divabot

Dear Lazyweb! How do you manage keeping spring boot applications up to date?

We run an arseload of Java webapps. Our devs have taken a strong liking to spring boot, where everything including the Tomcat is uploaded as a JAR. A delight for them, but somewhat of a concern for the sysadmins who are the people first dealing with security issues.

So I've been asked to come up with recommendations to deal with this, and I haven't a clue as to how to do this other than laborious iterative checking, or automated versions thereof. Nor can I find recommendations.

Has anyone else got this problem or one like it? (Where applications are uploaded as a package that then runs.) What do you do?

Danese Cooper swung through London as she periodically does, so we met for breakfast at Gail's and I got a pancake. Grumbles about how people are a problem, bragging about children and (step-)grandchildren.

Still trudging through the book-shaped albatross. Looked at the site on Danese's phone and went "FUCK," it looks like a web page for ants. So I'll be installing a WordPress on that today then. Yet again doing the thing I tell everyone else not to, i.e. self-hosting WordPress. Bah.

The cover is the big blocker right now. I know what I want now, big block "business book" lettering and a coupla Sergio Aragones style silhouettes. Main blocker is my complete lack of artistic talent.

Also, I posted a rough draft of the Bitfinex section to Reddit /r/buttcoin and ... Mark Karpelès of Mt. Gox bought me Reddit Gold. :-O

you know that thing that firefox on linux does, where if you click on the scrollbar it doesn’t just take you up or down a page like every scrollbar in the past thirty-odd years, but instead moves the scrollbar slider to where you clicked?

this is a gtk+3 thing, because GNOME’s UI team are relentless desktop innovators.

workaround: add this to ~/.config/gtk-3.0/settings.ini :

[Settings]
gtk-primary-button-warps-slider=false

then restart firefox.

this being GNOME they will doubtless tch at people evading their superlative user interface vision and break it. until then, though, gtk+3 apps will work properly once more.

HT psych0naut

The book progresses. Current total: 17,472 words of body text. My target is about 500 usable words a day, so today I have to top 18,000. I expect it to make 20-25,000, at which point it gets edited and will probably end up 15-20,000. Amazing how much work one can put into a Kindle Short.

If you want to watch my ranting progress, it's on Tumblr with bits on Facebook. Here's a rough outline and to-do list.

I have a rudimentary page up for the book, with rough draft excerpts!

(it'll also probably end up actually for real being called "Attack of the 50 Foot Blockchain" because I was sitting in bed with arkady, who is an artist and got all inspired with pulpy cover art ideas. I may even need to do a pulp cover and a sober business cover.)

Answers to Frequently Asked Questions

A. Sadly, Amazon Kindle only accepts conventional currencies.

The DAO

You just learned chemistry and the first thing you built was a giant bomb and you can't understand why it blew up in your face.

– brockchainbrockshize, /r/ethereum¹

Not content with their existing sales of Internet fairy gold, some Ethereum developers at German blockchain startup Slock.it came up with an even more complicated scheme: The DAO (a Decentralized Autonomous Organization, with “The” as part of the name). This was a program running as a smart contract on Ethereum which would take people’s money and give it to projects voted on by the contributors as worth funding: a distributed venture capital firm.

The DAO’s Mission: To blaze a new path in business organization for the betterment of its members, existing simultaneously nowhere and everywhere and operating solely with the steadfast iron will of unstoppable code.²

Bold in original. I’m sure there are no obvious problems there that jump right out at you.

The DAO launched on 30 April 2016, got massive publicity and became the biggest crowdfunding in history, with over $150 million in ETH from 11,000 investors. Fourteen per cent of all Ether was in The DAO. It was also the most prominent smart contract of all time, achieving much mainstream press coverage. It proceeded to illustrate just about every potential issue that has ever been raised with smart contracts.

The DAO’s legal footing was uncertain (and widely questioned). Selling tokens in The DAO closely resembled trading in unregistered securities – particularly when DAO tokens themselves hit cryptocurrency exchanges – and the SEC had come down on similar schemes in the past. There was no corporate entity, so it would default in most legal systems to being a general partnership, with the investors having unlimited personal liability, and the creators and the designated “curators” of the scheme likely also being liable.

Shortly before the go-live date, researchers flagged several mechanisms in the design of The DAO that would almost certainly lead to losses for investors, and called for a moratorium on The DAO until they could be fixed.³

Worse, on 9 June a bug was found in multiple smart contracts written in Solidity, including The DAO: if a balance function was called recursively in the right way, you could withdraw money repeatedly at no cost. “Your smart contract is probably vulnerable to being emptied if you keep track of any sort of user balances and were not very, very careful.”⁴ This was not technically a bug in Solidity, but the language design had made it fatally easy to leave yourself wide open.

The principals decided to proceed anyway, Stephen Tual of Slock.it confidently declaring on 12 June “No DAO funds at risk following the Ethereum smart contract ‘recursive call’ bug discovery”⁵ … and on 17 June, a hacker used this recursive call bug to drain $50 million from The DAO. And nobody could stop this happening, because the smart contract code couldn’t be altered without two weeks’ consensus from participants. The price of ETH promptly dropped from $21.50 to $15.

(Tual posted on 9 July a hopeful list of reasons why the attacker might just give all the ether back, just like that. Because it would be in their rational self-interest.⁶ This didn’t happen, oddly enough.)

Ethereum Foundation principals discussed options including a soft fork or a hard fork of the code or even of the blockchain itself, or a rollback of the blockchain. The community wrangled with the philosophical issues: this contract had been advertised as “the steadfast iron will of unstoppable code,” but it appeared only one person had read the contract’s fine print in sufficient detail.⁷ Some seriously debated whether this should even be regarded as a “theft”, because code is law and intent doesn’t matter (unlike in real-world contracts operating in a legal system, or indeed in fraud law). Others merely argued that the integrity of the Ethereum smart contract system required that incompetent contracts, which The DAO certainly was, needed to be allowed to fail.

(The proposed soft fork solution was to blacklist transactions whose result interacted with the “dark DAO” the attacker had poured the funds into. This would have been an avenue for a fairly obvious denial-of-service attack: flood Ethereum with costly computations that end at the dark DAO. This approach could only have worked by first solving the halting problem.⁸)

The DAO was shut down soon after, and on 20 July the Ethereum Foundation — several of whose principals were curators of The DAO⁹ and/or heavily invested in it — changed how the actual code Ethereum runs on interpreted their blockchain (the “immutable” ledger) so as to wind back the hack and take back their money. The “impossible” bailout had happened.

This illustrated the final major problem with smart contracts: CODE IS LAW until the whales are in danger of losing money.

Ethereum promptly split into two separate blockchains, each with its own currency – Ethereum (ETH), supported by the Ethereum Foundation, and Ethereum Classic (ETC), the original code and blockchain – because this was too greedy even for cryptocurrency suckers to put up with. Both blockchains and currencies operate today. Well done, all.

Apologists note that The DAO was just an experiment (a $150 million experiment) to answer the question: can we have a workable decentralized autonomous organization, running on smart contracts, with no human intervention? And it answered it: no, probably not.

1 brockchainbrockshize. Comment on “Attacker has withdrawn all ETC from DarkDAO on the unforked chain”. Reddit /r/ethereum, 25 July 2016.

2 The DAO front page, archive of 22 June 2016. Yes, that’s after the hack. The page doesn’t say that any more.

3 Dino Mark, Vlad Zamfir, Emin Gün Sirer. “A Call for a Temporary Moratorium on The DAO”. Hacking, Distributed (blog), 27 May 2016.

4 Peter Vessenes. “More Ethereum Attacks: Race-To-Empty is the Real Deal”. Blockchain, Bitcoin and Business (blog), 9 June 2016.

5 Stephen Tual. “No DAO funds at risk following the Ethereum smart contract ‘recursive call’ bug discovery”. blog.slock.it, 12 June 2016. (archive)

6 Stephen Tual. “Why the DAO robber could very well return the ETH on July 14th”. Ursium (blog), 9 July 2016. (archive)

7 There’s an amusing (if probably just trolling) open letter purportedly from the attacker posted to Pastebin (archive) that makes this claim explicitly.

8 Tjaden Hess, River Keefer, Emin Gün Sirer. “Ethereum's DAO Wars Soft Fork is a Potential DoS Vector”. Hacking, Distributed (blog), 28 June 2016.

9 Stephen Tual. “Vitalik Buterin, Gavin Wood, Alex van De Sande, Vlad Zamfir announced amongst exceptional DAO Curators”. blog.slock.it, 25 April 2016.

CodeValley is the latest from the world of Blockchain™.

The "idea" is that you have a problem, so you put up a contract to fully-automated Vendors to supply the libs for a program to solve your problem. At no point does a coder have to write actual code apparently, it's all done by the machines ... somehow. All of this is paid for in penny shavings.

"This isn’t open source, and it isn’t closed source. It’s no source." (well, that's bracingly honest of them.)

Even Hacker News doesn't buy this shit. "the whitepaper reads something like what I'd imagine somebody trying to troll the software industry would write"

Here's the "whitepaper". It reads like a example of the CodeValley concept applied to marketing, or perhaps Hacker News fed to a Markov chain. (And be sure to "View Source" on that page.)

To be fair, it's reviving an old hype: "this will end programming! All you need to do is fill in a form and define the problem." This was first said about COBOL. I think the last time anyone said it quite that bluntly was The Last One in 1981.

Putting it on Blockchain™ is of course the obvious next step, and suggests a network of autonomous software vendor programs seeking out old sucker scams to put on Blockchain™.

So, what is CodeValley? It is literally code from thin air. Here is the lead CodeValleyer explaining it. Now it sounds saneish up to a point — you work out what lib-like things you need, those are contracted out to a Vendor. That's the bit where you'd expect a human would be doing the job. But no:

I just wanted to stress one last time that that trickling down goes all the way to the hardware. There is no more writing of code, as we have outsourced (and outsourced and outsourced) the design of the program until it is so detailed that only bytes need to be placed (or binary CPU instructions). Pretty cool huh?

So cool it's literally fucking magic.

Looking at how it's supposed to work, the lead proponent says:

A developer's IP — the decisions they automate their Vendor to make and the supplier that Vendor is automated to contracted — stays protected inside their Vendor program. We are not privy to how you designed your Vendor any more than any other user in the network is.

You fill in a form, and define the problem. (This is assumed to constitute a creative work you have a defensible copyright in.) Then you send this to a multilayered compiler chain that puts it together at byte level. You might think that THIS IS LITERALLY WHAT PROGRAMMERS DO, and that "do what I mean" is the entire hard bit of programming no matter how many layers it's on top of, but obviously you need enlightening as to the magic of Blockchain™.

There's a whole advertising subreddit: /r/codevalley

I'm wondering who the target market is. Sucker VCs? Developers themselves?

This sort of sci-fi (not SF, but bug-eyed monsters and special effects) approach was the sort of thing people were talking about before open source became popular, a fractal micropayments nightmare world where everything contracted to everything else for penny shavings. "Imagine if we had micropayments in open source for every lib that every lib you use uses, how much better it would all work." Except now they've automated it on Blockchain™. Left-pad on Blockchain™.

The thing that really struck me about Hugo vote-stackers the Sad Puppies was founder Brad Torgersen’s lament that he could no longer tell from the cover of a science fiction novel what it was about. So I wrote a rant on Tumblr and just put a more polished version up on Rocknerd and it's quite popular. Intro:

I won’t try to explain the entire saga of the Sad Puppies and their Rabid Puppies offshoot. But in short, a bunch of reactionary science fiction authors were upset that people other than white straight guys were getting their stories noticed, so started a backlash to take over the Hugo Awards through slate voting, and made stupendous dicks of themselves.

If anyone knows where would be appropriate on Reddit, please post this there, let's give the 32GB server a good old workout. It survived a Scalzi-dotting after all.

I also have a Castalia House review on Eruditorium Press tomorrow, which was way too much fun to write (in a "here, look what I just stepped in" sort of way).

Yet another in the series "stuff I'm blogging so future poor buggers can find it in Google."

If you've seen this supercilious and not actually helpful error from ant:

Cause: Could not load a dependent class com/jcraft/jsch/Logger
It is not enough to have Ant's optional JARs
you need the JAR files that the optional tasks depend upon.
Ant's optional task dependencies are listed in the manual.
Action: Determine what extra JAR files are needed, and place them in one of:
-/usr/share/ant/lib
-/home/fun/.ant/lib
-a directory added on the command line with the -lib argument
Do not panic, this is a common problem.
The commonest cause is a missing JAR.
This is not a bug; it is a configuration problem

— it is a bloody bug, and it's a bug in Ubuntu that hasn't been fixed in years.

1. Install the relevant packages: sudo apt-get install ant-optional libjsch-java
2. The symlink to make it work! sudo ln -s /usr/share/java/jsch.jar /usr/share/ant/lib/

The bug is that it should make that symlink. (The other bug is that ant-optional should have libjsch-java as a dependency and doesn't.)

installing and setting up xubuntu 16.04. why the hell does vim-gtk have apache2 as a “suggested package”.

to make capslock a control key, run /usr/bin/setxkbmap -option "ctrl:nocaps" from Session and Startup->Application Autostart, and fuck you xubuntu for still not including an interface for this basic x11 config shit. you’re darned lucky you haven’t comprehensively sodomised the pooch like gnome or kde.

(i'd be running xfce debian if it wasn't as bloody ugly as sin and mint if they'd ever heard of security.)

how the fuck do you set preferences for nautilus when you’re not actually running gnome. edit: the answer: gsettings set org.gnome.nautilus.preferences default-folder-viewer 'list-view'

My most and least favourite system that I have ever had to administer involved an embedded copy of OpenOffice.org (originally a Solaris SPARC binary of 3.1, later the Ubuntu 10.04 package of 3.2), started from a cgi-bin Perl script as needed, to convert MS Word .doc files to PDFs.

This is because MS Word .doc is such an utter shower (specification PDF, 563 pages) that it takes something approximately the size and complexity of MS Office to deal with it. And OOo is certainly that.

(We thankfully talked them out of making us install embedded MS Office instead, by offering to charge them the cost of a Windows sysadmin to run it. Never say no!)

The .doc files were end users’ edited versions of deeply defective source .rtf files generated from XML and XSLT by Apache FrontOffice, that wouldn’t open properly in anything else but MS Word. I wish I still had some, they’d be great bug fodder to submit to LibreOffice.

Even though this system was released in 2009, it never did manage to cope with MS Word 2007 .docx files.

It also kept said .doc files in a Subversion repo. Which was not operated using svn binaries, but twiddled by the relevant Java libs.

The cgi-bin Perl script was because the “generate PDF” functionality required a process fork, which hit a bug in Solaris SPARC Java 5 and 6 that tried to make a copy of the entire Tomcat process in physical RAM, which of course ran out of memory and failed. OOo won’t run if the user’s home directory isn’t writable, so on Ubuntu this required “sudo chown www-data /var/www“. Thankfully we weren’t using that as the webroot.

When I asked the (very good) senior developer about these design decisions, the pained expression on his face as he detailed why all these terrible ideas were the least-worst options was quite exquisite.

The purpose of a specification is to nail down the vague hopes and dreams of the business unit that’s just seen a fat, juicy market opportunity. In this case, they wanted a magical flying unicorn pony that ejaculated rainbows. The spec went into quite some detail about the desired properties of the wing feathers.

What they ended up with, of course, was a retired seaside donkey that had been tarred and feathered, a cornetto stuck on its head and fed food colouring and laxatives.

One part of the original specification of the system was to take updated versions of the source .rtf files and merge them with the user’s free-form .doc files such that the end users’ annotations would be preserved and stay correct. That is, the spec implicitly required the implementation of strong artificial intelligence. We told them that bit would have to be implemented later.

I quite delighted in deleting all traces of that system personally when, after five years’ soaking up money for two institutional customers ever, it was finally decommissioned.

a tumblr querent asks:

the question of why there haven't been any sociological studies of tumblr social justice culture is a good question- and why hasn't there been a news report on like, tumblr communists as a subculture? you'd think at least fox news would have something to say about that.

over on this post, someone notes “Sociology as a discipline is still reeling after so many fine sociologists disappeared in to Second Life and have yet to emerge.“

really they were a plague in the early ‘90s.

this was just before nirvana hit big. it was blindingly obvious to everyone in indie rock that someone was going to hit super-big at some point. will it be sonic youth! they got a major deal! … and no, goo sold pretty well but not spectacularly. will it be mudhoney! … no, they did two great singles and a good cover and the rest was uh okay. … nirvana? the ones who did that crappy album bleach? how the hell did they get good. wow.

(i remember the first time i heard “smells like teen spirit” in early 1992. i was in a pub beer garden discussing a prospective road trip with friends. [if anyone reading this has a copy of The Good Fight #1, please send me a copy of my bit, which writes up the story.] it came on the radio, which was the local AM chart station. my first thought was “oh, the pixies scored a mainstream hit? well done, pixies.”)

so it was a scene that (a) knew important stuff was brewing (b) was obsessively introspective with a ton of discourse. i mean, i was a ziner. it was very very slow moving tumblr. so we really really wanted to TELL THE WORLD ABOUT OUR STUFF.

enter sociology students desperate for material. which they then made a fucking hash of.

i think we were hoping for Proper Academic commentary that would tell us interesting and useful stuff about ourselves. instead we were fodder for terrible useless rubbish that was created to be written and not under any circumstances read.

(open source software got the same treatment, for a parallel. parasitical publication-credit churns like First Monday. everyone was so hoping for something useful to the discourse that was already going on, not intelligence-insulting inanity that didn’t understand the first thing of what it was talking about and didn’t care.)

after a couple of those i started grilling them when they called and saying i wouldn’t help unless it was helpful to the existing zine world discourse. or at least not inane bullshit. (i forget my precise wording.)

what sociologists i encounter these days seem much better-behaved, probably because they realise their subjects can and will in fact talk about them afterwards. there’s some awesomeness out there. i recommend paul hodkinson, who got his ph.d thesis on goth published as a really very good book that continues to sell okay, a.k.a. stupendously well for a ph.d thesis. is also a top bloke. of course, he knew very well all his friends were going to read it with an acerbic eye.

for news, um i suppose we have breitbart still trying to make gamergate a thing