Python: Select from True/False

I just ran across this neat technique while reading wxPython in Action- A common operation is to output a string based on some expression being True or False. Being an assembly programmer at heart I usully code it as something like this:

if borked:
 print "Its Borked"
else:
 print "Its not Borked Yet"

In 'C' you can do this:

borked ? "Its Borked" : "Its not Borked Yet"

An alternative way in Python is to do it like this:

borked and "Its Borked" or "Its not Borked Yet"

The expression is evaluated from left to right and it returns the result of the and if both are true, or the result of the or if the and fails. In Python instead of returning True for 'borked and "Its Borked" it returns the 2nd object, a string in this case, which is exactly what you want if borked is true. When it is false it goes on to the or expression and returns "Its not Borked Yet"

Productivity for Programmers, #1: Trusted Systems

Bob Walsh and Matt Cornell have an excellent post over at MyMicroISV. They talk about 5 systems that every productive programmer needs to have in their toolbox:

• Task System
• Decision Logs
• Version Control
• Code Snippets
• Your Bugs

Personally, I use a combination of Trac, Subversion and Gtodo.

This is the information I've been waiting for - NIST is going to have a competion for a new secure hashing standard. For a year or so there has been information that the SHA-1 hash has been 'broken', I have been waiting for Bruce Schneier's take on the issue:

The hash function you're most likely to use routinely is SHA-1. Invented by the National Security Agency, it's been around since 1995. Recently, though, there have been some pretty impressive cryptanalytic attacks against the algorithm. The best attack is barely on the edge of feasibility, and not effective against all applications of SHA-1. But there's an old saying inside the NSA: "Attacks always get better; they never get worse." It's past time to abandon SHA-1.

You can read the rest of his essay from Wired here at his blog.

Secure Remote Filesystems

Accessing files on remote systems can sometimes be a big pain in the ass (BPITA). You can use Samba to mount filesystems, but that means setting up a Samba server on the remote system and being susceptible to security problems. There is an alternative, called SSHfs that uses SSH to mount the remote filesystem as if it were a local directory.

In Ubuntu it is easy to get working:

sudo apt-get install sshfs
sudo joe /etc/modules
Add fuse on a line by itself
sudo modprobe fuse (only needed to get it loaded now)
sudo gpasswd -a username fuse
newgrp fuse
mkdir ./mnt/remote
sshfs user@remote.system: ./mnt/remote/

Now your remote account's files are accessible right there on the local system, via a secure link. This works for the MAC as well, if you install MACfuse and Secure Remote Disk.

Unmount the remote filesystem using the unmount command:

fusermount -u ./mnt/remote

This is better than Samba because you are using secure link to transfer the data, it is less complicated and therefore less likely to be compromised than Samba. Building on top of things that do 'just 1 thing' is the Unix way and is a large part of why Unix systems and programming practices are more secure and more flexible than those you see with primarily GUI centric systems.

wxPython

Back in July I wrote that I had settled on pyGTK as the cross-platform development tool for me. Well, I've change my mind a little. With pyGTK you don't get the native 'look-and-feel' on other systems like Windows and MAC. This isn't a problem for me, but for normal users it makes the program appear amateur. Good news, though! The wxWidgets project provides a cross platform C++ environment that uses the native widgets for each platform. And, there is a python project, wxPython, that integrates nicely with it.

So, now I can develop cross platform applications, using my favorite language (Python) and they will look like native applications, keeping the natives happy.

Petals Around the Rose

Here is a fun little brain teaser that took me about an hour to figure it out. Bill Gates took longer, but didn't have the advantage of looking at a series of previous rolls (he memorized his). The answer to the roll above is 2.

Chaos Manor Reviews

One of my favorite writers, Jerry Pournelle, has been publishing his Chaos Manor column in Byte Magazine for darn near forever. It was one of the first magazines I subscribed to in High School and only gave up the subscription after Steve Ciarcia moved on to create Circuit Cellar Ink. Jerry has one of the first 'blogs' at his www.jerrypournelle.com site and I have been reading that for years now -- well before there were such things as 'blogs'.

CMP, the owner of Byte, has finally pulled the plug on it and now Jerry and some of the other columnists from Byte are running their own site at Chaos Manor Reviews. Its worth checking on a daily basis, as is the main Jerry Pournelle site.

pyGTK for Cross Platform Development

I've been debating the pros and cons of various development environments, from VC++ 6 to the new C# Express from Microsoft to MinGW with GTK+ or wxWidgets. I've finally settled on Python and GTK+ and Glade as the best choice.

This wil provide me access to the massive Windows client base while retaining my love for Linux and elegant designs. Python allows rapid application development, can be packaged up as only the compiled python code for distribution and can be optimized by writing processor intensive sections in c and linking them in.

That said, I now need to go write some code.

Grokking the source

Back in the 'good old days' if you wanted to tweak a program on your system you downloaded the source from the author (if you hadn't already), made your changes and were done. It isn't quite as straightforward these days.

I'm trying to tweak cpufreq to idle down the CPU when the laptop lid is closed. Normally that would be a good use of the acpid event system. Execpt that my lid only generated an even when its closed, not when it is opened back up! So I'm going to add an option to cpufreq to check the lid status in /proc/acpi/button/lid/LID/state and when its closed set the CPU to its minimum frequency. Should be easy, right?

Nope. Not when you are running Fedora Core and their modified version of cpufreq. Apparently their startup script passes it a nice level (-n ). This wouldn't be so bad except that it gets passed by the daemon function and doesn't appear in my debugging echos. Arrgh.

So, I guess I'll do things the 'redhat way' and create a new diff for my changes and rebuild it as a rpm.

Progress? Maybe. But I'm starting to feel like a unix curmudgeon.

ssh and the GNOME Desktop

As much as I hate the bloat of the GNOME desktop, I tend to use it on most of my machine. Its easier than trying to maintin something else. I also use openssh extensivly, and normally have a shell or 10 open to different machines. My laptop is seutp to run a backup once a day to one of these remote machines, it uses rsync over ssh so I have to either enter my password (hard to do in a script launched from cron) or the ssh agent needs to have the key loaded.

The easy way to do this is to have it ask you when you login. This is really easy to do:

Go to Desktop->Preferences->More Preferences->Sessions->Startup Programs

Click on 'add' and enter /usr/bin/ssh-add then click on close. Log out and back in and you should have a dialog asking you for your ssh password.

Now if I could just convince Firefox and Thunderbird to use ssh-agent for their authentication...

.cp

Microsoft Windows Kill Switch?

I came across this article over on Bruce Schiener's blog. Apparently Microsoft is refusing to respond to reporters valid questions about WGA and the possibility that they may be able to disable your system sometime in the near future.

As we have mentioned previously, as the WGA Notifications program expands in the future, customers may be required to participate. [emphasis added] Microsoft is gathering feedback in select markets to learn how it can best meet its customers' needs and will keep customers informed of any changes to the program.

No trunc() in VC++ 6?

I must be too used to Linux, where the world makes sense. It appears, unless I am totally missing something, that VC++ doesn't have the 'standard' rounding functions like trunc() and round()!

Here's the MSDN floating point page, and they are nowhere to be found.

bloggunity test

Here is a link to use for the test

Sometimes things do 'Just Work'

and contrary to popular belief they aren't always Microsoft Products. I reinstalled XP on a desktop the other day (so I can do some cross-platform pyGTK programming). Its a plain-jayne Celeron 2.9GHz machine that I picked up on sale at Tiger Direct a few months back. Wouldn't you know it, XP hasn't got a clue as to how to install the Audio drivers. After digging about for a considerable amount of time I finally came up with the motherboard CD and got that working.

Then I tried DVD playback, I wanted to watch Firefly while cleaning my guns. I had bought a $15 license for a Sonic DVD codec when I bought WinXP online. I downloaded the package from Sonic (I had printed out the instructions so I knew it was right!). The darn thing didn't work! Windows Media Player still says it ain't got a clue as to how to play the DVD.

Under Linux I use Xine to play DVDs, but it hasn't been ported to Windows. But Mplayer has. Ironically I can never get mplayer to work properly under Linux. On Windows it was a different stopry entierly. I downloaded the Windows pre-compiled binary and a full load of codecs. Unzip the binary to c:\ and the codecs into the c:\mplayer\codecs directory. Then run mplayer dvd:// from a command window and off you go!

Now I have a clean gun and Windows XP that can play DVD's without having to bother with those damn closed apps that won't even work with your legal license. So how do I get my $15 back from Sonic?

Islamist Hackers Target Michelle Malkin

According to Michelle Malkin the peace-loving Islamist movement has been trying to take down her blog, probably because she has been showing those horrible disgusting cartoons of their so-called prophet. Look at the cartoons and compare them to some of the things that have been drawn and displayed about the Christian faith in recent decades.
If Christians were as 'peace loving' as the Muslims appear to be we'd have had riots in the streets 20 years ago over crosses dipped in urine and paid for with tax-payer money. But we didn't.

Think about that.

Watch those old scripts

There's a popular perl script for processing web forms into emails. It has some checks to make sure it cannot be used to send spam. Except that it didn't check enough.

The Subject form field can be exploited to send a spam message by sending a subject, followed by a \n and then the headers and body of a spam message. This has been fixed in this version. But the subtag field may still be used to explot this script (maybe, I haven't tried it).

So, it pays to go over what you are posting on your webpage, especially if it was written by someone else.

Backwards compatibility?

One of the great features of Unix is that the small apps that you use to build applications change very slowly, if at all, over time. ESR makes the point in "The Art of Unix Programming" that programs should maintain compatibility. Well, I guess that's no longer true. I'm trying to build some rpms for one of my projects and both tar and rpmbuild no longer work the same way they did a year ago (yep, the code is stable and I haven't built a new release in over a year).

tar has changed how 'strict' it is about accepting arguments like --exclude. It used to handle it fine if they were at the end of the argument list. No longer. And rpmbuild is barfing on the Copyright: entry in the .spec file of all things.

I really, really dislike fighting with my tools. Especially on Unix which has historically been the most stable and reliable of the OSes.

Its the Code Stupid!

New blog on the block, subjects will be limited to writing code and code related issues, especially cryptograpy and security.