What Cookies are set by this Site?
This blog is a web site, within the meaning of the EU cookie law. It uses cookies. As such, it is governed by regulations set forth by the Information Commissioner's Office. What cookies are used here, and why?
Google Analytics
...is a web service provided by Google, Inc. Google Analytics sets a cookie in order to evaluate how visitors find and use the web site. This feature does not collect any personal information about you. I occasionally browse the reports generated by Google Analytics in order to to evaluate just how devastatingly unpopular my blog is.
Cookies from the Blog
...which resides on the Google-owned blogger.com platform. Blogger.com sets various cookies related to that service. I don't control the dissemination of the cookies set by the blogger.com platform, except for the Google Analytics cookies explained above.
Dog Biscuit's Trading Pages
If you visit my archived Yes & Led Zeppelin bootleg trading site, some of your search preferences will be saved by cookie for your next visit. The information saved in this cookie never leaves your browser. In fact that entire site comprises nothing but static HTML pages and a bunch of exclusively client-side JavaScript; there is no server component (yes, the entire database is in that script).
I am certainly not using cookies to gather information about your browsing habits or to push advertisements at you. If you have reason to think you picked up a tracking cookie here, it might mean I've been hacked; please contact me, for example by leaving a comment on a post - anonymously if you prefer.
This has been a public service announcement made necessary by a directive of the European Commission, confusing a worthy goal (securing web users' privacy) with a particular technology (cookies).
Wednesday, 30 May 2012
Saturday, 12 May 2012
Caring and Sharing
Who knows what possessed my friend Scale This! to seize on this particular tweet of mine, immortalising it through the medium of ceramic mug?
And What Is Truth?
In the perceived software development wars between academic ideals and commercial pressures, the first casualty, according to the ingenious definition supplied by Alfred Tarski, is unlimited satisfaction.
My first CS tutor at university, in a 1976 introductory lecture, first stressed the need to make every program solve "in some sense" the maximum possible set of problems, before going on to say Hello World in FORTRAN. Contrast that with the philosophy behind some of today's popular industrial methodologies - Agile, Test and Behaviour Driven Development - where the stated goal is to write just the minimum amount of code satisfying strictly delineated requirements.
The trouble with the lean and sparse approach is just that, assuming we know what we're doing, we do tend to design complicated systems in a modular way, ideally using plug-in replaceable components. These components need to have readily discoverable characteristics, specifications, and interfaces; they should not be capable of surprising us. In an audit scheduling application, a control for selecting a date should never be constrained to use only future dates, on the justification that audits can't be scheduled for the past (and support for past dates would require extra coding effort in the control implementation).
Evolution
Finding the happy medium can involve a certain degree of oscillation. In the early days of our company, I and others championed the idea of a Code Gallery, holding chunks of reusable Delphi; for example, utilities for date, string and other data types, or controls such as hierarchical combo boxes. For various reasons - including a span of years spent developing just a single app! - there was never a great deal in that gallery. Most of what there was, was never in fact shared with a second project.
Source control arrived, and one fine day when my back was turned, the Gallery disappeared! Absorbed whole into the repository of our flagship product. It was impossible to protest, as by then the Gallery had come to be seen as merely a mechanism allowing code sharing across projects, and this clearly wasn't happening. Personally I thought the reduced visibility of Gallery code, which was nonetheless applied across multiple disparate modules of that single app, to be an unfortunate mistake, effectively precluding any notion of testing other than the black-box kind. A more prominent Gallery, I felt, might have encouraged more unit testing, more component-level integration testing, and eventually perhaps (step 2: "?"), better modularity and re-usability (Profit!).
Departments, portfolios and personnel all change. Today we have an internal review group tasked to investigate matters like these. One new developer in particular has done much, using not only his ridiculously popular and now-famous dynamic slide shows, but more importantly his own experience of design methods, code review, sharing and reuse, to begin once again promoting awareness of our roles as both producers and consumers of each other's output. This is a good time for our department!
And What Is Truth?
In the perceived software development wars between academic ideals and commercial pressures, the first casualty, according to the ingenious definition supplied by Alfred Tarski, is unlimited satisfaction.
My first CS tutor at university, in a 1976 introductory lecture, first stressed the need to make every program solve "in some sense" the maximum possible set of problems, before going on to say Hello World in FORTRAN. Contrast that with the philosophy behind some of today's popular industrial methodologies - Agile, Test and Behaviour Driven Development - where the stated goal is to write just the minimum amount of code satisfying strictly delineated requirements.
The trouble with the lean and sparse approach is just that, assuming we know what we're doing, we do tend to design complicated systems in a modular way, ideally using plug-in replaceable components. These components need to have readily discoverable characteristics, specifications, and interfaces; they should not be capable of surprising us. In an audit scheduling application, a control for selecting a date should never be constrained to use only future dates, on the justification that audits can't be scheduled for the past (and support for past dates would require extra coding effort in the control implementation).
Evolution
Finding the happy medium can involve a certain degree of oscillation. In the early days of our company, I and others championed the idea of a Code Gallery, holding chunks of reusable Delphi; for example, utilities for date, string and other data types, or controls such as hierarchical combo boxes. For various reasons - including a span of years spent developing just a single app! - there was never a great deal in that gallery. Most of what there was, was never in fact shared with a second project.
Source control arrived, and one fine day when my back was turned, the Gallery disappeared! Absorbed whole into the repository of our flagship product. It was impossible to protest, as by then the Gallery had come to be seen as merely a mechanism allowing code sharing across projects, and this clearly wasn't happening. Personally I thought the reduced visibility of Gallery code, which was nonetheless applied across multiple disparate modules of that single app, to be an unfortunate mistake, effectively precluding any notion of testing other than the black-box kind. A more prominent Gallery, I felt, might have encouraged more unit testing, more component-level integration testing, and eventually perhaps (step 2: "?"), better modularity and re-usability (Profit!).
Departments, portfolios and personnel all change. Today we have an internal review group tasked to investigate matters like these. One new developer in particular has done much, using not only his ridiculously popular and now-famous dynamic slide shows, but more importantly his own experience of design methods, code review, sharing and reuse, to begin once again promoting awareness of our roles as both producers and consumers of each other's output. This is a good time for our department!
Sunday, 6 May 2012
Meeting Music Heroes
Pen pal Murray Easton recently posted his recollection of buying Gary Manny "Mani" Mounfield (Stone Roses, Primal Scream) a lunchtime pint in 1999. It's a good read, definitely getting across that joy of meeting one of your true life heroes - who turns out not only to be a good guy, but in Murray's words, to exceed your expectations.
Now, I'm never going to try to one-up Murray; he does run his own music management company, after all! But that read prompted me to copy into this blog, from various other places, descriptions of a few times when I've managed to meet up with my own personal musical heroes, and more particularly, when I've bought them a drink...
Bitter Medicine
Name: John Fiddler
Band: Medicine Head
Venue: Strathclyde University Students' Union, Glasgow, 1976
Drink: Pint of Bitter
Before the gig I found a well-moustachioed John sitting entirely unmolested in the Beer Bar, chatting with his bandmate Peter Hope-Evans (Medicine Head were a duo at this time), and nursing a pint of bitter. Uncharacteristically un-starstruck, and yes I may have had some Dutch or other national courage, I casually asked if they'd like another. John accepted, Peter declined. Assuming they were settling pre-performance nerves, I naturally and respectfully left them alone just as quickly as I'd arrived.
This was an odd gig. Despite the fact Medicine Head were universally known for the quite slow, blues-influenced gentle rock and sway and Jew's harp of their singles, John kept insisting on telling everyone to get up and "dance like an idiot, go crazy!" Two girls at the front and centre of the performance area (there being no stage) duly obliged all night, but it seemed like everybody else just wanted to continue sitting on the floor, drinking their beer, smiling broadly, and smoking something with quite a sweet perfume. "Medicine Head" indeed.
Orange L
Name: Steve Hillage
Band: (ex-Gong)
Venue: Strathclyde University Students' Union, Glasgow, 1977
Drink: Fresh Orange Juice
Another somewhat unremarkable encounter, though at the time quite thrilling indeed. Though the air was every bit as fragrant, I remember the crowd being quite a lot more active than the Medicine Head massive, and doing a lot of their dancing horizontally, under the discarded coats at the back of the room.
Hurdy Gurdy Glissando was a wee bit spectacular in the small room setting. Some of us got the chance to tell Steve so afterwards, over some fruit juices.
Yes - Sorry About the Shirt
| Alan White! |
Band: Yes
Venue: Playhouse Theatre, Edinburgh, 2003
Drink: Brandy (for Chris, served in a pint of beer)
| Rick & me! |
Our favourite bass guitarist was first at the bar, followed soon by Alan, Rick, and Steve. All were more than happy to talk to the fans, pose for photos, autograph programs and so on. Rick was his usual convivial self. Alan is the nicest chap on the planet. Steve joined in just as much as anyone, though for a somewhat shorter time. And when we offered Chris a drink, he studied the gantry for a minute, selected a good brandy, then promptly poured it into his pint! Ah, the hectic lifestyles of those crazy rock'n'roll kids...
(From http://jmkerr.com/db/Yes_2003.htm)
The Two That Got Away
Also in 2003 - I've waited almost a decade to publish this, out of respect for my heroes' privacy - Linda and I took her mum with us on a caravan holiday in Embo. And just like this April, we all took a day trip from the east coast to the west, and Ullapool, augmented as then by the obligatory Achiltibuie scenic route. Having spent a terrific afternoon on the sunny beach there, we were driving along the single track road to the village when I got distracted by a little green car, a left hand driven Citroën (or was it a right hand Morris Minor?) speeding towards us. As we stopped to let it race past, I suffered the illusion of its prescription windscreen magnifying the golden tresses of Robert Plant, surrounding his wide grin, beaming and waving to us from the passenger seat.
We drove on to the Post Office, where I sat dazed and... speechless. That was Robert Plant, I eventually managed to squeeze out. Rubbish! explained Linda. Who? added her mum from the back.
Later, driving back toward the main road, I continued belabouring the assertion we'd just passed the original Golden Rock God™ on a Highland dirt track. Then rounding a corner where the road widens temporarily, we passed a black limousine, with smoked windows and the registration ZL7, heading the other way, followed by an entourage of assorted vehicles. I swear I heard music pounding, and peering briefly through the windscreen, discerned the unmistakable outline of Jimmy Page in the middle of the back seat.
Reflexively I spun the car around, racing them back to the little deserted beach where we'd just spent our afternoon. We arrived at dusk. Planet Zeppelin converged in that place that day, celebrating the release of their new DVD. There was music and merriment and naked dancing and whisky and every flavour of sex and drugs and did I mention sex. I'd brought my guitar with me, and later that evening, gave Jimmy some advice about that tricky Stairway opening...Actually the only U-turn I made was into fantasy fiction at the previous paragraph. That year I'd decided to bring my mother-in-law instead of the guitar; we were in no shape to gatecrash an all-night wild beach party. The rest of the journey back to our Embo caravan was... I'd say, inconsolably quiet.
Monday, 30 April 2012
My Work in Print: 1987
Previously: 1985
DISZ80 - a Z80 Disassembler
Delighted today, to receive a comment from Geoff Wearmouth on that previous Personal Computer World: Sub Set article. Geoff it was, who first typed my 1094-byte Z80 disassembler DISZ80 into a Sinclair Spectrum some quarter century ago. His site http://www.wearmouth.demon.co.uk/ gathers Sinclair ZX Spectrum ROMs, as well as emulation tools for the related ZX80, ZX81, and the eternally awe-inducing Jupiter Cantab Ace.
Geoff's own Spectrum Globeplotter, featured in The Register Hardware's Basic Instinct last week, and itself more than a quarter century old, proves us to be PCW stablemates. Whilst presented as a BASIC listing, this spinning-sphere-transpoising, sinusoidal-Mercator-projecting screen plotter actually employs untold amounts of custom crafted machine code.
Some ten years ago, Geoff made appeals in comp.sys.sinclair for any further information about PCW back issues. And just today, Stephen Parry-Thomas of http://jupiter-ace.co.uk/ has replied, with full scans of Sub Set from February-May 1987. At last, the extensive line comments can be restored to my crusty old utility!
February 1987
Click to big. In "Z80 Radix Conversion" David Barrow starts off with CONVHL, which is used at various points within the main disassembler to convert 16-bit integers to various bases (binary, octal, decimal, hex) for readable output. He remarks upon the "quite ingenious" optimised method used to convert raw digits to ASCII.
I remember being quite happy with the way David had split out the various modular components of the program. Publishing these in multiple datasheets over several months resulted in a steady stream of payments, giving a pleasant illusion of gainfully paid employment!
March 1987
March saw the publication of routine XTRACT, designed to read and print strings from a table. As David correctly notes, this too is pathologically storage space optimised, for both code and data table size.
April 1987
The I/O fest continued in April with a set of five connected utilities dealing with the output of hex data and addresses. This is the point at which David, having correctly diagnosed my space optimisation compulsion, shows where I could have saved one program byte, two stack bytes and 14 clock cycles. Though 25 years later I've still to validate the assertion, respect for David's manifest expertise compels me to believe it, albeit truculently.
May 1987
The May edition was given over to just the two remaining big routines, spread across five new datasheets / appendices, and completing the 1094-byte Z80 disassembler.
So, once again: hooge thanks to the guys, Geoff Wearmouth and Stephen Parry-Thomas, who got these page scans to me - I do hope you'll both understand and forgive the indecent haste with which I've posted them here.
Try It Out!
Finally, Geoff's just been in touch again to tell me that DISZ80 is actually live online, and has been for years, embedded in his ZX Spectrum Emulator. How cool is that? Click here to run it. I just tried it out using Internet Explorer 8, 64-bit (!) version. Click the "screen" then press Enter for instructions. The Disassembler itself can be disassembled (!!) by typing the address $5100 then pressing Enter. The code you see starting at that address is actually the DISZ80 entry point, as illustrated in the first of the May 1987 pages above. Mind = Blown!
DISZ80 - a Z80 Disassembler
Delighted today, to receive a comment from Geoff Wearmouth on that previous Personal Computer World: Sub Set article. Geoff it was, who first typed my 1094-byte Z80 disassembler DISZ80 into a Sinclair Spectrum some quarter century ago. His site http://www.wearmouth.demon.co.uk/ gathers Sinclair ZX Spectrum ROMs, as well as emulation tools for the related ZX80, ZX81, and the eternally awe-inducing Jupiter Cantab Ace.
Geoff's own Spectrum Globeplotter, featured in The Register Hardware's Basic Instinct last week, and itself more than a quarter century old, proves us to be PCW stablemates. Whilst presented as a BASIC listing, this spinning-sphere-transpoising, sinusoidal-Mercator-projecting screen plotter actually employs untold amounts of custom crafted machine code.
Some ten years ago, Geoff made appeals in comp.sys.sinclair for any further information about PCW back issues. And just today, Stephen Parry-Thomas of http://jupiter-ace.co.uk/ has replied, with full scans of Sub Set from February-May 1987. At last, the extensive line comments can be restored to my crusty old utility!
February 1987
I remember being quite happy with the way David had split out the various modular components of the program. Publishing these in multiple datasheets over several months resulted in a steady stream of payments, giving a pleasant illusion of gainfully paid employment!
March 1987
April 1987
May 1987
So, once again: hooge thanks to the guys, Geoff Wearmouth and Stephen Parry-Thomas, who got these page scans to me - I do hope you'll both understand and forgive the indecent haste with which I've posted them here.
Try It Out!
Finally, Geoff's just been in touch again to tell me that DISZ80 is actually live online, and has been for years, embedded in his ZX Spectrum Emulator. How cool is that? Click here to run it. I just tried it out using Internet Explorer 8, 64-bit (!) version. Click the "screen" then press Enter for instructions. The Disassembler itself can be disassembled (!!) by typing the address $5100 then pressing Enter. The code you see starting at that address is actually the DISZ80 entry point, as illustrated in the first of the May 1987 pages above. Mind = Blown!
Sunday, 29 April 2012
April in Embo
Photo Essay: Easter Break Snaps
Look mum! The sand's back.
Eek! A periscope.
The Russians have been watching this place for years.
Home from home: the new Linnhe caravan (6-8), introduced just this year. With sun deck! (Sun not included)
Look at those bananas. Just look at them.
The neighbours.
This is the life.
Some nice weather.
Garden fence conversation.
Handy for the beach.
Moody, broody, old North Sea.
The old pier, no longer accessible - officially. Thanks, HSE!
The view towards Portmahomack. Wonder if we'll ever find that lighthouse?
More neighbours: the Loch Fleet seals basking at low tide.
Dornoch International Airport.
Windsock action closeup.
Dunrobin Castle, Golspie.
Grounds.
More grounds.
Still more grounds.
Clynelish Distillery.
Clynelish Distillate!
Day trip to Ullapool.
Encore en route.
High art concept shot!
Are you lookin' at me?
Are you lookin' at me?
Arrival at sunny Ullapool.
The obligatory scenic diversion to Achiltibuie.
More scenic ridgery.
We found it! It's in Tarbat Ness (we love lighthouses).
Photos copyright © 2012 by Linda Kerr, except those containing Linda, which are copyright © 2012 by me.
Friday, 13 April 2012
Tri-State Logic in C#
First, a Story About Trees
Certain friends and colleagues, asking me about the origin of my "Stanislaw" Facebook persona, have already been introduced to the shady night dweller "Stanislaw the Philosopher". Found in and around 1980 sweating over some maths and engineering textbooks in the wee small hours, listening to Mike McLean Through the Night on Radio Clyde, and occasionally sending in record links in the form of unbearably awful puns. Like this:
On another occasion, Stanislaw the Philosopher posed a riddle from Raymond Smullyan's book of logical puzzles, What Is The Name Of This Book? The hardback book itself was sent to the radio station as a prize. Stanislaw then sent in the correct answer under the guise of his good friend Tom, who was subsequently baffled to receive such a book, from a radio station he never listened to, as a prize in a competition he'd never heard of.
But Seriously...
This whole confession is prompted by Eric Lippert's blog Fabulous Adventures in Coding, and in particular by today's entry, null is not false, part two. Eric starts off by using Dr Smullyan's deductive logic puzzle books to introduce the concept of multi-valued logic systems, including the nullable boolean. This 3-state scheme has the possible values: true, false, and null.
The rules of null are quite straightforward and obvious, if you think of replacing it everywhere with "unknown". So for example in arithmetic, we would have
So, the operators && and || are not "lifted to nullable". That seems a shame! I'd have preferred the alternative way out of that dilemma, where we allow nullable overrides of these operators, and simply replace the pair of statements
Certain friends and colleagues, asking me about the origin of my "Stanislaw" Facebook persona, have already been introduced to the shady night dweller "Stanislaw the Philosopher". Found in and around 1980 sweating over some maths and engineering textbooks in the wee small hours, listening to Mike McLean Through the Night on Radio Clyde, and occasionally sending in record links in the form of unbearably awful puns. Like this:
The king's gardener feared for his life. Long and hard he had toiled in the royal grounds, trying desperately to make the castle's fir trees thrive in the dry, dusty and too-barren earth. Nothing would work to save them. And now that his life was forfeit, he had begun to see ghosts during his nightly rounds. One of these came up to him, holding forth a small cloth pouch, and saying "These are the droppings of the kestrel hawk. Lime for this climate, bone for these flora. You must feed it to their roots, one and all. For either you and they shall die, or else neither."
The gardener did as he was bid. Three nights later, walking through the grounds in the dark of an otherwise still night, he now sensed those trees rising up before and around him, moment by moment blocking off a little more of the violet horizon. Was this truly and solely an imagination? Then too, he began hearing something wholly unaccustomed and chilling on the air, what was that sound? The raising of a distant breeze, the creaking of old bones and branches, the arrival of some new monster unseen?
Or kestrel manure firs in the dark?
On another occasion, Stanislaw the Philosopher posed a riddle from Raymond Smullyan's book of logical puzzles, What Is The Name Of This Book? The hardback book itself was sent to the radio station as a prize. Stanislaw then sent in the correct answer under the guise of his good friend Tom, who was subsequently baffled to receive such a book, from a radio station he never listened to, as a prize in a competition he'd never heard of.
But Seriously...
This whole confession is prompted by Eric Lippert's blog Fabulous Adventures in Coding, and in particular by today's entry, null is not false, part two. Eric starts off by using Dr Smullyan's deductive logic puzzle books to introduce the concept of multi-valued logic systems, including the nullable boolean. This 3-state scheme has the possible values: true, false, and null.
The rules of null are quite straightforward and obvious, if you think of replacing it everywhere with "unknown". So for example in arithmetic, we would have
X + null = null,which translates as the self-evident "Anything plus unknown, equals unknown." Now in our 3-term logic,
false AND Y = false,since whatever the second term might represent (including null), the first false makes the expression false. But this also implies that
X AND false = false,which can be a problem for computer languages featuring short-circuit boolean evaluation. Eric considers the cases of the C# operators && and ||, which are specified as strictly short-circuiting operators, and asks the question, how should we evaluate
X && Ywhen X is null? The truth table gives unambiguous answers: false if Y is false, otherwise null. But to obtain that answer we had to violate the specification that Y is only evaluated when X is true. Eric closes by saying "...either we sometimes evaluate Y when we shouldn't, or we sometimes return a value that does not match the value that X&Y would have produced. The way out of this dilemma is to cut the feature entirely."
So, the operators && and || are not "lifted to nullable". That seems a shame! I'd have preferred the alternative way out of that dilemma, where we allow nullable overrides of these operators, and simply replace the pair of statements
In the expression X && Y we evaluate Y if and only if X is truewith
In the expression X || Y we evaluate Y if and only if X is false
In the expression X && Y we evaluate Y if and only if X isn't false
In the expression X || Y we evaluate Y if and only if X isn't true
Sunday, 18 March 2012
SharePoint "Vulnerable by Default"
Even the Scroll Bar Can't be TrustedHere's how to steal sensitive information from users of either SharePoint or LinkedIn, via their web browser.
The method, known as frame sniffing, is unlike a conventional SQL Injection or cross-site scripting (XSS) attack, in that no code need be injected into the site. Instead, a target website crafted within the attacker's malicious webpage is simply loaded into a hidden HTML frame, once the CMS user is tricked into browsing to that page by any of the usual, socially-engineered means (e.g., spam email). As long as the user then keeps that tab open, the attacker can frame-sniff, for example running SharePoint searches exactly like an authorised user.
Paul Stone & Jacobo Ros describe the vulnerability in their video, and present some sample exploits, including a proof of concept that you can run for yourself, at the Context Information Security site:
http://www.contextis.com/research/blog/framesniffing/
Surprisingly, the attack works because often the default configuration of the CMS omits to secure against browsers which allow framing. The approach bypasses browser security restrictions intended to prevent webpages directly reading the contents of third-party sites loaded in frames. At the time of writing, only Mozilla Firefox has been updated to prevent frame sniffing.
Installations that are vulnerable by default include SharePoint 2007 and 2010. The vulnerability is easily stomped by tweaking the X-Frame-Options, forcing browsers to disallow framing on critical configuration server pages, or other pages that require an “authentic user click” - as previously described by Microsoft's Eric Law in his (two year old!) IEInternals article, Combating ClickJacking With X-Frame-Options. Obviously, since this setting will prevent SharePoint from being framed, it might break your installation, for example if you have another intranet app using SharePoint via a frame.
Good news: Microsoft have stated that the X-Frame options should be correctly set in the next version of SharePoint. Bad: at the time of writing, LinkedIn have yet to respond to Context's vulnerability report.
Subscribe to:
Comments (Atom)






