Category Archives: Technical

Top 25 Coding Errors

Security, Technical, ,

The Mitre Corp has produced the 2010 CWE / SANS Top 25 Most Dangerous Programming Errors which identifies the most commonly encountered coding errors that can potentially lead to web sites being hacked or PCs being compromised.  Some of the errors are well-publicised in the technical press, e.g. “cross-site scripting”; some are downright stupid, e.g. “use of hard-coded credentials” and others are the results of carelessness, e.g. “improper validation of array index”.

However, what makes this document better than the usual Top-X lists is that it provides guidance to programmers on how to prevent or mitigate the errors.  For example, to avoid cross-site scripting it suggests, “Use languages, libraries or frameworks that make it easier to generate properly encoded output.  Examples include Microsoft’s Anti-XSS library, the OWASP ESAPI encoding module and Apache Wicket“. There’s additional information for the technically-minded that goes through the different stages of software development starting with initial design, through to compilation, implementation and testing.

One of the best pieces of advice is in the discussion around checking for unusual or exceptional conditions, “Murphy’s Law says that anything that can go wrong, will go wrong. Yet it’s human nature to always believe that bad things could never happen, at least not to you. Security-wise, it pays to be cynical. If you always expect the worst, then you’ll be better prepared for attackers who seek to inflict their worst. By definition, they’re trying to use your software in ways you don’t want.”

So, if you are into web programming in any way, this has to be mandatory reading to keep the bad guys at bay.  Even if you are not, the discussion elements for each of the errors is illuminating in showing exactly what is going wrong and why it’s bad.  Just skip over the technical bits in between.

Windows XP to 7 upgrade step by step

Information, Technical, , ,

I decided to devote a large part of last weekend to upgrading my main system to Windows 7.  In the interest of science I decided that I would read no guides or tips beforehand, I would test how easy it was using only the information and instructions that came in the packaging.

So the stage was set for the install.  The system I am upgrading was very powerful when I built it 5 years ago.  While I do most of my web surfing on it, the main use for the system is to manage my media, either syncing it to my portable player or streaming it to devices on the network.  It started this process with Windows XP Media Centre Edition installed; I had a brand new copy of Window 7 Home Premium upgrade to work with.

Stage 1 – Preperationxp27 - device mgr xp

Even the packaging for Windows 7 made clear that a clean upgrade was only possible if you were upgrading from Vista.  The claim was though, that even though the main programs would need to be re-installed, the settings would be maintained.  I have never had a software upgrade that ran well so my confidence was not high.  Given that the test is to see how easy it is to have a usable system after the upgrade I took a few notes first on the beginning state.

When I performed a Vista upgrade on a relative’s computer the main issue I had was with a lack of drivers for all the installed devices.  At that stage it has already been 3 months or so since Vista was released and it was months more after that before all devices had working drivers.  I have a number of extra components installed so I am interested to see how many work after the upgrade.

xp27 b4 upgrade advisor devices

Microsoft has released an upgrade advisor to check which parts of the system are supported under the new environment.

The reports showed that Outlook Express would not be available and the game port would not work.  No great loss for these as I do not use either of them.  More worrying though was that my network card was listed as not compatible.  I have recently put in a new wireless-n router so I took the precaution of buying a new wireless card prior to starting the upgrade.

As you can see from the image to the right, the majority of my devices came up as being supported.

Once I had a level of confidence that I could support Windows 7 on this PC I was ready to start upgrading.  The only change I made to the system was to upgrade the RAM to 2GB.

Stage 2 – Settings transfer

xp27 b4 easy transfer startFirst step of the XP upgrade process is to run the Windows Easy Transfer program.  This is designed to take all the settings and files from the old to the new system.  There are options to save these to disk, USB media or a network share.  If the Windows 7 and XP installs are on different computers the transfer can also be done directly across the network.  In my case I set the target as a directory on another drive in the system.

While the process completed with no errors it took a long time.  Even though there was only about 260GB of data the process started at 5:05pm and didn’t finish until 12:51am, nearly 8 hours later.  Given that the processor was much busier than the disk during this time it appears like this was more than just a simple file copy.

Stage 3 – Install

The actual install on Windows 7 itself was a breeze.  I chose to install to a brand new directory so I could still boot XP if everything went pear shaped.  Even though I was using an upgrade version the install didn’t complain and there was very little interaction needed over a 15 minute process.  Within half an hour of shutting down XP I was running the Windows 7 side of the Easy Transfer.  This time I didn’t wait for the finish, I left it to run and went to bed.

xp27 7 system properties

In the morning the transfer had finished and I had a working system.  The next step was to check whether it was functional.  The Easy Transfer Report showed a few strange issues, including the “programs without identified manufacturers” including 5 Microsoft Programs.  Happily, even though the upgrade assistant claimed my system wasn’t up to Aero, it was running happily.

Stage 4 – Is it working?

A Device Manager repoxp27 7 device mgr after installrt showed that there were 5 devices that did not automatically find a driver.

-MS  Keyboard with Fingerprint reader

-Soundblaster Audigy

-Avermedia TV tuner

-SB Gameport

-DLink USB wireless-g NIC

This last was of course the problematic one as it prevented me getting onto the Internet to find drivers.  Thankfully I was pre-prepared with my brand new replacement NIC.  Such cunning, such foresight, such misplaced optimism.  This is where I ran into my first actual problem with the install.  The Netgear wnda3100 wireless n USB NIC came with a Vista driver that would not load and management software that crashed 5 seconds after it loaded.  As I no longer have any UTP running to my study from the router this would have been a problem without the miracle of multiple computers and flash memory.

Doing a few searches I found that it may not have been Microsoft’s fault.  The general feeling around some of the forums was that the Netgear 64-bit drivers were flaky to begin with and people had similar problems with Vista.  I managed to find someone who had hacked a driver to actually work located So thanks to unnamed author who gets some link love and a $10 donation.

xp27 7 device mgr after autocorrectNow back on the Net I ran an autocorrect feature that Windows 7 provided.  This managed to find drivers for 2 of the remaining issues, the SB Audigy and the TV tuner which both now worked.  This left just the gameport, which I was unconcerned about, and the fingerprint reader on the keyboard.  While the whole keyboard is listed in the report, the reader is the only function that does not work.  How ironic that the only device that caused me a lasting problem on a Windows OS was a Microsoft problem.

I was also having problems with the system freezing coming out of hibernate.  I am currently avoiding this by diasabling the auto-hibernate feature.

Stage 5 – Application re-install

The big test was next.  The two biggest worries I had going into this were Firefox and iTunes.  Firefox has a number of plugins, greasemonkey scripts, and heaps of favorites and links.

xp27 7 firefox after re-install

I was very pleased with this install though.  No only were all of the mentioned features there instantly after install, the new version of FF remembered all of the tabs I had open under XP when I shut down.  I had left a number of tabs open as what a I though would be an unfair test of the upgrade and was pleasantly surprised with the result.

xp27 7 itunes after re-install

The iTunes install went just as well with all of my songs and playlists surviving intact.  Most importantly all my podcast subscriptions, listened stats and player sync details came up automatically.  I did need to re-authorise a couple of songs though, which highlighted again for me the danger to consumers of DRM.  Almost all my digital media is DRM free because I stayed with CD’s until iTunes offered DRM free downloads.  I have 5 iTunes DRM’ed songs though that I bought for my daughter because she bugged me at a weak moment.  I have already used 3 of my 5 total re-authorisations and they were only purchased 2 years ago.

Conclusion

The other programs I re-installed had no significant history to remember.  All in all a relatively quick and painless process.  A benchmark claims that the system is about 15% slower running Windows 7, which is not bad for a 5yo system jumping 2 OS generations in one step.  The browsing and podcast syncing, which are the main functions of the system are running just as well as with XP.  The next couple of weeks will show whether problems start to show up and I’ll report back on my progress.

For the upgrade process though I will give Microsoft an 8.5 out of 10.  They lose some marks for the length of elapsed time the whole process took, most of which was waiting for the Easy Transfer process to finish.  This was the only real negative though from what was a painless process that delivered a better than expected result.

Can a Tablet Succeed?

Technical,

The rumour machine is abuzz with the prospect of Apple releasing a tablet, and there are a number of other people, most notably TechCrunch and Archos, have tablet systems either out or on the planning desk. It will be interesting to see if anyone can finally make one that is worth owning.

The first tablet PC I had used was a Compaq Concerto somewhere in the mid 90’s which was a 486 based tablet version of a standard Compaq notebook. I believe the much glorified Apple Newton preceded it, however while both these products were much hyped at the time but never delivered any real value and were cancelled without replacement.

In the 15 years or so since they first appeared tablets have made periodic returns, always for a brief flurry of enthusiasm that eventually came to nothing. The most sucessful itteration was the slight tangent into the PDA space. While that eventually was a dead end market as well, it did directly contribute to the creation of the smartphone market, which has been an increasingly bouyant tech market.

I am not confident that the track record of tablets gives great hope of success this time. There are a couple of new technologies that give this iteration a better chance. The first is multitouch touchscreens. This will make the platform more usable and increase the number of applications. The second is pageflow. While it is more an application of technology rather than a radically new technology, it does change the feel of scanning though multipage documents or lists of items, essentially making it a more natural feel.

The other positive aspect is the operating system options that exist now. A major problem previously was trying to use a full size operating system on a platform that needed to be lightwieght. A modified iPhone OS or Android platform could offer the functionality needed for the platform to operate while being lightweight enough to operate well on a less powerful platform and get good battery life.

I think this article in PCMag might have a good handle on what the Apple platform might end up looking like. One factor I definitely agree with is that new version of the tablet has to offer a different experience from a standard laptop, which needs to be more than just adding a different interface. There is also a good rundown of the tablet market in this NYTimes article.

802.11n is now actually a standard

Technical,

I don’t classify myself as an early adopter, I usually wait until a new technology has been out a while and the price has come down a bit before I jump in.  Consequently I rarely find myself ahead of the certification curve.  It is more a measure of the length of time that the IEEE certification has taken that I am already on my second generation of 802.11n router when the standard has only just been approved.

Considering that Draft-n wifi gear has become almost the defacto standard for most new networking gear it was only a matter of time.  Some time was lost deciding between one of three proposals until the groups behing them decided to merge into one.  A patent case from CSIRO on technology used in the draft standard also delayed things to some extent.  Regardless of the delays n is now a standard.  All we need now is something faster.

How heavy is a useable Petabyte?

Technical, ,

The team at MatrixStore have a post up calculating the weight of a petabyte of storage today compared to 1980.  Needless to say todays weight was a lot less.  The article was inspired by a post on Gizmodo illustrating how big a PB is.  There are two problems with the calculations though.

  1. 2TB is a marketing number.  The formatted capacity of 500 2TB drives is more like 916TB
  2. The weight is for the drives alone, which is not storage you could actually access and use
Image courtesy of WD

If we want to use 2TB drives we need a system that can hold 3.5″ drives.  The highest capacity tray I know of for these drives takes 48 SAS or SATA drives in 4U of rack space (about 7″ x 19″ x 24″).  You can sit multiple of these behind a single RAID box which would provide access for your computer over IP or FC depending on the type.

To get a real petabyte of base 2 usable storage you would need 546 2TB drives.  The whole setup including racks and power would weigh 1400kg or 3100lbs.  It would also consume 12kVA of power spitting out 39KBTU/hr of heat.

546 drives is for a PB of raw storage though.  In reality you would need to protect it from drive failures using RAID.  If we go for as littlle overhead as possible we can create 24 disk RAID 6 sets which would have about 40.4TB useable storage each.  For this we need about 600 drives which adds another 100kg to the weight.  Still about 1/180th of the weight of a PB just 30 years ago.

Has the Internet ruined our surprises?

Apple, Information, Technical, , ,

gift2

Like a few other thousands of people around the Internet I have payed close attention to the E3 briefings going on down in Las Vegas this week and it got me to thinking.

As I watch the live streams of the Microsoft, Sony, and Nintendo briefs most of it seemed very familiar to me, due to the fact that most of the “announcements” had been leaked or rumoured for the past few weeks leading up to E3.

In today’s digital age we are hungry for up to the minute information on whatever topics and trends that interest us, but does some of this come at a cost?

Part of the thrill of watching the briefings held annually at E3, CES, and Apple’s events is seeing what new things ideas, projects, and innovations are in our futures. Now a good part of that thrill seems to be gone thanks in part to message board posts, tweets, and inside sources.

Now I know its human nature to want to know every secret right away, but in a way it reminds me of the days leading up to Christmas and seeing the present under the tree with your name on it and wondering what it could be. I think Part of the joy of Christmas morning was going through those secretive bundles one by one and the excitement of uncovering what is inside.

In short I’m starting to feel that knowing what’s going to happen before the event is like opening a gift to yourself. No matter how good it is, it pretty hard to feel that rush of excitement.

Let me know what you think. As always I can be reached at jparie@gmail.com.

Wall Warts Are Like Socks

Gear, Information, Technical, , ,

200px-Wall_wartWall Warts is a slang term used for power supplies (wall transformers) and are the little brick-like devices that come with almost every electronic device. So why do I say they are like socks? Well, like socks, they seem to lose their mate and you end up wondering where it belongs.

Socks have a habit of getting lost for a period of time (typically around laundry day) but eventually show up and can be reunited with it’s mate (or one that looks similar). The same can’t always be said for wall warts. These are the ones that have no identifying information about where they belong and to make matters worst, may actually have a plug that would fit a number of devices. The fact that the plug fits, means it could supply the wrong power (voltage, current, polarity, AC/DC) and possibly destroy your device. (See AllElectronics.com for some examples of wall warts.)

This is a problem I’ve seen for years and I thought manufacturers were getting better identifying their products. Just the other day I bought a Maxtor 750 GB OneTouch4 external USB drive and it came with a small power supply. On the power supply was this information: “Sunny Switching Adapter; Model: SYS1308–2412–W2 … OUTPUT: +12V 2.0A …” It also showed a symbol indicating that the center connection was positive. The back of the Maxtor OneTouch drive had no voltage or polarity information so if I was trying to match up this power supply to it’s mate, I would be taking a gamble if the plug just happen to fit. This power supply uses a very common power connector and I know it’s fits at least four other devices that I own. I wonder how many devices have been destroy because the wrong power supply was plugged in? Would you take the time to research the power requirements of your device before plugging in an unknown wall wart if the plug fit?

I’ve developed products before and totally understand why manufactures do this. They develop a product that uses a common power source (i.e., +12V DC, 1.0A, positive center) and order an off-the-shelf power supply from China. It cost more to private-label the power supply, so they decide against it to keep down the cost. There is nothing stopping a company from offering a power supply with the same power connector but with a different power output (i.e., +5V, 0.5 A, negative center) and shipping that with a different consumer product. The consumer is the loser when he/she tries to mix and match loose wall warts and with their tech toys.

I do see a trend that I think may help. It’s the move to USB. More manufacturers are using the fact that the USB connector supplies a standard 5.0 VDC at 0.5 Amps. I said I think it may help because a lot of newer USB devices need more than the 0.5 Amps supplied by a standard USB connector (my Zune requires 1.5 A and my Android G1 phone needs 1.0 A). At least you have a fighting chance and may only damage (overheat) the power supply if your device needs more juice.

I would love to see manufactures label their power supplies to help out the consumer. I can’t believe printing and placing a sticker on the power supply to identify the manufacturer before they ship the product would be that costly.

I make it a habit to add a label to every wall wart before I start using the device. I have a Brother P-touch labeler and find it’s very handy (and fun) for things like that. I even add labels to wall warts that has been re-branded because I generally find the information is too generic (i.e. Maxtor) or hard to read when I’m looking to remove a power supply from a power strip under a desk with very little light. (I won’t mention that I have aging eyes too.)

Another reason I do it is because it’s a nice feeling knowing I’m organized. It’s wonderful seeing that little label showing me my Android G1 power supply after digging it out from under a foot-high stack of papers and unpaid bills.

73’s, Tom