV1", null);
}
catch (Exceptione ex)
{
    // wow, thats bad
    System.exit(1);
}
method.invoke(financialCalcObj, null);

If this doesn’t seem pretty amazing just remember that you cannot do the following unless you already have all methods defined at compile time.  (which does defeat the idea of trying to future proof your code)

try {
    financialCalcObj.calcBreakEvenV2();
}
catch (Exception ex)
{
    financialCalcObj.calcBreakEvenV1();
}

The difference between the two sets of code is that in the reflection example was compiled before version 2 of this method existed.  We just knew that it would show up eventually.  This could be extended to either use the highest version that existed or to use the version of a method based on a command line argument.

No magic just a bit of forethought required

A program that uses reflection in this manner might not make much of a difference if the same set of class files or jar files are used each time.  It does allow some flexibility but if the code base never really changes it is not necessary to go to these extremes just to change how the program behaves at runtime.

The program that I had been envisioning  was going to use this technology to dynamically support multiple language text.  The dynamic part was the program would convert numbers into text of the desired language.  The program would run every few minutes so it would be possible to exchange jar files between runs, however I think there is an even better solution.

ie.

    numberToTextGerman
    numberToTextEnglish
    numberToTextFrench

Instead of continuously replacing the language jar – each time with more languages I would take a slightly different route.  I would structure the program in such a way that each new language with its methods would exist in its own jar file.

The actual program itself would retrieve the data which needs to be processed and this would include the form language.  Most of the form text might be read from a database table or a possibly a file but the conversion between numbers and their textual descriptions would need to be some sort of program.

Because each language would exist in its own jar file and because the program would be receiving the target language in the input data, it would be possible to support new target languages whenever they were ready.

Simply copy the new jar file to the program directory and change the list of supported languages in the application.  The program would do the rest.  Well, the script or batch file that calls the program does need to ensure that it will include the new jar file.

I simply create the classpath from the list of jar files available and the script which runs the program would be called periodically from the crontab or other scheduler.  So the simple act of adding the jar file to the programs library directory automatically adds support to the program for this new language each time the script is run.

Reflection classes and methods

The Java API has the Method class which can be used to retrieve and inspect methods.  It is possible to query the name, which parameters types it expects, the return type and of course the ability to call the method.

class Method

  • String getName()
    Returns the name of the method.
  • Class[] getParameterTypes()
    Returns an array of Class objects which represent the parameters, in the order of declaration.
  • Class getReturnType()
    Returns a Class object that represents the return type of the method.
  • Object invoke(Object obj, Object... args)
    Invokes the underlying method represented by this Method object with the specified parameters.

class Field

The Method class allows you to interrogate a method to see exactly what parameters it is expecting and so forth but it is also possible to perform similar queries but on the class level for defined variables.

Once you have retrieved your variable from the class it is it can be used to then query information about the fields.  It is possible to retrieve the name, the type or even the value.

  • String getName()
    Returns the name of the field.
  • Class getType()
    Returns the type of the variable.
  • Object get(Object obj)
    Returns a Class object that represents the return type of the method.

 

Multilingual support example

For this example, it is expected that every language support class must have a certain core set of methods.  The easiest way to ensure that this happens is to create an interface of those methods.

To demonstrate this rather interesting idea using reflection, I am not going to have complete language functionality just enough to demonstrate how it works.  The language classes will each have to support two numberToText methods.

package com.acmesoft.support;

public interface languageInterface {

	public String numberToText(long value);
	public String numberToText(double value);
}

The actual reflection magic happens in the Numbers class. This class essentially is a small dispatcher by looking up the method based on the language that is passed in.

package com.acmesoft.support;

import java.lang.reflect.Method;

public class Numbers 
{
	public static String number2TextClass = "Numbers";
	public static String number2TextMethod = "numberToText";

	public String numberToText(String language, Integer val) throws Exception 
	{
		String outputtext = "";
		
		try{
			String searchObject = "com.acmesoft.support." + language ;
			Class cls = Class.forName(searchObject);
			Object obj = cls.newInstance();
			Method method = null;

			/* for methods with other parameters 
			//no paramater
			Class noparams[] = {};

			//String parameter
			Class[] paramString = new Class[1];	
			paramString[0] = String.class;

			//Double parameter
			Class[] paramDouble = new Class[1];	
			paramDouble[0] = Double.TYPE;
			*/

			//Long parameter
			Class[] paramLong = new Class[1];	
			paramLong[0] = Long.TYPE;
			
			// lets find out what the number is in words
			method = cls.getDeclaredMethod(number2TextMethod, paramLong);
			outputtext = (String)method.invoke(obj, val);
		}
		catch(Exception ex)
		{
			/*
			ex.printStackTrace();
			System.out.println(ex.toString());
			System.out.println(ex.getLocalizedMessage());
			*/
			throw ex;
		}
		
		return outputtext;
	}
}

Lines 15-17 actually lookup the class that we will need for this method.  This will be the actual language class (ie English).  Lines 34-35 prepare the type of parameter that will be used by this method as well as performing the lookup of the method with the getDeclareMethod call.  Lines 38-39 simply calls this method with our parameter.

The actual language implementations are actually rather sparse.  Having the code to convert 73626.82 into either either German or English although interesting doesn’t actually reinforce anything related to reflection so it has been simplified.

package com.acmesoft.support;

public class en implements languageInterface 
{
	public String numberToText(long val)
	{
		String retval = "";
		
		switch ((int)val)
		{
		case 1:
			retval = "one";
			break;
			
		case 2:
			retval = "two";
			break;
			
		case 3:
			retval = "three";
			break;
			
		default:
			retval = "unknown";
		}
		return retval;
	}
	
	public String numberToText(double val)
	{
		return "not yet";
	}
	
	public void testPgm(String[] args)
	{
		int val = 2;
		String valText = "";
		
		if (args.length != 0)
			val = Integer.parseInt(args[0]);
		
		try 
		{
			valText = numberToText(val);
		} 
		catch (Exception e) 
		{
			e.printStackTrace();
		}
		
		System.out.println(val + " is equal to " + valText);

	}
	public static void main(String[] args)
	{
		en pgm = new en();
		pgm.testPgm(args);
		return ;
	}
}

There is nothing in this class “en” sample code that you won’t be able to recreate in perhaps in the first few days of introduction to Java.  It is only a few lines of reflection code in our Number class that provides the flexibility.

#!/bin/bash

CP=base/final/internationalBase.jar:german/final/internationalDE.jar:english/final/internationalEN.jar:.

java -cp $CP com.acmesoft.support.TestPgm  1 en de fr
echo " "
java -cp $CP com.acmesoft.support.TestPgm  2 en de xx
echo " "
java -cp $CP com.acmesoft.support.TestPgm  3 en de

testrun

Download complete source for this language example

The darker side of reflection

The ability to get either the value or method directly is much more powerful than it appears at the first glance.  It is actually possible to retrieve values from private variables or call private methods that you normally wouldn’t have access to.

The neat thing about this is you only need to add one additional method call to enable the actual access to the value or method.

For Private methods

Method method = yourObject.getClass().getDeclaredMethod(yourMethod, argumentTypes);
method.setAccessible(true);
return method.invoke(yourObject, yourParameters);

For private fields

Field field = yourObject.getClass().getDeclaredField(yourField);
field.setAccessible(true);
field.set(yourObject, value);

Ignoring access permissions example

package payroll;

import java.lang.reflect.*;

public class Interrogate {

    public void showIncome(PayrollDept myobject)
    {
        Field privateIncomeField = null;
        
        try {
            privateIncomeField = myobject.getClass().getDeclaredField("income");
        } catch (NoSuchFieldException e) {
            e.printStackTrace();
        } catch (SecurityException e) {
            e.printStackTrace();
        }
        double income = 0;
        try {
            privateIncomeField.setAccessible(true);
            income = privateIncomeField.getDouble(myobject);
        } catch (IllegalArgumentException e) {
            e.printStackTrace();
        } catch (IllegalAccessException e) {
            e.printStackTrace();
        }
        System.out.println("Income " + income);
    }
    
    public void hackIncome(PayrollDept myobject)
    {
        Field privateIncomeField = null;
        
        try {
            privateIncomeField = myobject.getClass().getDeclaredField("income");
        } catch (NoSuchFieldException e) {
            e.printStackTrace();
        } catch (SecurityException e) {
            e.printStackTrace();
        }
        double income = 0;
        try {
            privateIncomeField.setAccessible(true);
            privateIncomeField.set(myobject, 1000000.0);
        } catch (IllegalArgumentException e) {
            e.printStackTrace();
        } catch (IllegalAccessException e) {
            e.printStackTrace();
        }

    }
    
    public Interrogate()
    {
        PayrollDept myobject = new PayrollDept();
        
        System.out.println("Name   " + myobject.firstName + " "+ myobject.lastName + ", " + myobject.title);
        System.out.println("Eyes   " + myobject.eyeColor);
        System.out.println("Height " + myobject.height);
        System.out.println("Weight " + myobject.weight);

        showIncome(myobject);
        hackIncome(myobject);
        showIncome(myobject);
        
        Method increaseIncomeMethod = null;
        Class[] paramDouble = new Class[1];
        paramDouble[0] = Double.TYPE;
        try {
            increaseIncomeMethod = myobject.getClass().getDeclaredMethod("setIncome", paramDouble);
        } catch (NoSuchMethodException e) {
            e.printStackTrace();
        } catch (SecurityException e) {
            e.printStackTrace();
        }
        try {
            increaseIncomeMethod.setAccessible(true);
            increaseIncomeMethod.invoke(myobject,2000000.0);
        } catch (IllegalAccessException e) {
            e.printStackTrace();
        } catch (IllegalArgumentException e) {
            e.printStackTrace();
        } catch (InvocationTargetException e) {
            e.printStackTrace();
        }
    
        System.out.println("Income " + myobject.verifyIncome());
    }
    public static void main(String[] args) 
    {
        new Interrogate();
    }
}
package payroll;

public class PayrollDept extends Object
{
    public String title ;
    public int height;
    public String eyeColor;
    public double weight;
    public String firstName;
    public String lastName;
    private double income ;
    
    public PayrollDept()
    {
        title = "CEO";
        height = 204;
        eyeColor = "hazel";
        weight = 90;
        income = 1000;
        firstName = "Max";
        lastName = "Musterman";
    }
    
    private void setIncome(double val)
    {
        income = val;
    }
    private double getIncome()
    {
        return income;
    }

    public double verifyIncome()
    {
        return income;
    }
}
#!/bin/bash

CP=final/darkside.jar

java -cp $CP payroll.Interrogate

darksidetest

Download complete source for this “darkside” example

Posted in programming | Tagged | Comments Off on interrogating your code – dipping your toes into java’s reflection

Security in homogeneous systems

The Central Intelligence Agency (CIA) has been quite industrious in creating a new way[1] of tracking documents that could be “borrowed” from a person, business or government against the will of of that entity.

This new document protection is the creation of a watermark that is also a web beacon in the document.  If you think about it, this is a pretty neat way of “bugging” a document to call home when it is opened.

This particular trick works (at the moment) only on Microsoft Office files.  Not a very surprising choice considering the market penetration of MS office.  I cannot find any usage statistics for MS Office but it seems reasonable that Microsoft has at least 50% of the overall market including personal usage and business usage.  I would bet that the business usage for medium and large sized company’s is much much higher.  There are some big firms and governments that use open source office suites but many more that use Microsoft Office solutions.

However, those ambitious CIA fellows must have had a blind spot in considering that people would only use MS products.  This probably doesn’t work when you open these documents with other office suites.  Not only that this foreign intrusion may actually be visible.  Oops.  I guess once they think this through to the end they will realize that was a bit of a silly assumption on their part.

Heterogeneous for the win

It is really a lot easier to support a company or division when everything is the same.  You have a few default images for the few types of systems.  In this situation, setting up a computer is really easy.  Really easy is not always the best solution.

All software has bugs and it is only a matter of time before some hacker or state agency finds a zero day bug they can exploit.  If all systems are using the same operating system then once a bug is found it would allow the hacker the ability to exploit it everywhere.  If some of the systems utilize a different operating system they would form type of firebreak against the exploit and help to make it safer.

Having different systems or programs can make support a bit harder but it will add subtle layers security at the minimum.

I thought that there were more articles about the dangers of homogeneous systems but Google cannot seem to find them.

Well, other than this white paper.

Read more: Whitepaper: Attack of the Clones – Is Homogeneity in a network environment safe?

 

Posted in security | Tagged , , | Comments Off on Security in homogeneous systems

The power of mathematics in government

DEBT

This is a word that you rarely hear mentioned much by politicians especially if they are campaigning for office.  Oh, sure you might hear something about how they will fix the deficit.  The deficit that the other guys have allowed to run rampant will be fixed.

Oh, sure we will cut the deficit by about 10% a year and then in about 10 years we will have that nasty deficit tiger tamed.  Usually the savings are conjured up by playing up how growth and thus tax receipts will be increased.

During an election when people or groups claim that these savings are either unlikely or not realistic.  These nay sayers are usually accused of being partisan.  Indeed this might be true but considering how optimistic politicians are (every single time) and how often they are incorrect – again virtually every single time maybe some pessimism is warranted.

How big of a deal is a 500 billion dollar deficit when compared to a 19.8 trillion dollar economy?  Well, people have been hearing about the deficit so much they have forgotten that it really means unpaid bills or borrowed money.  These small (ha) deficits are what keep adding up to mountains of debt.

budget deficit when your expenses exceed your income.
debt the sum of all of the money owed.  these values are essentially the sum of all budget deficits.

It would take a real concerted effort to pay any large debt it off and downright impossible without reducing the budget deficit to zero.

But it this really a problem? Perhaps it isn’t a problem with these low interest rates.  The Fed rate is currently at 1/2%.  In one sense this debt bomb is less of a problem with low interest rates but it isn’t the principle that will be the eventual problem but the interest.

I considered writing up a spreadsheet to try and describe the future evils that will be visited upon the US, but the Internet Wallstreet Journal has already done some looking into this issue.

https://blogs.wsj.com/economics/2015/02/03/the-legacy-of-debt-interest-costs-poised-to-surpass-defense-and-nondefense-discretionary-spending/

If you choose not to read the article, then at least read the headline.

The Legacy of Debt: Interest Costs Poised to Surpass Defense and Nondefense Discretionary Spending

This type of problem is not only limited to the US, one of the key weaknesses of the Maastricht was that deficits needed to be limited to 3%.  Limited to 3% pretty much gives the EU members the option of never really balancing their budget.

Politicians have a tendency ignore anything that they really don’t wish to address.  The key sentence for the Europeans.

annual deficits no greater than 3% of GDP

Sure, 3% is a small number but if it is left to grow at this amount even a 3% growth will cause the debt to double in about 25 years – assuming no unexpected circumstances increase the deficit.  Well, I am sure that the EU countries are making sure that in some years they have a surplus – right?

I am a tech guy (not a banker) but it is pretty disappointing to occasionally hear comments from people who cannot tell the difference between deficit and debt, and (US) politicians that play on that.

There will be some real problems for big countries that have never had to make hard decisions on their budgets if things don’t change.

Tell your friends the difference, tell your family the difference or perhaps most important tell your politician the difference (and that it matters to your children and their children).

 

Posted in Soapbox | Comments Off on The power of mathematics in government

… and because perception matters

“I am from the government and i am here to help”

                                            Ronald Reagan

It has certainly been a while since the government or the career politician has received a lot of respect.  I don’t find any statistics going back more than a few decades but it turns out that US politicians, especially congressman, end up much lower in the ranking over time.

Congress approval ratings in 2017             20%

Congress less popular than                           France

I don’t really want to defend the career politician but in this day and age their job is much tougher than when some of their predecessors such as when Abe Lincoln was in office. Actually, today it is even much harder than some of the more recent office holders such as Reagan or Clinton.  With the rise of technology their previous votes, speeches, or other misdeeds that have occurred in the last months, years or decades now come back to haunt them – sometimes in the form of video.

If you thought it was tough living down something you did in your youth imagine your every move being recorded for later use by groups just looking to find discrepancies or “flip flops” of opinion.  In addition, people or groups with personal agenda’s use all of this information with the intent of causing a politician to look stupid or clueless.

If you think that dealing with facts if difficult then try to imagine dealing perception.  It is just as powerful but not always grounded in facts.  There is even a trading adage to this effect.

Buy the rumor, Sell the fact

It is because perception is so powerful that small companies as well as large companies struggle hard to shape perception.  No CEO wants to loose customers or market capitalization because the public perceives them to be ambivalent about some topic or other – perception matters.

James Comey may have been fired for a lot of reasons but the reason that most people are looking closely at is that he was investigating the Trump campaign into collusion with Russia.

Were there any good reasons for firing James Comey?  Probably. What this the right time to do so? I suspect that historians will be answering these questions for years to come but this firing could be adding to the public perception that President Trump has something to hide.

This one firing would not necessarily matter so much if it was the only thing that has occurred during President Trump’s brief tenure as President.

In fact President Trump should be happy that special prosecutor Robert Mueller has been brought in to finish this task.  If for no other reason than it helps to refute the perception that there is anything that needs to be hidden, because perception matters.

It actually does not help President Trump’s case when he is exercising his hyperbole in some of his statements about this current situation.

The people who were happy with President Trump may or may not be less happy with him now. For those people who either did not like him before or had neutral feelings the various storms whirling around the White house do make a difference in how he is perceived as well as how America is perceive abroad.

I could take a cheap shot and find some reference from Donald Trump the campaigner to try and make him look less dignified or poke fun at him.  Instead, perhaps he will take some advice from someone he truly does trust.

Well, because perception does matter.

 

Posted in Soapbox | Tagged | Comments Off on … and because perception matters

professionalism in IT … at the movies

My first boss was a real ball-breaker.  He had a very good idea of what was possible with computers, what the users might need and how to achieve that.   He could have literally done it all himself except there were not enough hours in the day – so he needed staff.  When his staff had problems and needed assistance you could come to him for help.

First and foremost, when you show up, wait for him to finish what he was working on.  At the time it seemed like a power move but after years of reflection it was so he could finish whatever debugging he was in the middle of.  It takes longer than you would think to be in the zone and it is easy to get knocked out.

He would have expected that you had at least done your homework.

  • be able to clearly describe the problem
  • have the exact error message at hand
  • demonstrate what you have done in an attempt to correct this problem
  • be prepared to describe what you have done
  • know the code you bring to him

If you weren’t prepared the meeting probably wouldn’t go all that well.  He helped to cement how I would work on problems and what level I would expect from my colleagues.

I have a tendency to think about him whenever I see what I consider to be stupidity in the workplace.  I was surprised when I almost heard his voice at the movies.

It seems sloppy that in 2016 computers and point of sale terminals should be providing less information now than they probably did in the 1950’s.

cinestar-receipts-concessions

Concession receipt for 2 sodas and some popcorn

It my be difficult to see but this scanned receipt is a reasonably high res receipt that includes special symbols, German special characters, and bar codes.

I am a bit surprised how the number of items is represented.  I personally don’t think that the concession stand will be selling double digit of anything much less four digits of anything.  Someone decided they want all of their numbers to align so that isn’t the oddity but the leading zeros are.  Perhaps that is just a personal dislike.

The receipt itself actually has more information about the company and the branch than the food.  I know that snacks at the movies are expensive but from looking at this receipt it is almost as if the movie theater is embarrassed to say just how expensive each item truly was.

It is a possibility that receipts in Germany are more of the simple variety, but alas that isn’t the case.

tedi-receipt

receipt for USB cable and a flashlight

 

This is a receipt from a store that would be most like a dollar store in the USA.  This receipt contains as much information about the store in general as well as a lot of information about what was purchased.  The item #, description and cost per item is all clearly displayed.  Closer to the bottom you can even see how much of your purchase went to the government in the form of taxes.  This is a great receipt.

Taking one final look at my concession receipt

Dies ist keine Rechnung im Sinne des §14 UStG…

Well, I guess the receipt that I asked for is a receipt but not a receipt in the sense of what is a receipt as described by a long and dry law description clarified by §14 of UStG.

It is not like this particular movie theater cannot produce more complicated output.  They did a much better job with the tickets – font size, German characters and QR codes.

cinestar-receipts-seats

These are actually both the receipt and the ticket.  Plenty of information here as well including a nifty QR code which probably contains all of this and more.

If worked on the concessions output then my boss would be pulling me aside right now for a small talk.

Posted in Soapbox | Comments Off on professionalism in IT … at the movies

Is Agile development the Emperors new clothes

I had the opportunity to take a class on Agile development recently, Scrum, and it was a fascinating way of doing development. I have been pretty lucky over my career that I have not been dragged through a lot of heavy development processes. Yet, while working on some projects I have experienced the joys of slow processes, excessive meetings, indecisive users, as well as plenty of scope changes. Management would blame us if we didn’t deliver on time something that was completely different than their original program.

Initially while sitting in my class I was thinking that Scrum might be the solution to all those problems.

No specific due date is given for delivering on those features, just a series of releases each with more functionality than the last. There is no real penalty for change, well not for the developer; Perhaps for the product manager depending on the company culture. You even have your own advocate to deal with either incidental or structural problems.

About the time that I was convinced Scrum was the solution to all problems everywhere that I started to have a few doubts. I personally am not a big fan of writing up specifications or user documentation and the people have a tendency to not read it much either. This much unloved type of documentation is however requested by auditors.

I asked about this in class and oddly enough documentation was not one of the artifacts of the process. Sure, you could define “done” to include this but developers are not natural writers and from a productivity standpoint you would really want them to write code. What about adding a layer around the scrum team of technical writers?

That might be just as bad as not doing scrum in the first place. You will have a constant flow of people waddling over to the developers breaking their concentration.

Then why does Scrum work?

  • The developers set their own due dates rather than management
  • A product manager is available to answer all questions about the tasks being developed
  • The product manager can make decisions regarding the direction of the product
  • The number of meetings for the most part are all defined and limited
  • The developers are expected to be capable, independent and have courage
  • The scrum master is dedicated to eliminating impediments to team progress
  • The list of features have been ordered by priority and the important ones should be well defined.

The transparency helps management to realize that with the resources in place some of their requests are not possible.

What development methodology wouldn’t be better with these as preconditions? If you have dedicated group of smart people doing the work who are able to get feedback on their work along with someone fighting to remove difficulties then you will see good results.

Just like all other processes in the world the better your inputs the better your final results.  These results could be faster, smaller or less bug laden.  I guess this could be summed up with use better staff and try and stay out of their way … well, that’s my thoughts on agile.

 

 

Posted in Soapbox | Tagged | Comments Off on Is Agile development the Emperors new clothes