frog707

[frog707]

Kaspersky and the human side

Following up on "Kaspersky and pride", here is the analysis of the social engineering side of the XZ backdoor exploit:

As both a maintainer of and a contributor to open-source software, much of the discussion quoted seems very familiar:

Complaints about the software release process being slow.

2. Complaints that the maintainer has lost interest or doesn't care any more.

#kaspersky #open source #software engineering #social engineering #xz #backdoor #complaints #apathy #isolation #psychology

[frog707]

Kaspersky and pride

Kaspersky Labs is a cybersecurity firm with headquarters in Moscow.

Here's their technical analysis of the famous XZ backdoor that Andres Freund (of Microsoft) discovered back in March:

It's a fascinating chain of coding wizardry.

The big question is: who was "Jia Tan", the person or team who planted the backdoor? An article in The Economist (which has an anti-Russia bias) amplified speculation that it was Russia’s foreign-intelligence service (while admitting "the evidence is too weak to nail down a culprit").

The Economist article ends by quoting Michal Zalewski: “The bottom line is that we have untold trillions of dollars riding on top of code developed by hobbyists.”

As an open-source software developer, I get a weird thrill from news stories about FOSS, even when the stories are alarming. Not that I've ever worked on anything as crucial as XZ or Log4j, mind you! But seeing an obscure subject (which I care deeply about) getting public attention ... causes me to feel better about my hobby.

Pride. That's what I'm getting at.

It's the same feeling I felt when saw a website URL on a billboard for the first time. This was in the mid-90s, when the World Wide Web was an obscure novelty that I happened to be studying. Seeing a company advertise its website validated my (professional) interest in HTTP servers.

#open source #software development #coding #computer security #xz #kaspersky #backdoor #linux #the economist #pride #my hobby

[frog707]

Coder challenge

If the source code lacks comments, how can you be sure setBuilder() isn't actually cake?

#is it cake #programmer humor #software development #comments #documentation #cake #epistemology #source code #coding #computer programming

[frog707]

The amazing spaghetti factory

Software development is the process that transforms an algorithm explained by a dozen lines of pseudocode into 498 lines of poorly documented C++ spaghetti.

#software development #software engineering #github #open source #coding #programmer humor #pseudocode #c++ programming #c++ #obfuscation #wikipedia

[frog707]

They got me, except maybe for snacks. It's impossible for me to snack enough to put a dent in my day.

truth 😂

#procrastination #programmer humor #snacks #napping #social media #webcomic #4 horsemen #four horsemen of the apocalypse #productivity #time management

[frog707]

rescued by RenderDoc (again)

Yesterday I reported my first experience with RenderDoc, the open-source graphics debugger.

Today I had another opportunity to use it. My Macana project was exhibiting a weird bug where sometimes a nearby object would disappear behind a faraway object. By analyzing a captured frame using RenderDoc, I deduced that something was unexpectedly disabling depth writes.

I'm not saying RenderDoc makes graphics debugging easy---I still struggle---but it beats breakpoints and print statements hands down.

#weird bug #free tools #open source #3d graphics #war stories #debugging #computer graphics #software development #rescue

[frog707]

Lots of good tips here.

 How to exclude and ignore files when using find command

#linux #tips and tricks #command line #finding #options

[frog707]

RenderDoc the block

Today I solved the blocking issue in my Macana OpenGL project. I did it using RenderDoc, an open-source graphics debugger suggested to me by a colleague.

Since I'm a complete noob at RenderDoc (and not very proficient at OpenGL either), it took me awhile to gain traction. I didn't use the tool very effectively. But the key virtue of a good debugger is that helps users visualize what's going on. Somehow in the flood of details, I noticed that my problematic texture (which didn't have mipmaps) used a filter intended for mipmaps. And that proved to be my issue.

Meanwhile, I'm making progress configuring my new Linux Mint environment. I finally got the Cinnamon panel (analogous with the Windows taskbar) configured the way I like. I must've spent hours; it seems to me the Cinnamon UI could be a lot more intuitive.

Also I discovered I had 2 copies of LibreOffice: one installed from Apt and another installed from Flatpak. I only need one copy, so I'm removing the older (Apt) install to free up disk space.

#disk space #opengl #debugging #open source #computer graphics #accomplishments #free tools #textures #panel #linux mint #libre office #flatpak #duplication #software development #user interface #uninstall #war stories #traction #weird bug

[frog707]

In transit

I recently decided to stop doing most of my work on a 12 year-old mini-tower desktop computer and rely more on the gaming laptop I bought in 2021. That transition is about 90% done.

Last month I re-partitioned the laptop's hard disk and installed Linux Mint. Then I began installing apps and copying over data and settings. Today I accomplished the crucial steps: going live with Thunderbird (e-mail) and GnuCash (financial records) on the laptop.

All day I've been feeling anxious and disoriented. I'll be tweaking settings and smoothing rough edges for a while, but it feels good to be "over the hump".

The laptop is quieter and has 10x more storage. Long-term, I expect the transition will be good for my productivity. I'm glad I didn't wait for the desktop suffer a major hardware failure; that would've added a lot of stress to the process.

#data migration #accomplishments #linux mint #open source #laptop #desktop computer #applications #transitioning #disorientation #anxiety

[frog707]

Close call

I'm glad the XZ Utils software back door was caught before it spread further: https://www.theverge.com/2024/4/2/24119342/xz-utils-linux-backdoor-attempt

#open source #software development #computer security #xz utils #backdoor #software engineering #news #linux #close call #github #crime #supply chain

[frog707]

Year 2

Wishing a very happy Easter to all who celebrate the holiday! (And a very safe World Backup Day to everyone else.)

Also, it's been a year since I launched this devblog, so it's retrospection time!

Tumblr works fine as a public journal, but I don't know many people here. I'm not a person who makes online friends easily. For connecting with people I've met IRL, I tend to use Facebook.

For discussing my JME-related projects, there's a Discourse forum that provides much better feedback. Most of my software development is still JME-related, and that's why my dev postings here are tapering off.

I'm fond of Tumblr and would love to get more feedback here. I realize this is a special-interest blog with a narrow focus, but even so, I'm surprised at how few reactions it's gotten. (My most-popular original post has 14 likes and 5 reblogs.) If there's something I'm doing wrong, or something I ought to do that I'm not doing, please clue me in!

Some more statistics:

I have 47 followers (thank you for tuning in!) and am following 57 blogs.

During the past year I've made 211 posts and given 2,873 likes. Of those, 139 posts and 1,751 likes were during the my first 6 months. Thus only 72 posts and 1,122 likes given in the past 6 months.

#metablogging #tumblr milestone #anniversary #statistics #facebook #retrospection #discourse #easter 2024 #backup #thank you

[frog707]

The linked article does a good job telling the story of Ethernet: where it came from, how it works, and where it might go next.

#ethernet #computing history #information technology #computer network #ars technica #ieee #xerox parc #switches

[frog707]

Those wise, old Javanese

Yesterday I discovered "Arrays of Wisdom of the Ancients", Aleksey Shipilёv's 2016 quest for the most efficient way to convert Java collections into arrays. It's a fascinating story. Aleksey explains why the conversion API is the way it is, then presents some counter-intuitive measurements.

Next he makes an important point about performance analysis:

At this point, most people make the major mistake: they run with these numbers as if they are the truth. But these numbers are just data, they don’t mean anything unless we extract the insights out of them. To do that, we need to see why the numbers are like that.

To gain such insight, Aleksey uses various profiling tools. After pursuing some related questions (which lure him back into the spiderweb-encrusted days of Java 1.6), he concludes by making another point I adore:

most of the time, the straight-forward code is fast enough, so stop philosophizing about angels on the head of a pin, and get back to work. 99.9% of applications do not need a dedicated team of performance engineers; they need instead for their developers to focus on writing clear, maintainable code, and a little bit of measurement and tuning to file off the rough edges when the code fails to meet the performance requirements.

Here's the URL, in case you want to read the original post:

#java #software engineering #coding #jvm #arrays #collections #wisdom #software development #performance #measurements #profile app #old news #tuning #computer history #efficiency #war stories #good enough

[frog707]

Chuck Jones is a vengeful god.

Engineering Hubris [Explained]

Transcript Under the Cut

[A trans-panel color background of the Southwest American desert.] Maybe engineering is the pursuit of an unattainable perfection. Maybe it's impossible to create something bug-free.

Maybe I'm a fool. Maybe the tyranny of Murphy is the penalty for hubris.

But I just can't shake the feeling

With all those supplies [Cueball standing on boxes labeled "ACME."] I could have caught that roadrunner.

#tools #acme #wiley coyote #road runner #xkcd #hubris #engineering hubris #webcomic #nerd humor #cueball

[frog707]

Old dog learns parsertongue

Yesterday I learned how to parse a JSON string in Java, using Google's gson library:

My immediate need was to search a "database" of 3-D models that happened to be in JSON format.

This is a neat trick, and I expect I'll find other uses for it in the future.

#json #java #open source #github #accomplishments #coding #google #database #3d model #new tricks

[frog707]

If in doubt about what to work on...

improve the documentation.

#software development #documentation #time management #technical writing #note to self

[frog707]

Keep your eyes on the code, your hand upon the (mouse) wheel...

Just go to YouTube, search "how do I start learning to code", and you'll immediately get a dozen 10-min videos telling you where to start.

But really, just sit down and build something.

#programmer humor #cartoon #you tube #the doors #self education #learning to code