Mike's Blog

Ampersands and the Fortune 500

2010-11-17T10:42:00.000-05:00

Trivia contests in bars keep on growing in popularity in the Boston area. I've been to a couple, but they've never managed to live up to the excitement and intensity of the "quick recall" competitions I took part in during high school.

A coworker of mine recently attended a trivia night at the Oberon in Cambridge, put on by an outfit from New York named Big Quiz Thing. One of the final questions was: "What's the only company in the Fortune 500 that has an ampersand in its name?" My coworker named the first company that came into his head - Procter & Gamble (not surprising, since we sell analytics software for consumer goods companies). He was informed he was wrong - the correct answer was supposed to be AT&T.

Because I'm that guy, I have a copy of this year's Fortune 500 in my office. I gave it to him to flip through at work the next day, and he verified that Proctor & Gamble does indeed have the ampersand in its name on the list (as well as on the side of their headquarters in Cincinatti).

I read through the full 2010 Fortune 500 list and came up with a pretty long list of companies with ampersands in the name:

7. AT&T
22. Procter & Gamble
33. Johnson & Johnson
173. PG&E Corp
217. BB&T Corp
221. Marsh & McLennan
240. R.R. Donnelly & Sons
273. Air Products & Chemicals
283. Owens & Minor
314. Bed Bath & Beyond
372. Barnes & Noble
394. Reliance Steel & Aluminum
416. Telephone & Data Systems
420. Western & Southern Financial Group
435. Black & Decker
493. H&R Block

Disabling UNIX core Dumps In C

2010-04-13T17:47:00.006-04:00

When a UNIX program crashes, the operating system writes everything it held in memory out to disk. The resulting file, known as a core file, is pretty handy if you're a programmer trying to figure out what went wrong. You can pull the core file into a debugger like GDB or DBX to figure out what the program was doing when it crashed, and hopefully fix the problem.

As you'd expect, programmers love core files. The problem is, security guys hate them for the same reason programmers love them: they write out the contents of memory to disk. That means if somebody gets their hands on a core file, they can read any sensitive data the program was holding in memory such as passwords and security keys. It's not difficult to force a program to "crash" and create a core file - the gcore tool is designed to do exactly that.

If you're writing an application that handles secure data or operates in a secure environment, you can turn off core file creation in the (unlikely, of course) event that your program crashes. UNIX maintains a set of system resource limits for every process on the system: one of those limits is the maximum size of a core file. If we set the maximum size of a core file to 0, core files won't be created for processes that crash.

Below is a simple C function that uses setrlimit() to set the maximum size of core files to 0:

#include <sys/types.h>

#include <sys/resource.h>

void disableCores()
{
struct rlimit rl;

rl.rlim_cur = 0;
rl.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rl);
}

If you feel you need to disable core files in your program, do it as soon in your program's application as you can. Keep in mind that turning off core files means you're going to have a heck of a time trying to debug real crashes - you might want to use preprocessor directives to only turn off core files when the program isn't running in debug mode.

Detecting & Disabling UNIX Debuggers

2010-04-06T18:42:00.014-04:00

If you write security or licensing software targeting UNIX/Linux platforms, it's usually just a matter of time until somebody with not-so-good intentions tries to pull apart your software to figure out how to circumvent it. UNIX is definitely a programmer's operating system - a standard debugger like GDB is all you need to trace through any program's execution path.

Luckily, all UNIX debuggers are easy to detect if you know how they work. The key is that they use the ptrace system service, which provides an interface into the operating system kernel's control structures. ptrace is immensely powerful, but it won't allow a process that's currently being traced to call ptrace on itself or another process. Allowing that has the very real potential to lead to a race condition, which would result in a kernel panic.

If we want to see if our program is being traced by a debugger, all we have to do is try to start a trace ourselves on a child process. If we aren't being traced, the call to ptrace will succeed. If we are being traced, the call will fail.

Why a child process? You could use any process in theory, but we can't guarantee that our process will have the privileges required to start a trace on any process except a fresh child process. (For obvious reasons, the UNIX security model won't let a user call ptrace against a process they don't own unless they're root.)

The below code snippet implements a detect_debugger() function that returns 1 if a debugger is detected, and 0 if one is not. You can use this function (or one like it) immediately before executing sensitive code. If a debugger is detected, best practices would dictate halting with an error message. If your program has elevated privileges and you feel like being a bit snarky, you can get a system process list and issue a SIGTERM to anything that resembles a debugger.


#include <sys/types.h>
#include <errno.h>
#include <signal.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/ptrace.h>
#include <sys/wait.h>


int detect_debugger(void)
{
int status, waitrc;
pid_t child, parent;

parent = getpid();

//everything inside this if statement is the child process
if (!(child = fork()))
{

if (ptrace(PT_ATTACH, parent, 0, 0))
exit(1);

waitrc = -1;
while ((waitrc == -1) && (errno == EINTR))
waitrc = waitpid(parent, &status, 0);

ptrace(PT_DETACH, parent, (caddr_t)1, SIGCONT);
exit(0);
}


if (child == -1)
return -1;

waitrc = -1;
while ((waitrc == -1) && (errno == EINTR))
waitrc = waitpid(child, &status, 0);

return WEXITSTATUS(status);
}

Perl: Adding Hash Elements

2010-04-05T11:54:00.005-04:00

Adding elements to a hash in Perl is a simple exercise, since Perl doesn't force you to do lots of setup work to pre-allocate hash table space and set up a hashing scheme like other programming languages. Just assign your value to your key:


$HASH{$key} = $value;

For example, if you wanted to create a hash containing your favorite MLB baseball teams and their locations you could use code like:


$TEAMS{Red Sox} = "Boston";
$TEAMS{Pirates} = "Pittsburgh";
$TEAMS{Orioles} "Baltimore";
$TEAMS{Cubs} = "Chicago";

If you're bulk-loading a hash with hardcoded values like the above example, you can also use Perl's list syntax:


%TEAMS = (
"Red Sox" => "Boston",
"Pirates" => "Pittsburgh",
"Orioles" => "Baltimore",
"Cubs" => "Chicago");

Note that it's a good idea to zero-out the hash structure before you start using it with undef:


undef(%TEAMS);

I like to capitalize the names of hashes because I think it makes the code more readable, but that's the sort of thing that can start very long arguments at Perlmonger meetings.

Perl: Presizing Hashes

2010-04-02T12:39:00.000-04:00

If you're a lazy programmer (and why shouldn't you be?), Perl hashes are great because they automatically grow to handle any amount of key/value combinations you want to put in them. At least until you run out of memory, that is.

This works because Perl keeps track of how much "free" space is available in a hash table, and automatically grows it when it starts to get full. If you're adding a little bit to a hash now and then, or your hash isn't going to be very big, this isn't much of a performance problem. But Perl only grows the hash by the standard memory page size on your system - usually 8KB. If you're bulk-loading a 25MB hash, that means Perl is going to make around 3200 memory allocation calls.

Memory allocation is relatively lightweight on most modern operating systems, but it's still a heck of a lot more efficient to make a couple calls to obtain large blocks of memory than a lot of calls to obtain small blocks. Perl lets you specify the number of keys you expect to have in your hash before you begin work so it can optimize its memory allocation scheme. For example, if you expected your hash to have 1,000 keys you would call:


keys(%ENTRIES) = 1024;

Notice that I used 1024 instead of 1000 - Perl requires your presizing selection to be a power-of-2. With that said, Perl's smart enough to automatically choose the first power-of-2 larger than the value you specify. If I'd specified 1000, Perl would have automatically used 1024.

Doing this has a nice side-effect: if the system is going to run out of memory and force your program to halt, you'll know it before you do a lot of processing work.

Notes From San Francisco

2007-05-09T20:17:00.000-04:00

Ah, San Francisco in May. The weather is perfect - cool and crisp so the first cup of Starbucks smells that much better (and the homeless people don't smell too bad), the fog never makes it any further than the Marin headlands, and I'm here for a trade show so I don't even have to pay for dinner. A couple interesting observations:

1. Booking a hotel on Powell Street near Union Square seemed like an incredibly good idea when I was sitting in Boston a month ago. After being kept up half the night by the cable cars screeching by, it seems a little less so. (Lest you think I'm some whiny hick from the sticks, I live right next to the Green Line trolleys in Boston. I'm immune to the screeching they make, which can be pretty considerable.)

2. Note to family members who express concern whenever they learn I'm here: this isn't the 60s or 70s - downtown SF isn't exactly a dangerous place. My hotel is next to Tiffany's, Saks, Cartier, and Armani. Now, the block around the corner is a little sketchy - they only have mid-level retail like Levis and Victoria's Secret. I hear rumors that there's even a Walgreens 3 blocks away, but I'm too afraid to walk in a neighborhood like that.

3. Speaking of bad neighborhoods, what happened to all of the crazy/colorful homeless people? On previous trips I've seen people actually wearing foil helmets while screaming to a light post about CIA mind control, a quasi-naked homeless guy with dread locked pubic hair, and tranny hookers harassing tourists in front of the convention center. They all seem to be gone - did Giuliani ship them all down to Santa Monica?

4. Despite being a major business center and ground-zero for uppity tech companies who are too good for the Valley, hotels (even those that cater to business travelers) are pretty business-unfriendly. I have to get down on my hands and knees and scrabble around behind the bed to find an outlet to plug my laptop into, and the outlet is old enough to make me worried about electrical fires. The wireless Internet connection only works when everybody else is asleep (luckily I'm still on EDT, so I get 3 hours of decent usage every morning). My room didn't have an office chair for the desk, and it took me 2 days to explain to the hotel staff what an office chair was (and finally breaking down and asking a friend how you say "office chair" in Mandarin) to get one. (Just as an FYI to the hotel in question - when you show nice office chairs in all of the rooms on your website, it's not crazy for me to want one when the only chair in my room is some art-deco armchair monstrosity that's a foot too short to reach the desk.)

5. If you've never been to America before and you're in SF for a conference, three quick tips on how to avoid being the subject of stares and verbal abuse:

When you're given a free T-shirt as part of your conference package, you don't immediately strip down to the waist and put it on in the middle of the Moscone convention center. The proper response is to look at it, and either say "F---! Why can't you people get shirts in any size other than XL?" if you're a web designer or say "Frack! Why is XL the smallest size you guys have?" if you're a programmer.
When the convention center is serving the world's worst lasagna, you don't jostle your way to the front of the line causing everyone to spill lasagna on their non-conference-issued shirts. I'll get over you staining my button-down shirt from the discount rack at Macy's, but a couple of us almost had to physically restrain the guy next to me when you got lasagna all over his James Gosling-autographed Duke t-shirt.
When you're eating a bag of potato chips, don't carefully pull the bag apart at the seams, lay it down flat on a table, and then start licking up the chips like a dog. Use those awesome opposable thumbs we all have, regardless of where we live.

6. Reebok's current ad campaign appears to universally suck. The slogan is "run easy", accompanied by reasons why you should run slowly and lose races. They splattered Boston with them 2 days after the Boston Marathon, and everybody jeers at them. They're all over SF too, and I've overheard several locals mock them as they walked down the sidewalk.

April Snow

2007-04-04T15:41:00.000-04:00

At first glance, you might look at this photo and think to yourself, "Wow. Mike really sucks as a photographer." And you'd be right. But my lack of shutter skill isn't the cause of the streaks and blurring in the photo.

The white stuff on the ground isn't sand from the beach - it's snow. And there's a lot more of it falling from the sky.

I realize that this is Boston, but still. Snow on April 4th - that's freakin' ridiculous.

Bummer Nation

2007-03-08T14:36:00.000-05:00

No, this isn't a lame post about how America sucks and we should impeach Bush. (All of the other motards out in the blogosphere have wasted enough gigabytes of disk space and bandwidth with that crap.) Instead, I'm talking about Pontiac's new marketing campaign for their Solstice and G6 convertibles, at http://www.pontiac.com/convertible.

I factory ordered a Solstice GXP a month or so ago, which means I've somehow ended up on a GM mailing list. Now while I wait at least 3 months for the guys in Wilmington to assemble my car, they like to remind me that I don't have it yet with these emails. (Not that I'm missing it much right now - it's been in the single digits up here this week.)

Before I go any further, everything you've ever heard about car salesmen is true. I was sitting in the demo car at the dealership, and the guy spent 10 minutes showing me the cup holders and "auxiliary power point" (we called them cigarette lighters in my day, although anyone who even thinks of lighting up a piece of cancer candy in my car is going to get their hand slammed in the door). I'm not aware of anyone who has even remotely thought of purchasing a 2-seat convertible who cares about cup holders. No mention of the direct-injection engine technology, dual-scroll turbocharger, or the hydroformed steel body. I'm not expecting the guy to be able to show me where obscure components are in the engine compartment, but come on. At least talk about how fast it is - even the marketing folks at GM can apparently handle that: "It's faster than a Porsche! We swear! Please believe us!"

Anyhow, back to "Bummer Nation". The marketing gimmick is a little Flash presentation that has caricatures of people who are supposedly going to tell you not to buy a convertible, and the reasons they're wrong. There's "Wet Blanket Mom", who thinks they're unsafe because fun and safety are mutually exclusive. Her little quote is: "Oh, you need a convertible, fancy pants, like I need a belly shirt." And then if you click it, there's a little pop-up explaining how safe the Pontiac convertibles are. (I have my doubts about surviving a high-speed roll in a Solstice like the one James Bond did in his Vanquish, but I'm definitely not putting that thought in my mom's head.)

Then there's "The Hibernator", obviously modeled on someone I work with. His quote: "Good gravy, there's a dusting of snow out there, driving will be absolute mayhem!" In fact, the guy I work with is so much like this caricature that he started ticking off all the reasons I was dumb for buying a rear-wheel drive car in Boston when he learned I'd put down a deposit. I'd have pointed out that I learned to drive in snow in a staggeringly vast rear-wheel drive car (an '84 Impala) without the advantages of ABS and stability control, but he was having too much fun telling me how dumb I was. I didn't want to ruin it for him.

And my personal favorite: "Hair-Obsessed Semi-Hottie". Her description: "After hours of trowel and putty work getting her face on, nothing is going to mess it up - least of all your convertible." When you click her, you're informed "The only mirror you should be checking this chick out in - the rearview." Ironically, I couldn't make the Pontiac sales guy understand why I didn't want to pay an extra $1K for air conditioning I'd never use. My rationale was "If it's hot enough for AC, it's hot enough to put the top down." (Of course, I always forget that people up here freak out when it's over 85 degrees. Where I'm from, that's a mild summer day.) He used about 20 variations on the "what about your girlfriend's hair?" gambit, to which my response was a polite version of "if she doesn't like it, I'm sure I can find a new one."

There's several others including "Smug Import Guy" and "The Vise", but you can check them out on your own time if you care.

Science in New Jersey

2006-12-09T07:48:00.000-05:00

While sipping coffee this Saturday morning and flipping through some email, I had the TV on in the background. Instead of the news, some Saturday morning kids' show called "Beakman's World" was on. It's a psuedo-science-educational show that seems targeted towards the 3-10 age range.

As I was listening to it, something jumped out at me. Everyone on the show - Beakman, the chick in the weird outfit who is somehow managing to wear 5 hair scrunchies at the same time, and the guy dressed up as a rat - all had the most outrageous New Jersey accents you've ever heard. I had to pop in a Sopranos DVD for comparison. Yep - Beakman and friends make the Sopranos characters sound like they're from Illinois. And the Sopranos actors are trying to ham up a New Jersey accent. I always thought kids shows were like the national network news shows - everyone tries to have as flat a "modern American" accent as possible.

KFed Gets Tagged

2006-11-03T08:59:00.001-05:00

Ah, the joy of tagging. Judging by this link, my fellow Amazon users know the joy of tagging. Judging by this same link, Kevin Federline does not.

http://www.amazon.com/Playing-Fire-Kevin-Federline/dp/tags-on-product/B000IU3YLY/ref=tag_dp_ct_sa/002-3394238-1285634

Just in case someone from Amazon decides to clean it up, the tags on this particular page include (but are not limited to):

talentless
garbage
laughable
idiot
crap
loser
poser
torture
trash
wannabe
asshat
cause for suicide
causes diarrhea
gave me the runs
made me sterile
magically craptastic
no talent assclown
rich wife
would rather eat a turd
abominable agony
appalling
atrocity
audible hemmorage
auditory jihad
aural assault
dead-beat
ear bleach
eats his own poop
excrutiating dreck
four horsemen
heinous
horrifying
talentless wannabe clown
killed my cat
loathsome
makes baby jesus cry
makes cancer look fun
no talent

There are others that are even more fun, but this is a classy blog and we don't use that kind of language here.

(Just in case you're wondering, I wasn't actually conducting a search for KFed on Amazon. I was clicking on random tags while drinking my first cup of coffee to see where it would take me.)

And you thought you were having a bad morning...

2006-11-01T08:38:00.000-05:00

There was a small traffic jam on the Mass Pike on the way into work this morning. On its own that's nothing unusual, but the cause was.

Everybody headed westbound was stopping to rubberneck an interesting tableau on the eastbound lanes. There were three state police cruisers on the shoulder, with all of their lights flashing. They were arranged like the police cars at the end of a high-speed chase in California, with a late-model Jeep in the middle. (Yes, I admit to being morbidly fascinated by high-speed chases. I lost the tiny smidgen of respect I might have had for OJ when he drove 30 mph below the speed limit while running from the po-po.) If you're not familiar with the giant traffic jam known as the Pike eastbound during morning rush hour, OJ still drove about 30 mph faster than it's possible to drive on the Pike in the morning. That makes the whole post-high-speed chase scene even more interesting. Did the guy refuse to stop while driving so slow that the cops could have gotten out of their cars and kept up with him by running? Were the cops really pissed off because Dunkin Donuts ran out of Boston creams? (I know I am when that happens.)

One cruiser had its nose in the ditch at an angle in front of the Jeep. (Driving very fast at an angle in front of the car being chased is supposed to force them to stop or hit the police car and stop. Now that I've shamefully admitted to watching high-speed chases on TV, I can say with certainty that this never actually works except for Dirty Harry, Magnum PI, Starsky, Hutch, and Nash Bridges. If you're already running from the cops, you apparently don't have much to lose by hitting one of their cars.) The remaining two cruisers were parked side-by-side about 30 feet behind the car.

The guy in the Jeep (who looked surprisingly more like a clean-cut 40-something white guy dressed in business-casual attire on his way to work at the phone company than your stereotypical perp) was being smashed up against the back of the Jeep by one cop, who was attempting to simultaneously frisk him and keep him smashed up against the car. The second cop was standing about 4 feet away with his gun drawn and pointed at the guy's head, while the third cop was standing back by the cars talking on a walkie-talkie.

I have no idea what this guy did, but I'm assuming he had a kilo of blow on the dash board and a backseat full of illegal guns from Georgia to elicit this kind of response. It felt nice to know that no matter what happens in the next 4 hours, at least one guy had a much worse morning than I could possibly have.