Feb 17

Automatons, judgment amplifiers, and DSLs

Do we make too many of our software tools automatons when they should be judgment amplifiers? And why don’t we write more DSLs?

Back in the Renaissance there was a literary tradition of explaining natural philosophy via conversations among imaginary characters. I’m going to revive that this evening because I had an IRC conversation this afternoon, about the design insights behind reposurgeon, that pretty much begs to be presented this way.

The person of “Simplicio” was Galileo’s invention in his Dialogue Concerning the Two Chief World Systems. Here he represents four different people, but almost everything he says is something one of them in fact said or very plausibly might have. I’ve cleaned it up, edited, and amplified only a little.

For those of you coming in late, reposurgeon is a tool I wrote for editing version-control histories. It has many applications, including highest-quality repository conversions. Simplicio needed to excise some security-sensitive credentials from a DHS code repository – not just from the tip version but from the entire history. Reposurgeon is pretty much the only practical way to do this.

So, without further ado…

Continue reading

Feb 15

Brute force beats premature optimization

I made a really common and insidious programming mistake recently. I’m going to explain it in detail because every programmer in the world needs the reminder not to do this, and I hope confessing that even “ESR” falls into such a trap will make the less experienced properly wary of it.

Our sutra for today expounds on the sayings of the masters Donald Knuth and Ken Thompson, who in their wisdom have observed “Premature optimization is the root of all evil” and “When in doubt, use brute force.”

Continue reading

Feb 10

SRC users: check in, please?

I just released version 1.7 of SRC, Simple Revision Control.

For those of you late to the party, SRC is a simple version control system for directories full of small standalone files like FAQs, scripts in your ~/bin, dotfiles, and so forth – cases where you don’t want multi-file changesets. It’s actually a Python wrapper around RCS (or, optionally, SCCS) but gives you integer sequential version numbers, lockless operation, and a modern low-friction UI modeled on Subversion’s.

With 1.7, I think it’s finished – the last two user-visible features I had planned were SCCS support and DOT visualization, and those are done now.

I believe SRC is now feature-complete for its functional niche. Am I mistaken? Is anything missing? Did I do anything that seems wrong?

I know SRC has had real users since about 0.3. If you are an SRC user, please check in in the comments. Most importantly, tell me if you need any feature it doesn’t have. I’m also curious if the actual use cases are any different than I expected, and I am all agog to know if anyone actually has a use for the SCCS support.

Feb 05

SRC goes SCCS

I needed a break from serious work yesterday, so SRC now speaks SCCS as well as RCS. This wasn’t difficult, I had SRC carefully factored in anticipation from when I originally wrote it.

I can’t say I think this feature will be actually useful; SCCS is pretty primitive, and the SRC support has some annoying limitations as a result. But some hacks you do just because you can, and this is one of them.

Continue reading

Jan 30

Wicked River: the movie

Some years ago I happened across a fascinating book titled Wicked River: The Mississippi When It Last Ran Wild. If you have any fondness for Mark Twain (as I do – I own and have read the complete works), you need to read this book. The book is an extended argument that Twain’s late-Victorian portraits of river life were a form of rosy-filtered nostalgia for a pre-Civil-War reality that was quite a bit more wild, colorful, squalid, violent, and bizarre.

The river is tamed now, corseted by locks and levees, surrounded by a settled society. It was already nearly thus when Twain was writing. But in and before Huck Finn’s time (roughly the 1840s) it had been a frontier full of strivers, mad men, bad men, and epic disasters like the New Madrid earthquakes.

Random evocative detail: there was a river pirate named John Murrell who operated out of a section of the river called Nine Mile Reach and often masqueraded as a traveling preacher; his gang was called the “Mystic Clan”, and it was for years believed that he had a master plan to foment a general slave insurrection. But that last bit may have been fabrication by a con man with a book to sell. Whether true or not, it led to riots in various cities and a mob attempt to expel all gamblers from Vicksburg based on a rumor that some of them had been part of the plot.

The book is full of you couldn’t-make-this-stuff-up stories like that. And then, much more recently, I learned about Abe Lincoln’s flatboat voyage.

Continue reading

Jan 26

SRC 1.0 is released

If you were reading A&D a year ago, you may recall that I invented a new version-control system to occupy an odd little niche that none of the exiting ones serve very well.

Well, actually, it’s a shell around a very old version-control system that makes a reasonable fast version-storage manager but has a crappy UI. Thus, SRC – RCS reloaded, with a mission to serve cases where you don’t want per-directory changesets but prefer each file to have its own separate change history. Like a directory full of separate FAQs, or your ~/bin full of little scripts.

SRC gives you a modern UI in the svn/hg/git style (but much, much simpler than git’s) and lockless operation. It has full embedded documentation and an Emacs VC backend. If your little project goes multi-file, you can instantly fast-export to git.

Today I shipped Version 1.0. This could have happened sooner, but I’ve been focusing on NTPsec pretty hard in the last year. There was one odd bug in the behavior of multi-file commands that I just hadn’t got around to fixing. (Yes, you can do multi-file commands, but the files still have separate histories.)

The whole thing is just 2KLOC of Python, and that’s with the rather extensive embedded documentation. The sort of person who frequents this blog might find the FAQ entertaining.

Jan 19

The silent trade: universal objective ethics in action

Once upon a time, back during the Age of Exploration, there was a marvellous practice called the “silent trade”. It was a solution to a serious coordination problem between groups who had no languages in common, or distrusted each other so much that they refused to come within range of each others’ weapons.

What makes it marvellous is that it constituted experimental proof of the existence of universal, objective ethical principles sufficient to build cooperation among hostile parties.

Continue reading

Jan 18

Announcing sshexport

I struck a small blow for better security today.

It started last night on an IRC channel with A&D regular Susan Sons admonishing the regulars to rotate their ssh keys regularly – that is, generate and export new key pairs so that is someone cracks the crypto on one out of your sight it won’t be replayable forever.

This is one of those security tasks that doesn’t get done often enough because it’s a fiddly pain in the ass. But (I thought to myself) I have a tool that reduces the pain. Maybe I should try to eliminate it? And started hacking.

The tool was, until yesterday, named ssh-installkeys. It’s a script wrapper written in Python that uses a Python expect engine to login into remote sites and install (or remove) ssh public keys. What makes it useful is that it remembers a lot of annoying details like fixing file and directory permissions so your ssh server won’t see a potential vulnerability and complain. Also, unlike some competing tools, it only requires you to enter your password once per update.

Some time ago I taught this code to log its installations in a config file so you have a record of where you have remote-installed keys. I realized that with a little work this meant I could support a rotate option – mass-install new keys on every site you have recorded. And did that.

I’ve been meaning for some time to change the tool’s name; ssh-installkeys is too long and clumsy. So it’s now sshexport. I also updated it to know about, and generate, ed25519 keys (that being the new hotness in ssh crypto).

In order to reduce the pain, sshexport can now now store your passwords in its list of recorded sites, so you only have to enter the password the first time you install keys and all later rotations are no-hands operations. This doesn’t actually pose much additional security risk because by hypothesis anyone who can read this file has read access to your current private ssh keys already. The correct security measure is whatever you already do to protect other sensitive data in your dot directories, like GPG directories and web passwords stored by your browser. I use drive encryption.

The result is pretty good. Not perfect; the big missing feature is that it doesn’t know how to update your keys on sites like GitLab. That would take a custom method for each such site, probably implemented with curl. Perhaps in a future release.

Jan 17

What Amending the Constitution Cannot Do

An underappreciated fact about U.S. Constitutional law is that it recognizes sources of authority prior to the U.S. Constitution itself. It is settled law that the Bill of Rights, in particular, does not confer rights, it only recognizes “natural rights” which pre-exist the Bill of Rights and the Constitution and which – this is the key point – cannot be abolished by amending the Constitution.

Continue reading

Jan 12

What killed the duel?

A&D regulars will probably not be much surprised to learn that I’m something of a topic expert on the history of the duel of honor. This came up over on Slate Star Codex recently when I answered a question about the historical relationship of the duel or honor with street violence.

I’ve read all the scholarship on the history of dueling I can find in English. There isn’t much, and what there is mostly doesn’t seem to me to be very good. I’ve also read primary sources like dueling codes, and paid a historian’s attention to period literature.

I’m bringing this up now because I want to put a stake in the ground. I have a personal theory about why Europo-American dueling largely (though not entirely) died out between 1850 and 1900 that I think is at least as well justified as the conventional account, and I want to put it on record.

Continue reading

Jan 10

Cometary Contributors

I released reposurgeon 3.30 today. It has been five years and a month since the first public release.

In those five years, the design concept seems to have proved out very well, finding use in many repository conversions. But the project exhibits an unusual sociology; I don’t get lots of casual contributors, only a few exceptional ones.

Continue reading

Jan 03

Why I joined the NRA

After 20 years of evading joining the NRA, I finally did it last week.

I’ve never been a huge fan of the NRA because, despite the fearsome extremist image the mainstream media tries to hang on it, the NRA is actually rather squishy about gun rights. A major symptom of this is its lack of interest in pursuing Second Amendment court cases. Alan Gura, the civil-rights warrior who fought Heller vs. DC and several other key cases to a successful conclusion, was funded not by the NRA but by the Second Amendment Foundation. Also, in the past, the NRA has been too willing to acquiesce to unconstitutional legislation like the 1986 ban on sales of new automatic weapons to civilians.

So, you might well ask: why am I joining an organization I’m dubious about now, when the gun-rights cause seems to be winning? Popular support for Second Amendment rights is at record highs in the polls, a record seven states now have constitutional carry (no permit requirement), Texas just became the 45th state to legalize open carry last week…why am I joining an organization I’ve characterized as squishy?

Continue reading

Dec 25

Beehive huts to the stars!

None of the things I expected from seeing The Force Awakens was to recognize the location where the last scene was filmed, because I’ve been there myself.

I’m being careful not to utter spoilers here…but I’ve been to the western coast of Ireland, in County Kerry, in a place called Fahan. And in that place, where the Atlantic crashes on the shore and blue of the sky and the green of the grass are more vivid than anywhere else I’ve seen on Earth, there are beehive-shaped stone huts called “clocháns” on the hills that tumble down to the sea.

There are many legends about the clocháns, the most picturesque of which is that they were built by hermit monks around 1000CE. Built by hand, without mortar, they are rude and dramatic ornaments to a landscape that would be pretty impressive even without them.

The combination is unmistakable, and that’s how I know pretty much exactly where that last scene was filmed, to within a couple of hundred feet, on the south-facing shore of the Dingle Peninsula. I’ve seen it with my own eyes; I may have walked on the same paths the movie characters used, probably did in fact.

And again, no spoilers, but…it was a superb choice of location for that scene. Well done!

(And for you smartasses out there, no it wasn’t the huts on Skellig Michael rather than the mainland. The lie of the slope was wrong for that; besides, schlepping a film unit to the island would have been both hideously difficult and pointless when the shore locations were about as good for what they wanted.)

UPDATE: On new evidence, they changed locations during the scene – I was right about the beginning, but the very last bit (like, the last 60 seconds of the movie) was indeed filmed on Skellig Michael.

Dec 19

Comparative language difficulty for English speakers

This morning I found a copy of the chart the Foreign Services Institute uses to grade the comparative difficulty of world languages for acquisition by an adult monoglot English speaker.

I have an unusual perspective on this list for an American. I’m a low-grade polyglot; I have spoken three languages other than my birth English and can read a couple others with Google Translate. I have studied comparative linguistics; I know a bit about the morphology and phonology of many of these languages. I have received street-level exposure to over a dozen of them in my extensive travels, and I have a good ear.

So, I’m going to try to add some value to the list with additional notes and comments.

Continue reading

Dec 16

A short course in counter-terror theory

In the wake of the San Bernardino shootings, more Americans than before are trying to grapple with questions about the nature of terrorism, terror activity versus rampage killings, and what can be done to prevent these bloodlettings.

I have been studying these questions for years as part of my self-training. I learned some of the basics of counter-terrorism theory from a former SpecOps officer, and more from my Kung Fu instructor whose day job is as a criminal forensics and counter-terrorism specialist consulting to law enforcement. I’ve also read up on the subject, and thought carefully about what I’ve read.

The following is a primer on how people whose job it is to prevent and mitigate terrorist activity and spree killings think about it.

Continue reading

Nov 25

On the shooting of Laquan McDonald

One of my regulars, mindful of the forensic analysis I did on the Michael Brown autopsy photos last year, has asked me to comment on the Laquan McDonald shooting from my point of view as a pistol and self-defense instructor.javporn

The fast version: I would have said this was what cops call a “good shoot” if it had stopped at the first two bullets. It didn’t. I don’t think this was murder one, but it was at least criminally negligent homicide and those who covered it up should be prosecuted along with Van Dyke.

Continue reading

Nov 16

NTPsec’s beta is released

You’ve heard me uttering teasers about it for months. Now it’s here. The repository is available for cloning; we’re shipping the 0.9.0 beta of NTPsec. You can browse the web pages or clone the git repository by one of several methods. You can “wget https://github.com/NTPsec/ntpsec/archive/NTPsec_0_9_0.tar.gz” to get a tarball.

This is an initial beta and has some rough edges, mostly due to the rather traumatic (but utterly necessary) replacement of the autoconf build system. Also, our range of ports is still narrow; if you’re on anything but Linux or a recent FreeBSD the build may not work for you yet. These things will be fixed.

However, the core function – syncing your clock via NTP – is solid, and using 0.9.0 for production might be judged a bit adventurous but wouldn’t be crazy. The next few beta releases will rapidly get more polished. Expect them to come quickly, like within weeks.

Most of the changes are under the hood and not user-visible. A few auxiliary tools have been renamed, most notably sntp to ntpdig. If you read documentation, you will notice that what’s there has been massively revised and improved.

The most important change you can’t see is that the code has been very seriously security-hardened, not only by plugging all publicly disclosed holes but by internal preventive measures to close off entire classes of vulnerabilities (by, for example, replacing all function calls that can produce buffer overruns with memory-safe equivalents.)

We’ve already established good relations with security-research and InfoSec communities. Near-future releases will include security fixes currently under embargo.

If you consider this work valuable, please support it by contributing at my Patreon page.

Nov 13

Why Hackers Must Eject the SJWs

The hacker culture, and STEM in general, are under ideological attack. Recently I blogged a safety warning that according to a source I consider reliable, a “women in tech” pressure group has made multiple efforts to set Linus Torvalds up for a sexual assault accusation. I interpreted this as an attempt to beat the hacker culture into political pliability, and advised anyone in a leadership position to beware of similar attempts.

Now comes Roberto Rosario of the Django Software Foundation. Django is a web development framework that is a flourishing and well-respected part of the ecology around the of the Python language. On October 29th 2015 he reported that someone posting as ‘djangoconcardiff’ opened an issue against pull request #176 on ‘awesome-django’, addressing it to Rosario. This was the first paragraph.

Hi

great project!! I have one observation and a suggestion. I noticed that you have rejected some pull requests to add some good django libraries and that the people submitting thsoe pull requests are POCs (People of Colour). As a suggestion I recommend adopting the Contributor Code of Conduct (http://contributor-covenant.org) to ensure everyone’s contributions are accepted regarless [sic] of their sex, sexual orientation, skin color, religion, height, place of origin, etc. etc. etc. As a white straight male and lead of this trending repository, your adoption of this Code of Conduct will send a loud and clear message that inclusion is a primary objective of the Django community and of the software development community in general. D.

Conversation on that issue is preserved in the Twitter link above, but the issue itself in GitHub has apparently been deleted in its totality. Normally, only GitHub staff can do this. A copy is preserved here.

It is unknown who was speaking as ‘djangoconcardiff’, and that login has now been deleted, like the GitHub issue. (DjangoCon Europe 2015 was this past May/June in Cardiff.)

The slippery, Newspeak-like quality of djangoconcardiff’s “suggestion” makes it hard to pin down from the text itself whether he/she is merely stumping for inclusiveness or insinuating that rejection of pull requests by “persons of color” is itself evidence of racism and thoughtcrime.

But, if you think you’re reading that ‘djangoconcardiff’ considers acceptance of pull requests putatively from “persons of color” to be politically mandatory, a look at the Contributor Covenant he/she advocates will do nothing to dissuade you. Paragraph 2 denounces the “pervasive cult of meritocracy”. [Update: The explicit language has since been removed. The intention rather obviously remains]

It is clear that djangoconcardiff and the author of the Covenant (self-described transgender feminist Coraline Ada Ehmke) want to replace the “cult of meritocracy” with something else. And equally clear that what they want to replace it with is racial and sexual identity politics.

Rosario tagged his Twitter report “Social Justice in action!” He knows who these people are: SJWs, “Social Justice Warriors”. And, unless you have been living under a rock, so do you. These are the people – the political and doctrinal tendency, united if in no other way by an elaborate shared jargon and a seething hatred of djangoconcardiff’s “white straight male”, who recently hounded Nobel laureate Tim Hunt out of his job with a fraudulent accusation of sexist remarks.

I’m not going to analyze SJW ideology here except to point out, again, why the hacker culture must consider anyone who holds it an enemy. This is because we must be a cult of meritocracy. We must constantly demand merit – performance, intelligence, dedication, and technical excellence – of ourselves and each other.

Now that the Internet – the hacker culture’s creation! – is everywhere, and civilization is increasingly software-dependent, we have a duty, the duty I wrote about in Holding Up The Sky. The invisible gears have to turn. The shared software infrastructure of civilization has to work, or economies will seize up and people will die. And for large sections of that infrastructure, it’s on us – us! – to keep it working. Because nobody else is going to step up.

We dare not give less than our best. If we fall away from meritocracy – if we allow the SJWs to remake us as they wish, into a hell-pit of competitive grievance-mongering and political favoritism for the designated victim group of the week – we will betray not only what is best in our own traditions but the entire civilization that we serve.

This isn’t about women in tech, or minorities in tech, or gays in tech. The hacker culture’s norm about inclusion is clear: anybody who can pull the freight is welcome, and twitching about things like skin color or shape of genitalia or what thing you like to stick into what thing is beyond wrong into silly. This is about whether we will allow “diversity” issues to be used as wedges to fracture our community, degrade the quality of our work, and draw us away from our duty.

When hackers fail our own standards of meritocracy, as we sometimes do, it’s up to us to fix it from within our own tradition: judge by the work alone, you are what you do, shut up and show us the code. A movement whose favored tools include the rage mob, the dox, and faked incidents of bigotry is not morally competent to judge us or instruct us.

I have been participating in and running open-source projects for a quarter-century. In all that time I never had to know or care whether my fellow contributors were white, black, male, female, straight, gay, or from the planet Mars, only whether their code was good. The SJWs want to make me care; they want to make all of us obsess about this, to the point of having quotas and struggle sessions and what amounts to political officers threatening us if we are insufficiently “diverse”.

Think I’m exaggerating? Read the whole djangoconcardiff thread. What’s there is totalitarianism in miniature: ideology is everything, merit counts for nothing against the suppression of thoughtcrime, and politics is conducted by naked intimidation against any who refuse to conform. Near the end of the conversation djangoconcardiff threatens to denounce Rosario to the board of the Django Software Foundation in the confused, illiterate, vicious idiom of an orc or a stormtrooper.

It has been suggested that djangoconcardiff might be a troll emulating an SJW, and we should thus take him less seriously. The problem with this idea is that no SJW disclaimed him – more generally, that “Social Justice” has reached a sort of Poe’s Law singularity at which the behavior of trolls and true believers becomes indistinguishable even to each other, and has the same emergent effects.

In the future, the hacker whose community standing the SJWs threaten could be you. The SJWs talk ‘diversity’ but like all totalitarians they measure success only by total ideological surrender – repeating their duckspeak, denouncing others for insufficent political correctness, loving Big Brother. Not being a straight white male won’t save you either – Roberto Rosario is an Afro-Hispanic Puerto Rican.

We must cast these would-be totalitarians out – refuse to admit them on any level except by evaluating on pure technical merit whatever code patches they submit. We must refuse to let them judge us, and learn to recognize their thought-stopping jargon and kafkatraps as a clue that there is no point in arguing with them and the only sane course is to disengage. We can’t fix what’s broken about the SJWs; we can, and must, refuse to let them break us.

(Roberto Rosario, Meredith L. Patterson, and Rick Moen assisted in the composition of this post. However, any errors are the sole responsibility of the author.)

Nov 08

Status signaling and cruelty to betas

I find myself in the embarrassing position of having generated a theoretical insight for a movement I don’t respect very much.

My feelings about the “Red Pill” movement are a lot like my feelings about feminism. Both started out asking important questions about why men and women treat each other badly. Early on, both began to develop some answers that made sense. Later, both movements degenerated – hijacked by whiny, broken, hating people who first edged into outright craziness and then increasingly crossed that line.

But the basic question that motivated the earliest Red-Pill/PUA analysis remains: why do so many women say they want nice guys and then sexually reward arrogant jerks? And the answer has a lot of staying power. Women are instinctive hypergamists who home in on dominance signaling the way men home in on physical pulchritude. And: they’re self-deceivers – their optimal mating strategy is to sincerely promise fidelity to hook a good-provider type while actually being willing to (a) covertly screw any sexy beast who wanders by in order to capture genetic diversity for their offspring, and (b) overtly trade up to a more dominant male when possible.

(This is really complicated compared to the optimal male strategy, which is basically to both find a fertile hottie you think you can keep faithful and screw every other female you can tap without getting killed in hopes of having offspring at the expense of other men.)

What I’ve figured out recently is that there’s another turn of the vise. Sorry, nice-guy betas; you’re even more doomed than the basic theory predicts.

Continue reading