Computer Security Haiku

Gold in vault, target
Steel door closed, locked, key thrown away;
Thief laughs "There's no wall!"

Data stream flows, filling
Lake overflows; disaster!
Arbitrary code

Man trusts fellow Man,
fellow Man undeserving.
Script code injected.

Novice celebrates,
Output easy, just append strings!
Master needs new novice.

Dark secrets made, shared
Tells foe the password is lost...
Rubber hose finds it.

"Love", Alice tells Bob
In anger, Eve flips one bit
Now love's checksum fails

Small time differences,
like the blink of a blink, yet,
timing attacks still work.

Chick digs my profile,
sends regards in attachment.
Virus, still no love.

That plaintext password?
Easy, but when the press hears...
thought too hard to bear.

Address sign-up forms,
Security mindset sees
a way to spam foes.

I'm aware of the rule that haiku are supposed to have "season words", but I just couldn't jam them in there. "Arbitrary Javascript injection" is ten syllables already, for instance. It seemed better to not jam them in.

Parametricity in Go
Oct 17, 2013
Programming, Golang

One of my objections to Erlang is that despite paying the price of being a functional language, it often fails to reap the advantages. An example of this is in testability; nominally, a purely functional bit of code ought to be easier to test than the imperative equivalent, because it is just a matter of setting up your parameters and checking the results, with no IO or state in between.

Erlang doesn't make this impossible, but it's less convenient than the brochure promises. The core of your application is generally locked up in the various gen_* handlers. These handlers have very stereotyped ways of being called, which include the full state of the thing being tested. I find this very tedious to test, for two reasons: 1. Every test assertion must define some sort of "complete state" for the handler, which is probably full of real-world concerns in it. In particular if it has further messages it is going to send, those are often relatively hard-coded somehow... an inconvenient-to-mock Mnesia entry, an atom-registered process name, etc. (Erlang programs end up having a surprising amount of global state like that.) 2. If you want to test some sort of sequence of events, you are responsible for threading through the code, or manually invoking the proper gen_* start up functions, or something. It's possible to refactor your way out of this mess, but in practice it's a lot of work for the reward. So many of the tools you could use in other languages aren't available.

Go, in theory, ought to be harder to test than Erlang, being an imperative programming language. In practice, I'm finding it much easier, and I'm doing a lot more testing in it.

Read the rest...

Mathematical Diversions: Producing Helium from Hydrogen
Sep 20, 2013

In response to this story about a possible impending Helium shortage, someone suggested on Hacker News that perhaps someday we can use nuclear fusion to produce helium.

As it happens I'd idly chatted with my wife about that a few weeks ago, but that wasn't enough motivation to run the numbers. This was. Could we produce enough helium to satisfy our commercial production of it through fusion, if we just assume we have fusion?

Read the rest...

Sep 10, 2013

I had a dream this morning that my workplace had so suddenly shut down that there was nothing in the office when I got there, except a sign telling us that due to financial shenanigans the entire office had to be immediately liquidated, and a whole bunch of my coworkers milling around being angry about it.

Since I work for a tech company, this is quite silly. The assets of a tech company aren't anything interesting at all compared to the people, and an emergency fire sale would hardly recover anything of value.

Fortunately, I don't live in that universe and my job was still there this morning. Phew!

After that part of the dream, I encountered Captain Malcolm Reynolds sitting down for a man-to-man talk with his six-year-old son. I saw Kaylee there too, and asked her what season this was. "Eight or nine, I think" she replied.

Nooooo... come back, dreamuniverse! I can get a new job more easily than I can get new Firefly! noooooooooooo....

Sep 06, 2013
It is important to use a cartridge of the appropriate size for your target. Shooting a [UAV] drone with .22 rimfire for instance would be cruel. You need something that will kill the drone, not make it suffer. - jlgreco on HN

<- Future Posts Past Posts ->


Site Links


All Posts