Bojan

Weekly breakdown – 22w36d2

Programming

https://utcc.utoronto.ca/~cks/space/blog/programming/CAPIsEffectsOfMalloc

Important reminder to anyone writing C APIs and for the ones learning to use it.
It is also major source of security and stability issues when not handled correctly.
As a helpful guide when writing complex C APIs:

  • Explicitly define ownership of handled memory AND memory lifetime in API documentation
  • Always sanitize and check for correctness input parameters to API
  • Provide both at least one happy-case and multiple negative examples for using the API before any release
    When writing them, try to ask yourself what you would ask Stackoverflow 🙂
    This will help you understand usage patterns

    Note: The easiest part is to create an API, the hardest is to change it in production.

https://thephd.dev/c23-is-coming-here-is-what-is-on-the-menu

Finally the C language it getting proper modern ‘face-lift’ that will potentially help and alleviate bunch of manual work and increase quality of written code.
Lets see if it will fizzle-out, or it will gain traction (looking at you, compiler vendors 😉 ).

https://docs.google.com/document/d/16B36r0HksR0LqQAGLA1syYCtZvYaVC0hEF2D00ZAd0o/view#

Highly informative document for anyone switching between C and C++ and pitfalls of using same or similar approaches from one language into another.

https://luckyresistor.me/knowledge/learn-cpp/

To anyone interested in learning C++, with focus on usage in embedded environment.
Good comments especially valid to all related constraints and best practices for embedded implementation.

Fun

https://matthewbilyeu.com/blog/2022-09-01/responding-to-recruiter-emails-with-gpt-3

Fun use of GPT-3 to automate ‘handling’ of recruiter messaging 🙂

BojanLeave a Comment on Weekly breakdown – 22w32d1

Weekly breakdown – 22w32d1

Programming

https://nnethercote.github.io/2022/07/27/twenty-years-of-valgrind.html

For the ones writing low-level and/or in ‘unsafe’ languages, Valgrind is one of the tool suites to use regularly.

Linked text from one of the creators of Valgrind provides brief of its interesting history, and more importantly, links to high quality papers describing how Valgrind actually works under the hood and is able to to what it does.

Note that Valgrind is not the only good tool that Nicholas and Julian have made.

Security

https://arstechnica.com/information-technology/2022/07/researchers-unpack-unkillable-uefi-rootkit-that-survives-os-reinstalls/

This is expected development since obfuscation-as-a-security method failed spectacularly in hack of Intel Management Engine in the motherboard chip-sets.

News

https://www.bloomberg.com/news/articles/2022-07-25/porsches-postponed-by-buggy-software-cost-vw-s-ceo-his-job

One of the first big names in car industry to be ‘eaten’ by software.

As all modern car manufacturers are moving to become software first company, they are also learning hard lessons that:

Current state of software engineering is less engineering and more craftsmanship, with all its implications on quality, planning, timelines and ‘manufacturing’.

The software craftsmanship is a separate topic for another day 🙂

BojanLeave a Comment on Weekly breakdown – 22w28d2

Weekly breakdown – 22w28d2

News

https://www.theguardian.com/news/2022/jul/10/uber-files-leak-reveals-global-lobbying-campaign

Expected news for the ones that have followed news and shenanigans around Uber.

It also blatantly shows how easy it is and what can be done with influence and money even in the first-world countries.
For better-or-worse, lets hope that ‘limitless’ growth-first VC money dries up, and actually moves to profitable AND people-helping industries.

Bonus links:
https://marker.medium.com/how-the-uber-economy-is-killing-innovation-prosperity-and-entrepreneurship-7222982cd457
https://www.innovationaus.com/uber-concedes-deception-prepares-for-26m-accc-spanking/

https://www.nytimes.com/2022/07/11/technology/elon-musk-twitter-damaged.html

Expected lose-lose news for anyone involved in the destined-to-fail Twitter deal.

The onion covered it good 🙂
https://www.theonion.com/elon-musk-tries-to-back-out-of-twitter-deal-by-deleting-1849169663

https://www.smartcompany.com.au/startupsmart/analysis/atlassian-unprofitable-valuation-adam-schwab/

Atlassian continues with its slide into the red.
After recent little-to-say-embarrassing outage of some of their cloud products, there might be more rolling behind the scenes.

On a personal level, I actually prefer Redmine as more usable (but not modern) UX compared to Jira as a white-space hog.
And there are newcomers that are already using perfect storm to disrupt Attlasian.

And on a funny Jira note 🙂 https://ifuckinghatejira.com/

BojanLeave a Comment on Weekly breakdown – 22w24d3

Weekly breakdown – 22w24d3

Automotive

https://fortune.com/2022/06/10/elon-musk-tesla-nhtsa-investigation-traffic-safety-autonomous-fsd-fatal-probe

The more cars Tesla sells, the more issues will be found, and not just technical ones.

It is hard to escape law of large numbers and Gaussian bell curve, especially the more organization grows.

And the below quote paints potentially damning decision how ‘Autopilot’ functionality handles itself in accident situations.

(really short rant ahead)

In general terms I consider Elon Musk as a quite smart guy with extremely good sales and marketing talent.

But sales is usually selling features that are not (yet) there and/or overblown capability of existing functionality.

Just look at the naming of ‘Autopilot’ feature of Tesla cars with actual level 2 autonomy.
If you check the meaning of level 2 autonomy, ‘Autopilot’ is in no way autonomous and ‘auto’ as the name strongly suggest.

Heck, Tesla has been already surpassed by Mercedes and Honda with limited, but legally approved level 3 automation mode, where the car manufacturer is actually responsible in case of accident when it is enabled and running in command.

Old-school car manufacturer juggernauts are slow (some will crash and burn), but will eventually catch-up and overwhelm Tesla unless it comes up with something radical, and so far nothing is announced.
And if it we’re, Musk is famous for over-promising and under-delivering on those, for those who follow.

And the famous Tesla bots will not be able to help it.

But I have been wrong, and it will be fun to watch 🙂

Fun

https://www.tomshardware.com/news/working-lego-computer-brick

Make your own fully functioning Lego computer block 🙂

BojanLeave a Comment on Weekly breakdown – 22w22d3

Weekly breakdown – 22w22d3

Security

https://kenkantzer.com/learnings-from-5-years-of-tech-startup-code-audits/
Highly distilled and valuable knowledge about security and securing software from-first person audit experience.
Anyone who is interested in improving security (and everyone should) should at least glance through.

https://www.zerodayinitiative.com/blog/2022/5/18/pwn2own-vancouver-2022-the-results
Notable results:

– Sandbox escape on Tesla Model 3 Infotainment System – Important due to fact that significant amount of car information is consumed, but also produced by the infotainment system, possibly leading to much significant compromise of safety relevant components of a car

– Sandbox escape on Microsoft Teams – Important due to enormous presence of Teams in high variety of companies due to free(ish) model included in Office suite.

https://www.feistyduck.com/bulletproof-tls-newsletter/issue_89_certificate_transparency_data_is_used_to_compromise_wordpress_before_installation
How security improvement can have not-so-good side-effects when setting up your standard WordPress (or other web apps) installation.

https://www.lightbluetouchpaper.org/2022/01/19/security-engineering-course/
https://www.lightbluetouchpaper.org/2022/03/18/security-course-at-cambridge/
Free quality lectures going through fundamentals of security and hands-on approach on gaining security experience. And students from few countries can apply for course access in full and free.
Best learning is when you get your hands dirty 🙂

Funny

https://rubenerd.com/git-ignores-gitignore-with-gitignore-in-gitignore/
Sort-of-recursion 🙂

BojanLeave a Comment on Weekly breakdown – 22w20d2

Weekly breakdown – 22w20d2

Security

https://research.nccgroup.com/2022/05/15/technical-advisory-tesla-ble-phone-as-a-key-passive-entry-vulnerable-to-relay-attacks
https://duo.com/decipher/researchers-demo-relay-attack-against-bluetooth-le-systems
More and more successful real-life attacks will happen on Bluetooth protocol features unless additional layer of security is used.

Even though security was thought of when Bluetooth was originally introduced (year 1998.), state of security considerations and possible attacks were not the ‘most important’ items on the list. Further improvements resolved some problems, but fundamental issues with the protocol itself cannot be solved without breaking backward compatibility.

As one of the speakers at EU Tech Chamber session about IoT vulnerabilities last year, I had luck to listen to presentation from Maximilian about broken fundamentals in Bluetooth standard.
Just check KNOB Attack how easy is to manipulate Bluetooth key negotiation to reduce attack space.

Artificial intelligence

https://www.nature.com/articles/d41586-022-00858-1
AI is becoming more and more important tool in all kinds of applications.

For any application that touches safety, security and actual real-life implications, it should be paramount to understand why AI system came to the specific conclusion, something like a train-of-thought.
.
Imagine (near) future situation when (it is not if) autonomously driven car causes an accident, it would be beneficial to have such kind of logs when investigating without complex proprietary technology needed for each car vendor.
Or imagine medical AI assistant decides that some person has some illness, the doctor should have information why it has deduced such conclusion. Sometimes AI assistant would be wrong, but sometimes it can actually remind doctor about different possibilities.

I would not be surprised, and probably it should be pushed for quite heavily, that some kind of legal framework is put on top of safety and security related AI systems in which they are required to produce something like standardized decision-tree for their actions or inactions.

Random

https://www.newscientist.com/article/2319584-computer-powered-by-colony-of-blue-green-algae-has-run-for-six-months/
With current prices of electricity, it is not not so far fetch idea to have your own pond of algae on stand-by, just in case 🙂

BojanLeave a Comment on Weekly breakdown – 22w19d4

Weekly breakdown – 22w19d4

New day, new assortment of links 🙂

Thanks to old colleague Ivica for always good comments.
And for C and C++ lovers and practitioners, in case that you still have not found his blog, please check it out at:

https://johnysswlab.com/

As someone who has written not-so-small number of C++ lines, there are million ways to write bad C++ code, but only a few correct ones.

Security

https://media.ccc.de/v/rc3-2021-r3s-216-practical-bruteforce-of-military-grade-aes-1024
When there is a will, there is a way.

IT

https://www.netmeister.org/blog/futurama.html
What Futurama character is your preferred language?

Law

https://writing.kemitchell.com/2022/04/30/Zelensky-Compound-NDA
‘Fun’ take on NDAs, even when its purpose is purposeless in real-life situation.

Games

https://thegamednd.com/the-game-out-of-game/
To the lovers of D&D games, a comment from my friend, summarized by one word: “WOW”

Random

https://bjoernkarmann.dk/occlusion-grotesque
Fun take on creating evolving typeface carved in the tree trunk and how it evolves through years.

BojanLeave a Comment on Weekly breakdown – 22w17

Weekly breakdown – 22w17

New week, new useful, interesting, or plain fun links found, at least for me 🙂

And also a way to offload and preserve good information stored in way-too-many Firefox tabs 🙂

IT

https://12factor.net/
Good and clean methodology breakdown how to approach software development for Web/SaaS apps, but most of the ‘rules’ are also applicable for all kinds of software areas, even all the way down to embedded (i.e. IoT devices).

https://www.potaroo.net/ispcol/2022-04/leogeo.html
On surface, TCP is ‘simple’ protocol. But depending on underlying network behavior, different configuration options and TCP congestion control protocols used can have enormous impact on your networks performance and throughput.
Link above tests different TCP CCP protocols with Starlink internet service with surprising results.
Check ‘Conclusions‘ chapter for breakdown.
Note: It could be fun experiment to test different CCP protocols in noisy 2.4 and 5 GHz environments and WiFi versions. And people are already thinking about it in 5G and beyond mobile networks.

ttps://securityzines.com/
Funny, yet highly informative graphic breakdown of different (mostly web oriented, but again, web is everywhere) security ‘bugs’ and help information.

https://spectrum.ieee.org/single-chip-processors-have-reached-their-limits
Where the future is already moving for the ASICs, since gigahertz fight has plateaued long time ago.

https://iansommerville.com/technology/research-impact/
Short, informative info about (sad) state of research impact in software engineering.
(Topic for another day, but my take on software engineering is that it is less engineering and more old-school apprenticeship)

https://greenash.net.au/thoughts/2022/03/i-dont-need-a-vps-anymore/
Short but useful information what to think about when wanting to setup your own web presence and server in current day and age from decades of experience.

https://www.system.com/graph
New approach to search and graph connection between terms and topics.

Sciences

https://www.jpl.nasa.gov/news/nasas-mars-helicopter-spots-gear-that-helped-perseverance-rover-land
Breaking: Helicopter spots extra-terrestrial ‘trash’ on Mars 🙂

https://interconnected.org/home/2022/04/05/dunbar
Informative breakdown of human social network sizes and its impact.
Companies (especially larger ones) could use extracts from available information to optimize different workflows: from meeting sizes and its effectiveness (magic number 5?), to sizes of complete ARTs (magic number 150?).

https://qchu.wordpress.com/2016/05/26/whats-a-fire-and-why-does-it-whats-the-word-burn/
If you ever wondered what fire is, in way more details that you need and even understand 🙂

Finance

https://www.ineteconomics.org/perspectives/blog/how-intel-financialized-and-lost-leadership-in-semiconductor-fabrication
One example of what happens when financial people take total control from engineers and push for shareholder and short term gains only through outsourcing, stock buybacks, lack of motivation for innovation, etc.
Same thing happened to Boeing and Sony.

https://devonzuegel.com/post/inflation-propagates-unevenly
One way of looking into inflation and its uneven impact.