irker 1.0 (a functional CIA replacement) is shipped

OK, I’ve been hacking intensely for most of the last 24 hours and here’s the payoff: irker-1.0 is shipped. Code and documentation are at http://www.catb.org/esr/irker/.

Out of the starting box we have a hook script with tested support for git and (rather clumsily) Subversion; hg should be a piece of cake for anyone who wants to step up. Forge-site operators can begin installing the relay daemon and the repo hook immediately, and should do so.

Coming soon: a long essay I’ve been sitting on analyzing the now-dead CIA service as a case study in over-engineering. It’s not really very surprising that it collapsed under its own weight.

Also note that there is an XML-RPC proxy for people who have limited ability to change their hook scripts. I haven’t looked at the code myself but there’s a pointer in the irker README file.

27 thoughts on “irker 1.0 (a functional CIA replacement) is shipped

  1. 16 hours is still _most_ of last 24 hours, though. How wild did this ride get, Eric?

  2. >I’m gratified that you can still handle 24-hour hacking runs at your advancing age…

    Oh, come on, it’s not like I’m an octagenerian or something. Besides, I snuck a few hours of sleep in there :-). I’ll get Cathy to feed me a steak and some hot cocoa and I’ll be fine.

  3. >16 hours is still _most_ of last 24 hours, though. How wild did this ride get, Eric

    Not too bad. I got some good testing and patches from AI0867 and nenolod on the freenode #cia channel, which was sort of cheering me along through most of it.

  4. >Why didn’t you know about that ESR?

    Never heard of it before today. It did come up on the #cia channel. Over 4000 lines of Perl with a super-elaborate config file, apparently replicating some of CIA’s design mistakes. Having looked at it, all I can say is “Yuck!”. Too few people care about writing tight, minimal code these days.

  5. >Not too bad. I got some good testing and patches from AI0867 and nenolod on the freenode #cia channel, which was sort of cheering me along through most of it.

    The proxy is definitely going to be useful. Seems to be a simple setup, too, so migration should be flooding as soon as the first couple of irker servers go up.

    I’m guessing someone’s bound to set up an irker server for community use sooner or later.

  6. Actually read the documentation, it seems it’s not feasible to set up a community server. I wanted to be relevant :P

  7. >I’m guessing someone’s bound to set up an irker server for community use sooner or later.

    Maybe. I don’t think publicly accessible irkers are a great idea. The problem with them is that an attacker could use one to spam a channel while masking his actual IP adddress.

  8. @Eric:
    Never you mind, I’m falling asleep all over the place. For some reason, the icon this box was showing for the irkerd file was the 1′s and 0′s of binaries, not the dashes of the text/script files, and I thought it’d be something like the “pyc” that used to be generated automatically when you executed a python script aeons ago, except it wasn’t “.pyc”, and there was no source if I’d been right.

    I just didn’t notice I was wrong. Meh, I won’t flood your comments section with more nonsense.

    Have a nice time.

  9. Pingback: Exit CIA.vc, enter irker • Shadowmaster’s Blog

  10. ESR said, on KGB:

    > Never heard of it before today. It did come up on the #cia channel. Over 4000 lines of Perl with a
    > super-elaborate config file, apparently replicating some of CIA’s design mistakes. Having looked
    > at it, all I can say is “Yuck!”. Too few people care about writing tight, minimal code these days.

    I’m one of the people who wrote KGB, and the one who came with the original design.
    I think it gave you a bad first impression, but it’s unfounded. The bot code is a bit over a thousand lines, including embedded man page. It’s quite simple, it’s just a relay of messages received over SOAP to IRC channels. It has some superfluous stuff like colouring or replying when addressed, but its core function is implemented in the simplest way possible.

    The clients make another two thousand lines, again with documentation (about half the LOC), and including support for git and svn repositories. Yeah, it’s more than 300 lines, and it has some obvious flaws that we’d like to address. But at it’s core, it’s dead simple, so it’s just a matter of improving the interfaces.

    Now, you might be able to pull a service in 300 lines because you haven’t thought of things like supporting repositories with names different to their irc channels, or detecting branches and modules, or supporting having the client be on a different network than the bot. I think these are valid decisions, but I don’t think you can consider that bloat.

  11. >Now, you might be able to pull a service in 300 lines because you haven’t thought of things like supporting repositories with names different to their irc channels

    irkerd supports this.

    >or detecting branches and modules

    I looked into this. It seems branch detection is done only so Subversion branches can be highlighted in the IRC message. Yes, I am going to consider this bloat.

    >supporting having the client be on a different network than the bot

    irkerd supports this.

    Fair is fair; with the client code, my total LOC is 640. But accepting that your code is almost half embedded POD, that still means it’s about three times the size of irker. I am surely not seeing three times the capability in it. And…SOAP? What were you thinking? That’s ridiculously heavyweight for this application.

  12. Perhaps they were familiar with it? There’s something to be said for sticking with what you know. And if it’s been around since 2008, was JSON available then?

  13. ESR: according to what I saw from a quick inspection, you say there needs to be a firewall protecting the server, as there’s no access control.
    On soap: it’s so trivial to use soap::lite that I didn’t care about how heavy the protocol might be. I used to be an xml-rpc fan, but switched because of that implementation.
    Also, the load it imposes on our servers has been completely negligible so far.

    Joel: KGB communicates to a server and port you specify. Supports multiple serves for redundancy and chooses the first one that responds correctly.

  14. >there’s no access control.

    That’s correct. In the space of possible designs for something like this, you can have (a) stateless and decentralized, or (b) in-band access control. Choose exactly one. I chose (a).

    The problem is that in order to do (b) access control, your bot has to store credentials; this results in a complexity explosion and proliferating failure modes. Fuck that noise; guarding irker with firewalls reduces the global complexity of the system as a whole.

  15. Cool, that’d probably be more efficient than supybot + its git plugin :-D

  16. @esr

    The problem is that in order to do (b) access control, your bot has to store credentials;

    Sure, but how complex that has to be depends on what level of access control you want. If you just want very simple access control, you could secure the thing with just a simple SSL client certificate. Then you’d only need to store the keys and root cert, and those can be stored in a simple text file. Given the ease of implementing SSL in Python, implementing something like that wouldn’t increase complexity very much at all, though it does tend to increase administration work load some.

  17. >If you just want very simple access control, you could secure the thing with just a simple SSL client certificate.

    In this case there is no point in putting that support inside irkerd. The right thing to do is deploy spiped or stunneld in front of it. Proper separation of function…

  18. What about enabling IRC SSL support? Or is that not worth the additional complexity because commit messages are the sort of thing one shouldn’t care whether they are transmitted to the IRC server unencrypted?

  19. >commit messages are the sort of thing one shouldn’t care whether they are transmitted to the IRC server unencrypted?

    That’s what I think. What would be the point of encryption here?

  20. > That’s what I think. What would be the point of encryption here?

    Hmm. You know, truthfully, I can’t think of one. I guess I’ve grown used to using SSL for my normal IRC usage and was wanting it in irker out of some sort of reflex.

    Still, part of me wants to try to implement IRC SSL anyway, just to have an excuse to learn about it and to see if I can, practicality be damned.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>