ACCU Security Conference 2009

Let’s take the leader of Colossus reconstruction project, the author of The Code Book, the original creator of the PGP e-mail encryption package and horde of people as hungry of knowledge & fun as a bears of berries, and what you get?

ACCU :: Security: Yesterday, Today, and Tomorrow

You get ACCU :: Security: Yesterday, Today, and Tomorrow conference:

On November 7th 2009, the ACCU will be holding a one day conference at Bletchley Park, home of the legendary World War II ‘Enigma’ code breakers, and the site at which the world’s first digital computer went operational.

The event is put on the official calendar of events in Bletchley Park – National Codes Centre. It’s also announced by ZDNet.

By the way, who knows about the crucial role of the Polish Cipher Bureau and Polish mathematical geniuses in breaking Enigma? I can bet that many people still believe in this story which follows principles of canonical Hollywood education.

I think one of the things we need to make clear to Hollywood is, yes you’re in the entertainment business but the people who see your movies are going to come away thinking that’s information, not just entertainment.

By the way, I’ve read on ACCU forum that one of the speakers will probably talk about new his VoIP protocol and why his protocol spanks all other VoIP protocols as well as the effects of public policy and living in a surveillance society. The conference is going to kick!

Online Compilers

Sometimes I need to compile and run a tiny snippet of C++ code. For example, I want to proof some concept or I want to give code example while chatting with friends. Sometimes I don’t have access to good compiler. If I’m logged to irc.freenode.net, it’s not a problem – geordi is there. I’ve just found a Web-based alternative – codepad.org. It is a pastebin service that can compile, validate and execute your code.

Hello World!

Portability poem

Meaning of PortabilityNumber of OSGeo stack software written by C/C++ camp have to run on Microsoft Windows systems. I think I wouldn’t be dead wrong if said that most of hackers from OSGeo Community work on Unix systems (Linux, Mac OS X) but there is large number of users who work on Windows.

Conclusion? Portability. Google is bursting at the seams of the essays about how to write portable code in C or C++ language. I’d add a little poem to the collection.

Principles of Portability

  • Obey the standards, because they are not just dumb rules.
  • Make a list of compilers that must be supported. Learn about their differences.
  • If possible, use GCC 4+ and Visual C++ 7.1+.
  • Using old compilers? If possible, use C89 but avoid C99.
  • Prefer GCC 4.3 and Visual C++ 8.0+, so you get C++0x support. C++0x “brings C++ more in line with the C99″ – Wikipedia, so portability is much easier.
  • Write code in C or in C++, but do not write both at the same time.
  • Avoid (direct) use of C POSIX Library.
  • Never ever disable any warnings compiler throw. Fix them.
  • Be pedantic. Compile in highest strict mode possible.
  • If possible, do not use compiler-specific features.
  • Do not make platform/architecture specific assumptions about memory addressing, memory layout, etc.
  • First understand why, then cast the hack.
  • Personal preferences are evil. Make decisions based on reasoning.
  • (Re)Use good code that already exist. Boost C++ Libraries won’t bite you!
  • KIMS (Keep it modular, stupid) and let modules to loose coupling but keep cohesion in architecture, design as well as in development cycle (releases, inter-modular dependencies).

Be strict or…

…you may have to eat the C++ programming language standard (may be with the C one together, brrr) half-baked or even raw.

GEOS 3.0.0 does not compile using GCC 4.3.3. The compiler complains, surprisingly, about missing functions like std::memcpy (GEOS core is written in C++, not C):

DoubleBits.cpp: In static member function 'static double geos::index::quadtree::DoubleBits::powerOf2(int)':
DoubleBits.cpp:51: error: 'memcpy' was not declared in this scope
DoubleBits.cpp: In constructor 'geos::index::quadtree::DoubleBits::DoubleBits(double)':
DoubleBits.cpp:94: error: 'memcpy' was not declared in this scope

StringTokenizer.cpp: In member function 'int geos::io::StringTokenizer::nextToken()':
StringTokenizer.cpp:75: error: 'strtod' was not declared in this scope
StringTokenizer.cpp: In member function 'int geos::io::StringTokenizer::peekNextToken()':
StringTokenizer.cpp:123: error: 'strtod' was not declared in this scope

These functions come from the C/C++ Standard Library, so how they could be missing? They are because the files reported above do not include standard header <cstring>. GEOS 3.0.0 had used to compiled using GCC without problems, what happened? GCC is just being aligned to the standards closer and closer, so it becomes strict and unforgiving.

There is a lot of C/C++ code of FOSS written in sloppy way being compiled in relaxed mode without use of strict compilation flags. Having in mind number of bugs reported after GCC 4.3 was released, I presume dark clouds are coming again with just released GCC 4.4.0 and upcoming 4.5.0. It’s always a good idea to not to trust chain or implicit inclusion of standard headers – wherever std::malloc is used <cstdlib> must be included, same about std::vector and <vector> and so on.

By the way, this particular bug in GEOS was spotted using GCC 4.3, reported, patched and fix was released as GEOS 3.0.3.