Nov 16

NTPsec’s beta is released

You’ve heard me uttering teasers about it for months. Now it’s here. The repository is available for cloning; we’re shipping the 0.9.0 beta of NTPsec. You can browse the web pages or clone the git repository by one of several methods. You can “wget” to get a tarball.

This is an initial beta and has some rough edges, mostly due to the rather traumatic (but utterly necessary) replacement of the autoconf build system. Also, our range of ports is still narrow; if you’re on anything but Linux or a recent FreeBSD the build may not work for you yet. These things will be fixed.

However, the core function – syncing your clock via NTP – is solid, and using 0.9.0 for production might be judged a bit adventurous but wouldn’t be crazy. The next few beta releases will rapidly get more polished. Expect them to come quickly, like within weeks.

Most of the changes are under the hood and not user-visible. A few auxiliary tools have been renamed, most notably sntp to ntpdig. If you read documentation, you will notice that what’s there has been massively revised and improved.

The most important change you can’t see is that the code has been very seriously security-hardened, not only by plugging all publicly disclosed holes but by internal preventive measures to close off entire classes of vulnerabilities (by, for example, replacing all function calls that can produce buffer overruns with memory-safe equivalents.)

We’ve already established good relations with security-research and InfoSec communities. Near-future releases will include security fixes currently under embargo.

If you consider this work valuable, please support it by contributing at my Patreon page.

Nov 13

Why Hackers Must Eject the SJWs

The hacker culture, and STEM in general, are under ideological attack. Recently I blogged a safety warning that according to a source I consider reliable, a “women in tech” pressure group has made multiple efforts to set Linus Torvalds up for a sexual assault accusation. I interpreted this as an attempt to beat the hacker culture into political pliability, and advised anyone in a leadership position to beware of similar attempts.

Now comes Roberto Rosario of the Django Software Foundation. Django is a web development framework that is a flourishing and well-respected part of the ecology around the of the Python language. On October 29th 2015 he reported that someone posting as ‘djangoconcardiff’ opened an issue against pull request #176 on ‘awesome-django’, addressing it to Rosario. This was the first paragraph.


great project!! I have one observation and a suggestion. I noticed that you have rejected some pull requests to add some good django libraries and that the people submitting thsoe pull requests are POCs (People of Colour). As a suggestion I recommend adopting the Contributor Code of Conduct ( to ensure everyone’s contributions are accepted regarless [sic] of their sex, sexual orientation, skin color, religion, height, place of origin, etc. etc. etc. As a white straight male and lead of this trending repository, your adoption of this Code of Conduct will send a loud and clear message that inclusion is a primary objective of the Django community and of the software development community in general. D.

Conversation on that issue is preserved in the Twitter link above, but the issue itself in GitHub has apparently been deleted in its totality. Normally, only GitHub staff can do this. A copy is preserved here.

It is unknown who was speaking as ‘djangoconcardiff’, and that login has now been deleted, like the GitHub issue. (DjangoCon Europe 2015 was this past May/June in Cardiff.)

The slippery, Newspeak-like quality of djangoconcardiff’s “suggestion” makes it hard to pin down from the text itself whether he/she is merely stumping for inclusiveness or insinuating that rejection of pull requests by “persons of color” is itself evidence of racism and thoughtcrime.

But, if you think you’re reading that ‘djangoconcardiff’ considers acceptance of pull requests putatively from “persons of color” to be politically mandatory, a look at the Contributor Covenant he/she advocates will do nothing to dissuade you. Paragraph 2 denounces the “pervasive cult of meritocracy”.

It is clear that djangoconcardiff and the author of the Covenant (self-described transgender feminist Coraline Ada Ehmke) want to replace the “cult of meritocracy” with something else. And equally clear that what they want to replace it with is racial and sexual identity politics.

Rosario tagged his Twitter report “Social Justice in action!” He knows who these people are: SJWs, “Social Justice Warriors”. And, unless you have been living under a rock, so do you. These are the people – the political and doctrinal tendency, united if in no other way by an elaborate shared jargon and a seething hatred of djangoconcardiff’s “white straight male”, who recently hounded Nobel laureate Tim Hunt out of his job with a fraudulent accusation of sexist remarks.

I’m not going to analyze SJW ideology here except to point out, again, why the hacker culture must consider anyone who holds it an enemy. This is because we must be a cult of meritocracy. We must constantly demand merit – performance, intelligence, dedication, and technical excellence – of ourselves and each other.

Now that the Internet – the hacker culture’s creation! – is everywhere, and civilization is increasingly software-dependent, we have a duty, the duty I wrote about in Holding Up The Sky. The invisible gears have to turn. The shared software infrastructure of civilization has to work, or economies will seize up and people will die. And for large sections of that infrastructure, it’s on us – us! – to keep it working. Because nobody else is going to step up.

We dare not give less than our best. If we fall away from meritocracy – if we allow the SJWs to remake us as they wish, into a hell-pit of competitive grievance-mongering and political favoritism for the designated victim group of the week – we will betray not only what is best in our own traditions but the entire civilization that we serve.

This isn’t about women in tech, or minorities in tech, or gays in tech. The hacker culture’s norm about inclusion is clear: anybody who can pull the freight is welcome, and twitching about things like skin color or shape of genitalia or what thing you like to stick into what thing is beyond wrong into silly. This is about whether we will allow “diversity” issues to be used as wedges to fracture our community, degrade the quality of our work, and draw us away from our duty.

When hackers fail our own standards of meritocracy, as we sometimes do, it’s up to us to fix it from within our own tradition: judge by the work alone, you are what you do, shut up and show us the code. A movement whose favored tools include the rage mob, the dox, and faked incidents of bigotry is not morally competent to judge us or instruct us.

I have been participating in and running open-source projects for a quarter-century. In all that time I never had to know or care whether my fellow contributors were white, black, male, female, straight, gay, or from the planet Mars, only whether their code was good. The SJWs want to make me care; they want to make all of us obsess about this, to the point of having quotas and struggle sessions and what amounts to political officers threatening us if we are insufficiently “diverse”.

Think I’m exaggerating? Read the whole djangoconcardiff thread. What’s there is totalitarianism in miniature: ideology is everything, merit counts for nothing against the suppression of thoughtcrime, and politics is conducted by naked intimidation against any who refuse to conform. Near the end of the conversation djangoconcardiff threatens to denounce Rosario to the board of the Django Software Foundation in the confused, illiterate, vicious idiom of an orc or a stormtrooper.

It has been suggested that djangoconcardiff might be a troll emulating an SJW, and we should thus take him less seriously. The problem with this idea is that no SJW disclaimed him – more generally, that “Social Justice” has reached a sort of Poe’s Law singularity at which the behavior of trolls and true believers becomes indistinguishable even to each other, and has the same emergent effects.

In the future, the hacker whose community standing the SJWs threaten could be you. The SJWs talk ‘diversity’ but like all totalitarians they measure success only by total ideological surrender – repeating their duckspeak, denouncing others for insufficent political correctness, loving Big Brother. Not being a straight white male won’t save you either – Roberto Rosario is an Afro-Hispanic Puerto Rican.

We must cast these would-be totalitarians out – refuse to admit them on any level except by evaluating on pure technical merit whatever code patches they submit. We must refuse to let them judge us, and learn to recognize their thought-stopping jargon and kafkatraps as a clue that there is no point in arguing with them and the only sane course is to disengage. We can’t fix what’s broken about the SJWs; we can, and must, refuse to let them break us.

(Roberto Rosario, Meredith L. Patterson, and Rick Moen assisted in the composition of this post. However, any errors are the sole responsibility of the author.)

Nov 08

Status signaling and cruelty to betas

I find myself in the embarrassing position of having generated a theoretical insight for a movement I don’t respect very much.

My feelings about the “Red Pill” movement are a lot like my feelings about feminism. Both started out asking important questions about why men and women treat each other badly. Early on, both began to develop some answers that made sense. Later, both movements degenerated – hijacked by whiny, broken, hating people who first edged into outright craziness and then increasingly crossed that line.

But the basic question that motivated the earliest Red-Pill/PUA analysis remains: why do so many women say they want nice guys and then sexually reward arrogant jerks? And the answer has a lot of staying power. Women are instinctive hypergamists who home in on dominance signaling the way men home in on physical pulchritude. And: they’re self-deceivers – their optimal mating strategy is to sincerely promise fidelity to hook a good-provider type while actually being willing to (a) covertly screw any sexy beast who wanders by in order to capture genetic diversity for their offspring, and (b) overtly trade up to a more dominant male when possible.

(This is really complicated compared to the optimal male strategy, which is basically to both find a fertile hottie you think you can keep faithful and screw every other female you can tap without getting killed in hopes of having offspring at the expense of other men.)

What I’ve figured out recently is that there’s another turn of the vise. Sorry, nice-guy betas; you’re even more doomed than the basic theory predicts.

Continue reading

Nov 03

From kafkatrap to honeytrap

I received a disturbing warning today from a source I trust.

The short version is: if you are any kind of open-source leader or senior figure who is male, do not be alone with any female, ever, at a technical conference. Try to avoid even being alone, ever, because there is a chance that a “women in tech” advocacy group is going to try to collect your scalp.

Continue reading

Oct 30

Hieratic documentation

Here’e where I attempt to revive and popularize a fine old word in a new context.

hieratic, adj. Of or concerning priests; priestly. Often used of the ancient Egyptian writing system of abridged hieroglyphics used by priests.

Earlier today I was criticizing the waf build system in email. I wanted to say that its documentation exhibits a common flaw, which is that it reads not much like an explanation but as a memory aid for people who are already initiates of its inner mysteries. But this was not the main thrust of my argument; I wanted to observe it as an aside.

Continue reading

Oct 23

NTPsec is not quite a full rewrite

In the wake of the Ars Technica article on NTP vulnerabilities, and Slashdot coverage, there has been sharply increased public interest in the work NTPsec is doing.

A lot of people have gotten the idea that I’m engaged in a full rewrite of the code, however, and that’s not accurate. What’s actually going on is more like a really massive cleanup and hardening effort. To give you some idea how massive, I report that the codebase is now down to about 43% of the size we inherited – in absolute numbers, down from 227KLOC to 97KLOC.

Details, possibly interesting, follow. But this is more than a summary of work; I’m going to use it to talk about good software-engineering practice by example.

Continue reading

Oct 15

SPDX: boosting the signal

High on my list of Things That Annoy Me When I Hack is sourcefiles that contain huge blobs of license text at the top. That is valuable territory which should be occupied by a header comment explaining the code, not a boatload of boilerplate that I’ve seen hundreds of times before.

Hackers have a lot of superstitious ideas about IP law and one is that these blobs are necessary for the license to be binding. They are not: incorporation by reference is a familiar concept to lawyers and courts, it suffices to unambiguously name the license you want to apply rather than quoting it in full.

This is what I do in my code. But to make the practice really comfortable for lawyers we need a registry of standardized license identifiers and an unambiguous way of specifying that we intend to include by reference.

Comes now the Software Package Data Exchange to solve this problem once and for all. It’s a great idea, I endorse it, and I will be using it in all my software projects from now on.

Continue reading

Oct 09

I improved time last night

Sometimes you find performance improvements in the simplest places. Last night I improved the time-stepping precision of NTP by a factor of up to a thousand. With a change of less than 20 lines.

The reason I was able to do this is because the NTP code had not caught up to a change in the precision of modern computer clocks. When it was written, you set time with settimeofday(2), which takes a structure containing seconds and microseconds. But modern POSIX-conformant Unixes have a clock_settime(2) which takes a structure containing seconds and nanoseconds.

Continue reading

Oct 07

The FCC must not lock down device firmware!

The following is a comment I just filed on FCC Docket 15-170, “Amendment of Parts 0, 1, 2, 15, and 18 of the Commission’s Rules et al.”

Thirty years ago I had a small hand in the design of the Internet. Since then I’ve become a senior member of the informal collegium that maintains key pieces of it. You rely on my code every time you use a browser or a smartphone or an ATM. If you ever ride in a driverless car, the nav system will critically depend on code I wrote, and Google Maps already does. Today I’m deeply involved in fixing Internet time service.

I write to endorse the filings by Dave Taht and Bruce Perens (I gave Dave Taht a bit of editorial help). I’m submitting an independent comment because while I agree with the general thrust of their recommendations I think they may not go far enough.

Continue reading

Oct 06

Vox is wrong – we don’t have too many guns, we have too many criminals

One of my followers on G+ asked me to comment on a Vox article,
What no politician wants to admit about gun control

I’ve studied the evidence, and I don’t believe the effect of the Australian confiscation on homicides was significant.  You can play games with statistics to make it look that way, but they are games.

As for the major contention of the article, it’s simply wrong.  80% of U.S. crime, including gun violence, is associated with the drug trade and happens in urban areas where civil order has partially or totally collapsed.

Outside those areas, the U.S. looks like Switzerland or Norway – lots of guns, very little crime.  Those huge, peaceful swathes of high-gun-ownership areas show that our problem is not too many guns, it’s too many criminals.

Continue reading

Sep 23

Major progress on the NTPsec front

I’ve been pretty quiet on what’s going on with NTPsec since posting Yes, NTPsec is real and I am involved just about a month ago. But it’s what I’m spending most of my time on, and I have some truly astonishing success to report.

The fast version: in three and a half months of intensive hacking, since the NTP Classic repo was fully converted to Git on 6 June, the codebase is down to 47% of its original size. Live testing on multiple platforms seems to indicate that the codebase is now solid beta quality, mostly needing cosmetic fixes and more testing before we can certify it production-ready.

Here’s the really astonishing number…

Continue reading

Sep 17

Word of the day: shimulate

shimulate, vt.: To insert a shim into code so it simulates a desired standardized ANSI/POSIX facility under a deficient operating system. First used of implementing clock_gettime(2) under Mac OS X, in the commit log of ntpsec.

I checked first use by Googling.

Sep 08

On open-source pharma

(This copies a comment I left on Derek Lowe’s blog at Science Magazine.)

I was the foundational theorist of open-source software development back in the 1990s, and have received a request to respond to your post on open-source pharma.

Is there misplaced idealism and a certain amount of wishful thinking in the open-source pharma movement? Probably. Something I often find myself pointing out to my more eager followers is that atoms are not bits; atoms are heavy, which means there are significant limiting factors of production other than human attention, and a corresponding problem of capital costs that is difficult to make go away. And I do find people who get all enthusiastic and ignore economics rather embarrassing.

On the other hand, even when that idealism is irrational it is often a useful corrective against equally irrational territoriality. I have observed that corporations have a strong, systemic hunker-down tendency to overprotect their IP, overestimating the amount of secrecy rent they can collect and underestimating the cost savings and additional options generated by going open.

I doubt pharma companies are any exception to this; when you say “the people who are actually spending their own cash to do it have somehow failed to realize any of these savings, because Proprietary” as if it’s credulous nonsense, my answer is “Yes. Yes, in fact, this actually happens everywhere”.

Thus, when I have influence I try to moderate the zeal but not suppress it, hoping that the naive idealists and the reflexive hunker-downers will more or less neutralize each other. It would be better if everybody just did sound praxeology, but human beings are not in general very good at that. Semi-tribalized meme wars fueled by emotional idealism seem to be how we roll as a species. People who want to change the world have to learn to work with human beings as they are, not as we’d like them to be.

If you’re not inclined to sign up with either side, I suggest pragmatically keeping your eye on the things the open-source culture does well and asking if those technologies and habits of thought can be useful in drug discovery. Myself, I think the long-term impact of open data interchange formats and public, cooperatively-maintained registries of pre-competitive data could be huge and is certainly worth serious investment and exploration even in the most selfish ROI terms of every party involved.

The idealists may sound a little woolly at times, but at least they understand this possibility and have the cultural capital to realize it – that part really is software.

Then…we see what we can learn. Once that part of the process has been de-territorialized, options to do analogous things at other places in the pipeline may become more obvious,

P.S: I’ve been a huge fan of your “Things I Won’t Work With” posts. More, please?

Sep 01

I have a Patreon page

I created a Patreon page just before leaving for vacation on 2 Aug. The background to this is that while I’m now getting some regular bucks for working on NTPsec, it’s not a lot. Royalties from my books have been dwindling and my wife Cathy isn’t making all that much from legal contract gigs that are all she can get since Obamacare costs killed her full-time law job. Add the fact that our eight-year-old car has developed problems that would cost more to fix than its book value, and the house needs a new roof, and it’s looking pretty broke out.

Continue reading

Aug 25

The Great Beast has met its match

When I built the Great Beast of Malvern, it was intended for surgery on large repositories. The specific aim in view was to support converting the NetBSD CVS to git, but that project is stalled because the political process around NetBSD’s decision about when to move seems to have seized up. I’ve got the hardware and software ready when they’re ready to move.

Now I have another repo-conversion job in the offing – and it does something I thought I’d never see. The working set exceeds 32GB! For comparison, the working set of the entire NetBSD conversion tops out at about 18GB.

What, you might well ask, can possibly have a history that huge? And the answer is…GCC. Yes, they’re looking to move from Subversion to git. And this is clearly a job for the Great Beast, once the additional 32GB I just ordered from Newegg arrives.

Aug 21

On having good form

Sometimes, the best encouragement you can get in a martial-arts class is silence.

Once a month my school, which normally teaches a combination of wing chun kung fu and Philippine blade/stick fighting, gets a visit from Sifu Jerry Devone, who teaches pure traditional Wing Chun at a level a bit higher than our Sifu Dale Yeager.

Sifu Jerry is a nice guy, but it’s not difficult to find videos of him almost casually destroying other kung fu players in ring fights. He shows the same soft/hard combination as an instructor – never yells at anyone, but demands precision and perfection and often gets it, even from unpromising students.

Tonight he told the four senior students (including Cathy and myself) to line up facing him and do the Siu Nim Tao form with him watching for defects. From some instructors this would be a terrifying prospect, with anticipation of a humiliating ass-chewing to follow. While Sifu Dale wouldn’t exactly humiliate someone who screwed up, he might make snarky theatrical jokes about bad performance in a half-laughing-with, half-laughing-at manner. Neither of these is Sifu Jerry’s style – he’d just quietly correct in a way that would make you grimly determined to get it right next time.

Still, I felt rather stressed. I know the motions of Siu Nim Tao – it’s not a complex form, and it doesn’t require anything I’m bad at like high kicking – but it’s subtle. There are fine details in it, and the devil is in those details, and in getting the overall flow and timing right.

Continue reading