Concurrently Chaotic

C is the modern assembly language for many architectures, and still the most useful computer language for me. C does not have a rigid grammar and has a lot of variants and local dialects, and have revised a few times including the old UNIX C, ANSI C 1989 which first introduced prototypes, and C99.

Finding out the de-facto standard elements of C is a complicated work. You can find a bunch of different indentation and writing styles on C code. I do not recommend a specific coding style in this article; I can only recommend you need to follow the mainstream style when working in a project.

Sometimes you have to read the books for discovering what is the most right thing to do. I recommend following books for C programming now:

• C: A reference Manual (5th edition) (2002), which has a lot of precise and detailed examples on ambiguous usage;
• Secure Programming Cookbook for C and C++ (2003), which explains what to do and what not to do to write secure code; and
• Advanced Programming in the UNIX Environment (2nd Edition) (2005), which explains usages of modern UNIX system calls and libraries.

For practical programming, however, depending on books is not enough. Actually those books I recommended above are 5 to 7 years old as of 2009, so if you want to know the cutting-edge details of programming, you should read the latest software. Consulting a C compiler manual and well-written source code such as that of BSD kernels is a must if you want to write an efficient code (those are freely available).

One thing to which you've got to pay special attention is that books are eventually but surely getting outdated. Books are not the Web articles; they are static and will not change. The lifespan of a reference book for computer science is typically very short these days, due to the rapid change of technologies. Books about C is not an exception either.

And I should confess that a few days ago I decided to sell the following old worn-out books because I found out them simply outdated (and I no longer recommend the following two books any more):

• The C Programming Language (2nd edition) (1988)
• The Standard C Library (1991)

The reason that I found them outdated were as follows:

• They are old, written in approx. 20 years ago, and they do not reflect the changes of C99 and other additional elements;
• Not mentioning secure programming at all, including
  • avoiding reference to non-existent data objects,
  • preventing buffer overflows,
  • limiting the length of a string;
  and
• The C library structure and source have been changed a lot for these 20 years.

Frankly speaking, I loved those old books, especially which I referred to the most during my apprentice time of learning the language in the late 1980s. Those books were the only source before the Web. I had to repeatedly read the old bestsellers many times to discover the details. I do respect the authors of those books. They are pioneers of UNIX and C programming.

Nothing is eternal, however; and I suggest use to stop using outdated reference books ASAP for every subject, not only for programming.

posted at: 12 Aug 2009 | path: /security | permanent link

I noticed Twitter was dead during 13Z-15Z 6-AUG-2009. (Z = UTC hours, BTW) Facebook was also affected. Other major world-wide social web sites including Livejournal and Blogger/blogspot.com were victims of a denial-of-service (DoS) attack altogether.

Elasticvapor.com has an article which says the attack was to one Georgian account from Russia, and that the attack was multi-staged through BGP and DNS vectors. I also feel the attack is not just a simple HTTP DoS, though unconfirmed.

DoS attacks are so popular on the Internet that I've got nothing to talk about. You can even hire a botnet to make a specific attack. Nevertheless, DoS attacks to popular sites do impact on our lives. Watching how people including myself responding to the simultaneous attacks to social web sites disclosed that we were living in a vulnerable society depending on just a couple of domains and IP networks.

I always ask a question to myself when I see a global service disruption event: isn't Internet a distributed system with adequate redundancy? Unfortunately, the answer is, no. Taking down a few systems of the social web will effectively paralyze the whole networking of people. Those systems have become a set of points of failure.

Regaining redundancy on Internet is not easy. Making a redundant system with multiple layers of technologies is a very hard task. The designer needs to put redundancy on every layer of the system; host machines, identifiers (such as IP addresses and domain names), physical networks, logical/overlay networks, data (or objects), etc. Just a simple replication will add a big price to an existing system. Not many sites can afford this.

Nonetheless, we've got to do the replication ASAP anyway; the Twitter attack incident tells us that replication, either manual or automatic, of data or identifiers, is still critical to provide alternative routes once the popular systems are took down.

And I now feel much safer to know that I've got my own Web site space other than external blogs out of my control. Diversifying the data and identifiers by replication is the easiest, if not only, way to deal with failures and attacks, which are inevitable in the hostile world of Internet. Maybe I need to make some copies of my articles put on the external sites into this blog too.

posted at: 08 Aug 2009 | path: /security | permanent link