The Heartbeat Bug in OpenSSL (It doesn’t affect SSH)

Thank goodness (see the post by nix); it’d be quite a hassle to reissue keys for git and SSH:

For a change, SSH is unaffected, since this is an SSL/TLS-layer bug, not a core crypto code bug.

Fortunately I only host a handful of services that use the affected versions of OpenSSL. It is recommended that if you are doing anything mission-critical you shut down these services and firewall them immediately. Then reissue new certs for every service(s) after you patch everything up.

Edit: I’m seeing a flood of updates coming in for Ubuntu today (2014/04/08). Basically anything linked with with libopenssl will eventually be updated.

More information [heartbleed.com]

What is heartbleed? [serverfault.com]

Project Updates

Software Projects

  • I halted production on Atomic (cross-platform Campfire Client) as a result of 37signal’s change in product direction.
  • Since I already had a production-ready logo for Atomic, I am going to use the Atomic branding on Eve Task Manager.
  • Eve Task Manager (now Atomic) is coming together nicely, but I do not have time yet to do list announcements. It takes a lot of time to get those emails together, and the demo isn’t ready for an official announcement.

Engineering Projects

  • My aerospace simulator project is stopped because I found a combination of current packages to model flight dynamics that works well enough. I am using Celestia, Orbiter, SpaceEngine and X-Plane. I will return to this problem at some point to integrate a newer simulation model to this software, then wire it into a simulated cockpit.
  • The production QJ jet engines are ready for prototyping, but the cost of additive manufacturing for the scale tests using Alloy 713C is expensive. I may have to use cheaper materials in the first runs.

Switching Back to Evernote

I considered DokuWiki these past few weeks. However after transcribing each of my notes to DW, it was apparent how slow this would be to work with on a regular basis. The biggest pain point was not being able to easily clip articles anymore. Also, hosting a local webserver for it takes up a lot of memory and battery life

If you’re concerned with security, organization, or platform-specific issues on Evernote and considering switching to a wiki, you may want to reconsider it; using a personal web-based Wiki for anything feels disruptive.

I now have all my notes back into Evernote and used a new Stack/Notebook/Note structure to handle Evernote’s arbitrary hierarchical limitations. I keep all of my interests, dev, platform, and projects neatly in their own stacks. Nearly every child notebook has an index, general reference and TODO list. It’s a workflow that I developed in the process of moving everything back and forth.

Ultimately, refactoring all my notes helped me prune old data and refine my ideas and personal projects.

wikidpad

WikidPad on OS X Mavericks is Hopelessly Broken (For Now)

WikidPad, despite its rich feature set has been sadly eluding my workflow. The personal wiki-editor is cross-platform, secure, and includes autocompletion, search and export. Unfortunately there are some issues keeping me from replacing Evernote on OS X Mavericks.

Current Status

wxPython is required for WikidPad. The wxPython 3.0.0 pkg file is not signed, so you’ll have to install it from the command line in order for it to work on Mavericks.

sudo installer -pkg wxPython-3.0.0.pkg -target /

There’s a wxPython formula for brew. I’ve tried countless times to get the following to work:

brew install wxmac

This just does not work with my environment and the patches were a waste of time for me. I’ve removed brew, reset my env paths, and used the installer package. Sample wxPython programs now run fine, and WikidPad will launch, however not without issues.

Errors

Here’s what is shown in stderr:

2014-02-04 09:52:34.307 Python[8902:d07] CoreText performance note: Client called CTFontCreateWithName() using name ".Lucida Grande UI" and got font with PostScript name ".LucidaGrandeUI". For best performance, only use PostScript names when calling this API.
2014-02-04 09:52:34.308 Python[8902:d07] CoreText performance note: Set a breakpoint on CTFontLogSuboptimalRequest to debug.
09:52:35 AM: Debug: No accel key found, accel string ignored.
09:52:35 AM: Debug: Unrecognised keycode 0
09:52:35 AM: Debug: In file /BUILD/wxPython-src-3.0.0.0/src/osx/window_osx.cpp at line 2706: 'RegisterHotKey' failed with error 0x00000016 (Invalid argument).

 

 

And in the error log, there’s not a lot of hope:

 3 Version: 'wikidPad 2.1_01' Session start: 2014-01-30 14:23:07
 4 Traceback (most recent call last):
 5 File "/usr/local/lib/wxPython-3.0.0.0/lib/python2.7/site-packages/wx-3.0-o sx_cocoa/wx/_core.py", line 16767, in <lambda>
 6 lambda event: event.callable(*event.args, **event.kw) )
 7 File "lib/pwiki/WikiHtmlView.py", line 418, in _scrollAndThaw
 8 self.Scroll(self.deferredScrollPos[0], self.deferredScrollPos[1])
 9 File "/usr/local/lib/wxPython-3.0.0.0/lib/python2.7/site-packages/wx-3.0-o sx_cocoa/wx/_core.py", line 16712, in __getattr__
 10 raise PyDeadObjectError(self.attrStr % self._name)
 11 PyDeadObjectError: The C++ part of the WikiHtmlView object has been deleted, attribute access no longer allowed.

Symptoms

  • The main window will never refresh. Clicking the close button or creating a new Wiki are the only features that appear to work. The options menu will only open on 2.3b11, but no other version.
  • Opening the options menu in 2.3b11 will trigger an error: ‘XRC error: unknown font family “normal”‘. Numerous font warnings will appear in stderr. Changing a font brings up the same errors and warnings.
  • Any text you write into the Wiki editor will be captured and displayed the next time you launch it, however the main window will never refresh.
  • Any current version past 2.1 of WikidPad will do this (even the RCs).
  • Earlier versions do not run because of errors related to wx initialization.

Mitigating the Problems

Because of the font warnings, I assume that the error trapping for font warnings (shown above in stderr) are causing the python wrapper for wxWidgets to halt. I changed all the fonts in settings to “Tahoma” and tried again.

I can now type in the edit box and the interface responds, but now with an unacceptable amount of lag.

I’m hoping that someone searching for this will know more than I do about the wxPython stack. At the moment I can’t spend anymore time on diving into the issue (I’ve never used wx, either,)  but perhaps sheds some light.

Addendum: And As Usual…

I’d like to add that this isn’t meant to insult any of the WikidPad developers. Platform issues are an enormous headache. If anyone has a fix I will submit a patch and attribute credit.

Neo900 hit its funding goal

The Nokia N900 was (and still is) my favorite phone. To this day I can compile modern programs for my N900 and run them as I would on a desktop. The messaging center was also quite impressive, and it consolidated all your conversations into a single app which could be extended at will with new chat protocols. You can also add custom repositories to install common Linux applications like OpenOffice, Chromium and more. Since it was powered by Linux, you can easily run Python and bash scripts, schedule cron jobs, run apache, use X11 forwarding, and do a slew of other things you’d never expect on a phone. It was like a server in your pocket.

I had heard about the N900 a few years too late, though. After my iPhone 4 broke I stumbled upon it and became absolutely fascinated. I bought one online, but I didn’t realize at the time that all of the “new-in-box” phones that sold on eBay were actually reproductions made in China. A week later I was having antenna issues and some of the hardware components (particularly the stand and camera cover) began falling off. In addition, the phone was released for the 2G network, so browsing was relatively slow. Modern SaaS companies also aren’t releasing applications for it. So if I recall there are no recent official Facebook, Twitter, Instagram, and Dropbox applications for it.

I still have my N900 but as soon as the Neo900 ramps up mass production I plan on getting my hands on one.

http://neo900.org/

Updates all across the board

  1. The response to Atomic is amazing. I am nervous to send my first update to all the people who have signed up. Some of you left very wonderful notes and I starred each of those in gmail of these as a reminder of why I am doing this project. Thank you.I would like to announce that the software is stable and running on Windows, Linux, and even Mac! So I will be releasing a Mac version as well, which you may prefer over the existing Jive client.My absolute highest priority with Atomic is reliability: no crashes, no loss of tasks, no annoying bugs, bullet-proof business logic. Secondly is feature set. Unsurprisingly, visuals come in last place for the pre-release and it looks hideous right now. I’m waiting to finish both the auto-update and some of the skinning before I announce a pre-release version to the wonderful people who signed up already.This will be a free product, but if you are interested in accelerating development I would graciously accept donations (Verified PayPal: evesoftware@gmail.com). And just like any crowdfunded project there are rewards: over $1 gets a credit in the about section on the site and app, anything over $10 gets a link to your site, and $250 gets your organization a special sponsorship link with logo and all. You can contact me for details. If I can offset just $8,000 of dev costs in donations I will even open the Github repository and make this Task Manager a fully Open Source project!
  2. I’m about to reorganize the site to make it more obvious which projects are in development and which were released.
  3. I have a copy of Christian Grobmeier’s book now, the Zen Programmer (a big congrats and thank you to the author!), so I plan on taking a deeper look on the philosophy behind his original blog post. I’ve skimmed through it briefly and the effort and polished editing is very obvious. His book is based on the post I previously responded to the other day.

This next point cannot fit in a list item but I am running into relentless dependency issues on my open source Flight Simulator project. Such a time sink. I have spent so much time writing build scripts and refactoring chunks of C++ code in order to make flexible cross-platform builds. And guess what—these builds don’t even work on Windows or Mac! They actually never did, but I didn’t notice because I was only working in Linux at the time.

Just to give you the scale of the project, it took me more time to write out a long post on the Cubespheres than it did to actually implement them in Irrlicht. But it took over 26 times the number of commits, plus more hours to learn the intricacies of various graphical engines, write dynamic build scripts to accommodate and statically link them (using premake) just to find that gcc would fail to compile them on different machines. This undermines the whole point of what I was trying to do. So I’m not including external libs in my FOSS projects anymore, with the exception of External Vessel Dynamics Simulator (EVDS) as this is integral for the physics simulations and has never given me any problems on any build.

The former problems are probably related to the large number of dependencies and platform-dependent code from statically linking everything, so given the new direction I will likely I will switch back to OGRE since it has better shader and other baked-in features that I would have to arduously recreate in Irrlicht.

OpenMW

I took a look at Open Morrowind years ago and it seems like the project has come a quite a far way. If you’re a big fan of The Elder Scrolls 3: Morrowind, this is pretty neat: a group of coders recreated the entire game engine. Their goal is to make it work on Windows, Mac and Linux, and to make it better looking than the original. If you still have your Morrowind data files you might want to check it out.

The big change since I last looked at it, though? They changed from D to C++. All the dependencies (listed on the FAQ page) are also platform-independent and are very tolerant to unusual and low-end hardware. I would love to see if this compiles and runs well for the Beagleboard or Raspberry Pi. Maybe something even smaller, like my Nokia N900 phone which runs Maemo (a full Linux-based operating system.)

Re: The 10 rules of a Zen programmer

My response is to the original post found here: The 10 rules of a Zen programmer.

Some preface. I’m a big fan of reading. On  slow days I can get through around 250 news articles, scientific journals, white papers and blog posts. Some of them deal with space, AI, technology, and algorithms, surrealist fantasy or humor, or pieces about lifestyle and workflow. I’m very careful to first cultivate articles that grab my interests. Today for instance, I read about positive results in the quantum superposition of very large particles that are subjected to the dual-slit experiment. I also read an extremely down-to-earth article that solidified what I knew about Fourier transforms. I try to keep the signal-to-noise ratio as high as I can. But even so, a lot of signal eventually turns to noise, and I get particularly excited when my jaded eyes come across one piece that sticks out above the rest.

I am not going to comment on each rule the author Christian Grobmeier touches on, who already does a great job expressing in the article. You should read his article first. Just like the title suggests it is tailored loosely towards programming and Zen Buddhism (of which Grobmeier practices,) however the author does not mandate or imply you have to be a programmer or spiritual for these rules to apply to your life. I would recommend the reading regardless of your beliefs, occupation or skill set.

Just as a disclaimer: I know next to nothing about Zen outside of what was mentioned in this article, so forgive me if I make improper assertions. I am also using bullets because these points do not actually correlate with the enumerated rules that Grobmeier lists in the article; I am just collecting and commenting on themes I have noticed throughout. Here goes:

  • If it’s worth doing, it’s worth doing right. Christian didn’t use these words, but he expounds upon this dad-like maxim with several additional concepts. Firstly, he explains that if your job detracts from your life—and that is to say if you have a job that you dread and gives you no opportunity to grow, and you are also one of privilege that can find a new job that has more positive qualities—you may just want to consider finding a new job. At the same time, when you are tasked with something you hate, try not make a scene over it. “[Zen monks] have stuff to do like cleaning the toilets. Or working in the garden. Or as a Tenzo, they cook.” The key part is in the next sentence: “They do it with all the care they can get. Whatever they do, they do it without suffering and they are (or should be) happy, because every second, even the second where they are cleaning toilets, is a second of their life.” Even the simplest of jobs done with great care. That is a great theme.
  • Focus, intent. If you need to work, work. If you need to sleep, sleep. Both are important, and you should never mix the two. Don’t work 12 hours and then go back to work 6 hours later on little sleep. If you are falling asleep at your job you might want to go home and rest. When you are working, though: focus. Working for you may entail constant interruptions from phones, chat messages, notifications. This is not focus. Focus with a deep passion like it’s your first day of your new job. Focus on one task as if what you are doing is your magnum opus. Focus like what you’re doing is more important than checking your Instagram feed.
  • Death of the ego. This is a common theme in some theological and meditative practices. By meditating you increase your awareness of the direct interconnectedness of everything. You become more empathetic, and less selfish. This isn’t just some new-age trend. Meditation is healthy for you. We’re finding it might even make you less of an asshole. Western culture can be very competitive rather than collaborative, so maybe try to work meditation into your routine. Fierce competition in society is very poignant and evocative of some of the culture today. It is important to note that peaceful cooperation usually tends to lead to a higher rate of success and lower stress all around. (Aside: I know I have another article supporting this but cannot find it at the moment, sorry.)
  • Awareness. Every word you say and action you take has a consequence. Someone who is especially aware can carefully craft their work in a way that is artful and strikingly beautiful. Act on this awareness by doing everything with care, as I mentioned earlier.
  • Flow. Situations change. People lose their jobs, people are born, people die. You are not excluded. Accept it as part of the flow, and be less concerned and caught up about the transient. Especially things that you cannot control. This does not mean “do not mourn” or “do not be sad”, but be more accepting of the highs and lows (and the possibilities of future highs and lows) of day-to-day, year-to-year life.

One last point that I’ve extrapolated from this article: be aware of the beauty and sacredness around you. Grobmeier expresses this in a charming way, first briefly flirting with Nihilism and then bringing you right back to the serenity of Zen:

“You live alone and you’ll die alone. World goes on, even without you.”

“A flower is beauty. But it’s just a beauty (sic) flower – nothing more. There is nothing special around it. You are a human who can program. Maybe you are good. There is nothing special around you. You are of the same kind as I am or all the others on this planet.”

“After (hopefully) a long time you will die and everything you have created will be lost. Even pyramids get lost, after a long time. Do you know the names of the people who build up a pyramid? And if you do, is it important that you know? It’s not. Pyramids are there, or not. Nothing special.”

“Don’t be too sad when the winter comes and don’t be too happy when spring comes back. It is just a flow.”

The exact opposite of the rat race. The antithesis of leaving a legacy, of being the top person in your field or being famous. Grobmeier accepts the flow, the inevitability of life and death. But Grobmeier is ok with it. That sounds pretty Zen.

Edit: Moments after posting this I found several other comments debating the use of the word Zen and some of the concepts discussed within the article. So take this post as a derivative of the original and understand that I am not interested in arguing the semantics. As with anything your encounter take it all with a grain of salt.

Also, drastically and absolutely adhering to any life philosophy comes with its own set of exceptions and caveats (no one actually does that, do they?)  So I found the original article both positive and inspiring and that is why I wanted to share it—even if others will continue to debate the accuracy of details on the internet it does not discredit the original work at all, in my mind. Cull the good from it. Cheers.

Visualization for the TR-1 Computing Block – Pragmatic vs. Ideal

This weekend I’ve been looking into getting the visualization component of the TR-1 computing block up and running. It is a third of the avionics computer block.

Computing Block Diagram

It’s 2am so there may be inaccuracies in this diagram.

I’ll focus more on the gray blocks on another time. These are the safety-critical systems that handle the main avionics, poll for input and so forth.

The visualization system highlighted in purple will be responsible for presenting data to the astronaut/pilot in a way that does not interfere with the safety-critical systems. We have a lot of flexibility here since it will be receiving mostly raw data from the neighboring systems. So let’s just start with some basic options:

  1. Using FreeDOS we can poll the serial buffer using a loop and refresh the heads-up-display with new sensor data. DOS has some limits (namely VGA video) however we won’t run into any hardware issues and it boots really fast. FreeDOS runs very well on x86 architecture, but don’t expect anything beyond a very simple interface of lines and text. (There’s nothing wrong with that though, and this type or architecture is still being used today and is expected–just take a look at INPU.)
    150-14
  2. Using a trimmed-down Linux kernel image, we can boot to a shell in around 300-600ms. However this has to be optimized specifically for the target hardware. This is easier said than done; the hardware aboard the ship will need to be resilient to radiation and bit-flopping, and target hardware hasn’t been fleshed out yet. The benefit with Linux, however, is power. A the preemptive Linux kernel patch can provide hard real-time support to improve timing to other interfaces. We have support for OpenGL to allow for better visuals. Furthermore we can even run common hypervisors or application containers on top for research, logging, and even more advanced visual feedback for pilots.

This is the battle of pragmatic vs. ideal. FreeDOS would yield a quick and easy set-up for visualization components whereas Linux may give us the opportunity to provide better pilot feedback with a more modern and intuitive interface.

mapping program

My Progress

I’ve focused more on #2 listed above. By trimming down a Linux kernel image I may be able to get near-instant boot times that I’m seeking. I’m currently at 28 seconds to boot fully to desktop, and I want to be closer to 2s. I named this milestone “2 seconds to cube” because I wanted to push the on button and see a rotating 3D cube in openGL running inside a window manager. This would make me confident that this system could be mission-capable. As mentioned before, though, this is heavily dependent on hardware configuration and so it can be profoundly difficult to support multiple targets.

Why is this so critical then? Well, in the case of a full system restart I don’t want the visualization system–that is, the thing that’s giving the pilot their primary point of reference for internal systems–to take that much longer than the safety-critical systems handling life support, guidance, and more.

I’ve noticed others’ success at getting instant-boot in Linux using minimalist hardware, so I’m falling back to other endeavors at this point. Namely designing the visuals in the final system, which will work independently of the Kernel. My new goals are to consolidate which sensor data will be used, establish a common API, and then find a way to present this data in a coherent and safe way.