SF PostgreSQL Conference

img_1796Recently beautiful South San Francisco hosted the annual Silicon Valley PostgreSQL conference, a gathering of the world’s top open-source database nerds.

Some of the fantastic talks I attended were:


A deep dive into the myriad features of the built-in postgres procedural language, PL/pgsql. It’s a sort of funny-looking but very capable and featureful language that lets you very easily mix procedural code with SQL statements and types based on your rows and tables. It’s something I’ve used before in a very limited form before but I really had no idea how many standard scripting language features were available, including things like “auto” and composite types, multiple return values, IN/OUT/INOUT/VARIADIC parameters, automatic function AST and SQL prepared statement caching, anonymous functions. PL/pgsql is very handy for trigger functions, administrative functions (like partitioning tables on a periodic basis) and distilling complex logic into reusable pieces. There are some important caveats about function performance, so if you’re planning on calling them often be sure to read up on what you should and shouldn’t do. Try to avoid functions calling other functions if possible, take advantage of the advisory keywords like IMMUTABLE and figure out if it’s okay to serialization inside of a transaction boundary.




Paxos is a distributed consensus algorithm and its integration into postgres as an extension gives you the nifty ability to paxosly-replicate tables and use a paxos(key) function to find out what value a majority of nodes report back with the option to use constraints as well. Seems like it could be useful for things like master elections, geographically disparate systems that have low latency for local writes but eventually become consistent, and times when you only care about an upper or lower bound (easy with the constraints). Not sure if I’ll ever have a need for it or not.



Went to a talk on using go with postgresql. There’s a nice driver for it. Mostly people seem to do raw SQL queries, using ORMs like gorm doesn’t seem like a very popular option. I imagine largely because people using go are doing so because they care about performance, and because ORMs are going to obviously be more limited in a feature-constrained compiled language. Speaker claimed his go rewrite of pgnetdetective was a bajillion times faster than the python version.

Becoming a PostgreSQL Guru:

We all want to be the proverbial unixbeard guru in the corner office who acolytes petition to receive tidbits of wisdom. A big ingredient in achieving enlightenment involves knowing what the new aggregate functions (see sections 7.2.4 and 7.2.5) can do for you. There are easy ways to auto-generate hierarchical aggregates by groups of different ranges and sets, using GROUPING SETS, CUBE, ROLLUP, LATERAL JOIN, CTE and window functions. If you find yourself needing to generate some reports there’s a really good chance some of these new features can speed things up a huge amount and require less code.



Postgres has many knobs related to how safe you want to be with your data. These are great to know about in some detail because often you will have different demands based on your application or business. Naturally they have tradeoffs so knowing how to make informed choices on the matter is crucial. For example if you’re a bank, you may not want to finish a transaction until 3-phase commit happens on all write replicas, but if you have some web session cookie table or log table on a single box you may want to make it SET UNLOGGED to vastly improve performance, with the caveat that you may not have perfect crash recovery of the latest writes if something terrible happens. Great that postgres gives you lots of options in these areas.


Supporting legacy systems:

A gentleman from a consulting company shared his experiences as a person hired by companies to come in and support or maintain or migrate extreme legacy systems and how useful postgres is in that process, along with some Java toolkit for bridging old systems. He namedropped things like FoxPro, JCL, COBOL, Solaris and a bunch of other things I didn’t recognize. I’ve always thought it’d be a fun job to take these ultra old systems that companies entirely depend on and are desperate to get off of and help them out. It’s not hip like writing new JavaScript build systems or whatever but I bet there’s real good money in it. One thing that’s always stuck in my head was how during the California budget crisis ten years ago or so, the governor wanted to pay all state employees minimum wage but the comptroll-er said it couldn’t be done. You see, the state’s payroll system runs on COBOL and their two job reqs have gone unfilled for years and years. Probably because all COBOL devs are dead or retired. It’s written out in plain English though so I don’t get what the big deal is…



In conclusion it was a fine set of talks, I wish I could have seen some of the others that were going on at the same time in other rooms. The SF Postgresql Meetup has more of these same types of great informative lectures going on year-round and I highly recommend attending them if this sort of stuff gets you pumped up too.


0wned By Put1n

This so-called reporting on the DNC hack really grinds my gears.

First let me preface this by saying I am not claiming to know who hacked the DNC, although it’s probably the Guccifer 2.0 person who’s been blogging about it the entire time. Maybe it was actually people working in the FSB and GRU for the Kremlin. That is beside the point. The point is the evidence that has been trotted out is of extremely questionable quality, the people reporting on it are clueless muppets who don’t know shit about computers, all sources point back to one guy who is part of the company paid by the DNC to spin things, and you should be highly skeptical of these claims. Again, maybe Russians did do it, I really have no idea obviously. But the absurd claims being said and printed really need some fact checking. Seems to be all the rage these days so let me try my hand at it here.

Let’s talk about what is being reported!

In the press there has been an unending stream of articles blaming Russian and specifically Putin himself for the hack. Usually with a photo of Putin and a stock image of a faceless male in a hoodie typing on a laptop with numbers flying out of it as he hacks the shit out of governments.
All of these stories lead back to the same person, the CTO of CrowdStrike which got called in and paid to do PR damage control for the DNC. Every article about this for a long time had only his blog post as evidence, nothing more.


Now attributing hacks is a really, really, really hard problem. I cannot stress this enough. It is incredibly difficult to be sure of who actually was behind a hack. More recently they have claimed that the IPs that were used came from Russia, and they used tools that they believe were used by the same russian hackers previously. Now if you know anything about computers at all you wouldn’t be one of these muppet “reporters” and you’d probably have a real job, and you’d also know that isn’t remotely convincing evidence.
There is an atrocious Buzzfeed article (why) that makes really goofball claims, including attributing some totally random unrelated ISIS hack was actually done by the same russians because a machine believed to have been compromised by the same russkiis was used. Well guess what, if a computer is hacked by one person, usually it’s backdoored and lots of services are enabled and any firewalls are removed and it’s open for anyone else to use who stumbles across it. But of course what would one expect from Buzzfeed. Also I suggest not listening to any other Cyber Journalists, and that goes doubly true for Brian Krebs who still has a vendetta against me (really, I asked him recently) for trolling him and many others and nearly ending his career with some off-the-wall claims.
You can read the article here but I don’t really recommend it because it will make you stupider: https://www.buzzfeed.com/…/meet-fancy-bear-the-russian-grou…


Now we have Mrs. Clinton saying Putin is trying to destabilize the election by hacking the DNC to get Trump elected. Says 17 intelligence agencies “confirmed” it. Really she means DNI Clapper, noted perjurer, who said “We believe, based on the scope and sensitivity of these efforts, that only Russia’s senior-most officials could have authorized these activities.” Words matter, especially ones like “confirmed” when you’re talking about attributing hacking. You know, the thing that’s really, really, really hard to be certain about. Note that “confirmed” does not appear anywhere in that statement.
The FBI says Russians probably did it. I assume that they are going off of the CrowdStrike report although who knows. They also claim that North fucking Korea hacked Sony based on hard evidence such as “the FBI discovered that several Internet protocol (IP) addresses associated with known North Korean infrastructure communicated with IP addresses that were hardcoded into the data deletion malware used in this attack”.
You know, the DPRK where the entire country’s phone system works by means of human fucking switchboard operators.

Little is also made of the fact that there’s actually someone calling themselves “Guccifer 2.0” (fun fact: Mr. 1.0 lied about hacking Mrs. Clinton’s email for lulz, which set off that whole wacky investigation into her email servers) who’s been maintaining a blog this whole time leaking documents from the hack and lolling at the ineptitude of people making wild claims about multiple russian intelligence agencies being behind it all.
Guccifer 2.0 posted this message while releasing the hacked documents:

“Worldwide known cyber security company CrowdStrike announced that the Democratic National Committee (DNC) servers had been hacked by “sophisticated” hacker groups.
I’m very pleased the company appreciated my skills so highly))) But in fact, it was easy, very easy.
Guccifer may have been the first one who penetrated Hillary Clinton’s and other Democrats’ mail servers. But he certainly wasn’t the last. No wonder any other hacker could easily get access to the DNC’s servers.
Shame on CrowdStrike: Do you think I’ve been in the DNC’s networks for almost a year and saved only 2 documents? Do you really believe it?
Here are just a few docs from many thousands I extracted when hacking into DNC’s network.”

On the CrowdStrike blog they responded by claiming the blog must be a russian disinformation smokescreen. Okay.
Some more of the “evidence” released includes statements like “Fancy Bear has used sophisticated — and expensive — malware during its operations”, which of course the russian government provides (while also stating that the operatives are at arm’s length from the government and don’t really have contact with the government, not sure how that works). I am not sure what to make of this statement. I think they are referring to 0-days? Then they say the DNC was hacked because someone made a Google Apps login page at “accoounts-google.com“. Now domains aren’t free but like, I don’t think you gotta have a nation-state-sized bank account to afford one.
They even go so far as to make the claim that not one commie intelligence agency but BOTH the КГБ I mean FSB AND the GRU both hacked the DNC by accident at the same time. Wow! Incredible
CrowdStrike also helpfully provided the IoCs, hashes of the trojans used by the hackers. I tried looking up some of the hashes and found nothing but references back to the same story. Maybe they know something we don’t, but they haven’t really said what.


Also let us not forget that there has been a constant, unrelenting media and economic assault on the pinko bastards for years and nothing would make officials happier than to have more villainous deeds to pin on Putin. He’s a dick, no doubt, but one should consider the interest our government has in reaching a certain conclusion. Many times in recent history these sort of motivations have produced their desired conclusions which turn out to be utterly incorrect. Remember that business about WMDs in Iraq? Or the utter failure to predict the Soviet Union collapsing because the director of the CIA fired anyone who said the Soviets weren’t a giant powerful menace? (ok I don’t remember that one since I was like five but you get my point).

What is my point again? My point is that you should look at these claims with a very critical eye. Remember that attributing hacking is really, really, really hard. It is also trivial for someone to forge an attack to look like it was done by another person or government when we allow the standards of evidence to be so low. Or even quite likely, simply someone randomly reusing an owned host or rootkit source that was left behind.
Be wary of anyone claiming to know who hacked whom. Be extra wary of claims that the hackers are working under the explicit direction of a foreign government. Sometimes they are! This is not in dispute. But it’s incredibly difficult to be confident of these things, it’s incredibly easy to set someone else up, and anyone who earnestly uses the word “cyber” in their speech should be immediately suspect.
Take this shit seriously because it is getting more and more serious. NATO has said that hacking is an act of war that can be retaliated against with violence.
I promise you that every evil troll antisocial misanthrope (of which there is no shortage of) who reads these proclamations is immediately thinking about just how easy it would be to set off WWIII. I’d really prefer that not happen. If people demand a higher standard of evidence and attribution that may make a real difference.

I wrote about this previously, going into more depth regarding the attribution problem, which as I mentioned, is really, really, really hard.

Now please enjoy this music video.


What’s Wrong With the Affordable Care Act

The Affordable Care Act, also known by many as Obamacare really set this country’s healthcare system back in a major way. Let me try to explain why I have such an issue with it.

The biggest problem is that it is not a single-payer (“government-funded”) healthcare system like in every other first world country, not to mention very many third world countries too. This is the only correct system. If you believe our system of health insurance is more or less functioning properly and nicely and efficiently and providing the best bang for our personal and government-contributed bucks, you are utterly misinformed.

Working in healthcare IT for many years has given me a small glimpse into the madhouse of medical billing in America. The system is fucked. Ask anyone in healthcare and they’ll tell you the same thing. It’s all dumb. The thousands upon thousands of different insurance plans, the multitude of types (government, HMO, PPO, Discount Card, Indemnity, POS, EPO, Medicare, Medicare Advantage, Medi-Cal, Medicaid, Premier, Worker’s Compensation…) have different rules about reimbursement and fracture the American people’s ability to negotiate good deals on drugs and services. There is wild variation in prices due to an utter lack of transparency. The scheme of employers providing healthcare for their workers makes no logical sense, hurts competitiveness and massively screws over anyone who loses their job, unless they want to pay COBRA to keep their coverage (now around $1000/mo for some). Medical bills are submitted to third parties on all sorts of different paper forms, often faxed around. Oh yes, faxes are considered state of the art when it comes to medical billing and health insurance companies. In short, the current system would only be considered acceptable by anyone who has no idea how much better pretty much everyone in the developed world has it than us. This is reflected by popular opinion, as of 2016, showing a majority of Americans just want a normal federal-funded single-payer healthcare system. It’s the obvious solution, everybody knows it. So why don’t we have it?

Well, we have this health insurance scheme instead. Instead of the government providing basic healthcare to everyone it only provides healthcare to some people through a bewildering array of disparate systems. Poor people, people with kids, poor people in California, seniors, veterans, congresscritters, that sort of thing. If you don’t fit into one of those you can buy healthcare insurance instead of maybe get it provided by your employer if you’re lucky. A plan can cost several hundred dollars a month and may or may not include vision and dental insurance too. There is a provision of the ACA that says everyone must have health insurance or face a steep tax penalty (2.5% of your total household adjusted gross income). As a result, everyone must have health insurance.

Now I, just a lowly taxpayer, wonder if everyone has insurance, what exactly are the insurance companies doing? What benefit do we as a society gain from a universal system of insurance? Well, supposedly the health insurance companies price risk appropriately and disburse funds for claims.

Probably the main indicator of your likelihood of filing a lot of expensive claims are your pre-existing conditions. Like if you have cancer or some rare disease, you’re going to cost a lot of money. Before the ACA this would make it very hard to get normal health insurance because you would be a terrible policyholder from the insurance company’s point of view. One of the truly fantastic things, and at the same time one of the most subtly problematic things in the ACA is that it disallows pre-existing conditions from driving up your premiums or being denied coverage. This is actually really great news for seriously ill people, and it deserves being said that it has given (relatively) reasonably-priced healthcare to millions of people who need it the most. The end result appears to be a major net positive for society, and it really is. Taken in a vacuum this is a noble and wonderful thing. But it also undermines the entire argument for the extant system.

Now if everyone has insurance, and the insurance companies are not allowed to properly price risk, what function do they provide? If they cannot perform any real actuarial purpose then they are essentially clogging the arteries of our healthcare system, siphoning off vast quantities of money, wasting everyone’s time and collecting a massive payoff while decimating the quality of our healthcare.

Healthcare providers just want to care for people and, well, provide health care. That’s why they got into it and that’s what makes them put up with the years of school and massive debt and internships and all the rest. Once they actually try to practice medicine though they are faced with the intractable and thankless task of trying to deal with health insurance companies. Filing claims, getting denied, re-filing claims, telling patients you can’t see them because their employer went with the wrong insurance company or plan type, telling seniors they can’t get the medicine they need, buying ink for your fax machine, dealing with your medical billing intermediary company, upgrading to ICD-10, and on and on. This takes time and costs a great deal of money. It is not good for anyone except for the health insurance companies because it gives them a reason to exist.

The potential saving in efficiency, the massive gain in time of providers and nurses and office managers, the insanely powerful bargaining power, the standardization of billing forms and reimbursements would be some of the incredible benefits of having a coherent national health system. My problem with the ACA is that it cements this horrible mess of insurance providers. Its smaller improvement in expanding coverage means that we can pretend our system works for longer now instead of getting the sane and efficient system that we desperately need. That is why I have a problem with it. It powers the vacuum machine stuck in our pockets by health insurance companies. It entrenches the current corrupt system. It makes it that much harder for us to right it. The current shit abyss of healthcare probably resembles that of our legal system. It’s something most of us healthy people don’t have to get too acquainted with, so we don’t demand much change because it doesn’t affect us yet. But when you fall into this pit you’re going to wonder why our country is so fucked up. Even having health insurance won’t protect you from bankruptcy, of which health care is now the number one cause in America.

If a majority of Americans want a single-payer system, and we’re the only country that hasn’t gotten it yet, why do we still have this joke system of rent-seeking insurance companies taking their fat slice of the $2.9 trillion dollars a year we spend on health care (projected to shoot to $5.2 trillion in 2023)? Well, for one thing the opinions of the bottom 50-70% or so of Americans have no discernible impact on policy that gets made at the federal level. As in, the majority of Americans are literally disenfranchised because politicians do simply do not care what they think.

In 2007 health insurance companies were major donors to Obama’s and Hillary Clinton’s campaigns to become president. In the 2012 campaigns the insurance industry (with Blue Cross as the largest individual) contributed “a record $58.7 million to federal parties and candidates as well as outside spending groups” according to OpenSecrets. Draw your own conclusions.

MarketWatch has a bunch more fun facts about specific major problems with our health insurance system.

projectM: Open-Source Music Visualization

If you remember the old windows music player Winamp, it came with an amazing visualizer named Milkdrop written by a guy at nVidia named Geiss. This plugin performed beat detection and splitting the music into frequency buckets with an FFT and then fed that info into a randomly-selected “preset.” The presets are equations and parameters controlling waveform equations, colors, shapes, shaders,”per-pixel” equations (not actually per-screen-pixel, rather a smaller mesh that is interpolated) and more.

Most of the preset files have ridiculous names like:

  • “suksma + aderassi geiss – the sick assumptions you make about my car [shifter’s esc shader] nz+.milk”
  • “lit claw (explorers grid) – i don’t have either a belfry or bats bitch.milk”
  • “Eo.S. + Phat – chasers 12 sentinel Daemon – mash0000 – multi-band time-distortion aurora granules.milk”
  • “Goody + martin – crystal palace – Schizotoxin – The Wild Iris Bloom – mess2 nz+ i have no character and feel entitled to one.milk”

Milkdrop was originally only for windows and was not open-source, so a few very smart folks got together and re-implemented Milkdrop in C++ under the LGPL license. The project created plugins to visualize Winamp, XMMS, iTunes, Jack, Pulseaudio, ALSA audio. Pretty awesome stuff.

This was a while ago, but recently I wanted to try it out on OSX. I quickly realized that the original iTunes plugin code was out of date by about 10 major versions and wasn’t even remotely interested in compiling, not to mention lacking a bunch of dependencies built for OSX.

So I went ahead and updated the iTunes plugin code, mostly in a zany language called Objective-C++ which combines C++ and Objective-C. It’s a little messed up but I guess it works for this particular case. I grabbed the dependencies and built them by hand, including static versions for OSX in the repository to make it much easier for others to build it (and myself).

Getting it to build was no small feat either. Someone made the unfortunate decision to use cmake instead of autotools. I can understand the hope and desire to use something better than autotools, but cmake ain’t it. Everything is written in some ungodly undocumented DSL that is unlike any other language you’ve used and it makes a giant mess all over your project folders like an un-housebroken puppy fed a laxative. I have great hope that the new Meson build system will be awesome and let us all put these miserable systems out to pasture. We’ll see.

Screen Shot 2016-08-02 at 9.59.55 PM.png
cmake – not even once

Long story short after a bunch of wrangling I got this all building as a native OSX iTunes plugin. With a bit of tweaking and tossing in the nVidia Cg library I got the quality and rendering speed to be top-notch and was able to reduce the latency between the audio and rendering, although I think there’s still a few frames of delay I’d like to figure out how to reduce.

I wanted to share my plugin with Mac users, so I tried putting it in the Mac App Store. What resulted was a big fat rejection from Apple because I guess they don’t want to release plugins via the app store. You can read about those travails here. I think that unpleasant experience is what got me to start this blog so I could publicly announce my extreme displeasure with Apple’s policies towards developers trying to contribute to their ecosystem.

After trying and failing to release via the app store I put the plugin up on my GitHub, along with a bunch of the improvements I made. I forked the SourceForge version, because SourceForge can go wither and die for all I care.

I ended up trying to get it running in a web page with Emscripten and on an embedded linux device (raspberry pi). Both of these efforts required getting it to compile with the embedded spec for OpenGL, GLES. Mostly I accomplished this by #ifdef’ing out immediate-mode GL calls like glRect(). After a lot more ferocious battling with cmake I got it running in SDL2 on Linux on a Raspberry Pi. Except it goes about 1/5fps, lol. Need to spend some time profiling to see if that can be sped up.

I also contacted a couple of the previous developers and the maintainers on SourceForge. They were helpful and gave me commit access to SF, one said he was hoarding his GLES modifications for the iOS and Android versions. Fair enough I guess.

Now we’re going to try fully getting rid of the crufty old SourceForge repo, moving everything to GitHub. We got a snazzy new GitHub homepage and even our first pull request!

My future dreams for this project would be to make an embedded Linux device that has an audio input jack and outputs visualizations via HDMI, possibly a raspberry pi, maybe something beefier. Apparently some crazy mad genius implemented this mostly in a FPGA but has stopped producing the boards, I don’t know if I’m hardcore enough to go that route. Probably not.

In conclusion it’s been nice to be able to take a nifty library and update it, improve it, put out a release that people can use and enjoy, and work with other contributors to make software for making pretty animations out of music. Hopefully with our fresh new homepage and an official GitHub repo we will start getting more contributors.

I recorded a crappy demo video. The actual visualizer is going 60fps and looks very smooth, but the desktop video recorder I used failed to capture at this rate so it looks really jumpy. It’s not actually like that.

Concerning Attribution of Hacking

Organizations are getting hacked left and right these days, and that’s just what’s in the news. Naturally most organizations and people that get hacked either don’t know it or don’t want to tell anybody. It should be no surprise to anyone that the DNC’s emails got leaked. As is depressingly routine though, the news coverage is both sensationalist and lacking in depth. In this case I’m specifically referring to all of the media saying that the Russians did this with big pictures of Dr. Evil Vladimir Putin to go along with them.

Maybe they have sweet refrigerator magnets like me
Maybe they have sweet refrigerator magnets like me

I’m not saying that some Russian people didn’t do it, but I really feel like the reporting on the matter is irresponsible. Here’s why:

Attribution of hacks to individuals or nation-states is hard. It’s very hard for many reasons, not the least of which is that techniques, tools, attacks and compromised machines are shared. Someone in Bolivia may be using a Russian tool from a already trojaned host in China, connecting from a Romanian proxy. In the past many attributions have been made on extremely flimsy evidence, like seeing some Russian strings in a file and then saying it is the work of Kremlin-sponsored hackers. Or coming from a Chinese IP therefore it’s the CPC (e.g.: Norse-style attack maps). Or a machine that has been compromised by a trojan believed to be used by a couple people in Russia, even though others could be using the machine or the trojan.

My point being that there should be some basic level of skepticism from the public and reporters when attributing hacks at all, and maybe even more when connecting them to nation-state sponsored hacking. The Economist very recently said regarding hacking financial institutions:

the limited number of actors thought to have the capabilities to pull off something like this are tied to nation-states

I’m definitely no expert on financial information security, but I doubt the basic premise here that hacking techniques or tools can exist only in the hands of nation-states. Anything can be copied, especially an attack that’s been used before. Suppose a nation-state has a super sweet 0-day and trojan kit or whatever. Once they use it, it’s fair game for other people to replicate and use themselves. Case in point: stuxnet, the SCADA attack that wrecked Iranian nuclear enrichment centrifuges. This is suspected to be developed by the Israeli and American governments using highly specialized knowledge. Cool. But now a detailed analysis of it is on the internet for anyone to read and copy if they want. So even if a lot of work is put into development by a nation-state, others can copy it. And in most cases a person with a lot of time on their hands and a computer could do the same research and development if so inclined.

Now regarding the DNC hacking, all news articles eventually point back to a single press release by one guy at CrowdStrike that says the attack was done by “COZY BEAR and FANCY BEAR.” whom they know to be sophisticated Russian operatives. This is a pretty important assertion and if it was to be printed everywhere with scary pictures of Putin and likely lead to diplomatic responses I would expect more evidence behind it than essentially taking their word for it. Again, I’m not saying I don’t believe them, but not being properly skeptical about such assertions and considering plausible alternatives could lead to very serious consequences that would be in everyone’s best interest to avoid.

We have identified no collaboration between the two actors, or even an awareness of one by the other.  Instead, we observed the two Russian espionage groups compromise the same systems and engage separately in the theft of identical credentials. While you would virtually never see Western intelligence agencies going after the same target without de-confliction for fear of compromising each other’s operations, in Russia this is not an uncommon scenario. “Putin’s Hydra: Inside Russia’s Intelligence Services”

To me this says that people with no connection to each other are using the same tools to compromise the same systems. Why must it be only these two attackers? How do you know it’s them? If there are detailed reports on the tools, techniques and traces of these attacks how hard would it be for someone else to make it appear to be the work of Russians?

These are important questions because there are debates now on how to respond to hacks (or “cyberattacks” in the somewhat anachronistic terminology of the U.S. government), possibly with military force. In the past high-level American diplomats have warned China about their cybertanks rolling over our cyberservers or whatever the hell they imagine is going on. China denies any such attempts. Maybe China attacked us, maybe not? Let’s be as certain as we can before rushing to any conclusions about who attacked a computer through the internet, and who “sponsored” them. I don’t really know what sponsorship a hacker needs other than a few cases of monster, some pizzas and a laptop.


Typical Kremlin-sponsored nation-state operative workstation


There are definitely some points to mention that do back up the assertions from CrowdStrike. Dell Secure Works supposedly verified that it was Russians independently. In the press release it certainly does sound like CrowdStrike knows what they’re talking about and has been following these guys for a while. I’m sure they have lots more information than they’ve released and know a lot more than I do. I just have a problem taking their word for it about attributing it to the Russian Federation government when such attribution seems extremely problematic and pretty impossible to confirm unless you actually arrest them and look at their computers and network traffic. Of course if we could track them down to that point, it would mean that they were shitty hackers and the work they did could have been done by any other shitty hacker just as easily. And if these shady Russkiis have been at it for so long and are so well known, what’s to stop China or Venezuela or Iran from sponsoring hackers to imitate the Russian’s attacks to stir up some diplomatic incidents and nationalist fervor?

Oh also, the person who hacked the DNC started a blog and said they were responsible and it wasn’t Russians and laughed at CrowdStrike’s incompetence:

Worldwide known cyber security company CrowdStrike announced that the Democratic National Committee (DNC) servers had been hacked by “sophisticated” hacker groups.

I’m very pleased the company appreciated my skills so highly))) But in fact, it was easy, very easy.

Guccifer may have been the first one who penetrated Hillary Clinton’s and other Democrats’ mail servers. But he certainly wasn’t the last. No wonder any other hacker could easily get access to the DNC’s servers.

Shame on CrowdStrike: Do you think I’ve been in the DNC’s networks for almost a year and saved only 2 documents? Do you really believe it?

So there’s that. CrowdStrike posted an update responding to Guccifer 2.0:

June 15, 2016 UPDATE:

CrowdStrike stands fully by its analysis and findings identifying two separate Russian intelligence-affiliated adversaries present in the DNC network in May 2016. On June 15, 2016 a blog post to a WordPress site authored by an individual using the moniker Guccifer 2.0 claiming credit for breaching the Democratic National Committee. This blog post presents documents alleged to have originated from the DNC.

Whether or not this posting is part of a Russian Intelligence disinformation campaign, we are exploring the documents’ authenticity and origin. Regardless, these claims do nothing to lessen our findings relating to the Russian government’s involvement, portions of which we have documented for the public and the greater security community.

Now I’m not an information security professional and I’m not claiming to know more than CrowdStrike or American diplomats or anything like that. I’m just a software engineer who tries to keep up on security issues so that I can better protect my systems and applications. All I’m saying is that hard questions should be asked when attempting to attribute a hack to a particular person, group or nation-state before plastering the news with headlines like “Why Would Vladimir Putin Want To Leak The DNC Emails?

Screen Shot 2016-07-26 at 1.08.16 PM


AWS Lambda Editor Plugin for Sublime Text

Editing the source of a lambda procedure in AWS can be very cumbersome. Logging in with two-factor authentication and then selecting your lambda and using their web-based “IDE” with nested scroll bars going on on the page is not the greatest. Even worse is if your function actually has dependencies! Then you cannot view the source on the web and must download a zip file, and re-zip and upload it every time you wish to make a change.

Naturally after a while of doing this I got pretty fed up so I created a handy plugin (documentation and source on GitHub) for my editor of choice these days, Sublime Text. After setting up your AWS access key if you haven’t done so already (it uses the awscli or boto config) and installing the plugin via the Sublime Package Manager, you can call up a list of lambdas from within your editor.

After selecting a lambda to edit, it downloads the zip (even if it wasn’t originally a zip), sticks it in a temporary directory and creates a sublime project for you. When you save any of the files it will automatically zip up the files in the project and update the function source automatically, as if you were editing a local file. Simplicity itself.

If you use AWS lambda and Sublime Text, get this plugin! It’ll save you a ton of time. Watch it in action:


Video instructions for installing the plugin from scratch:

Mac OS X El Capitan and OpenSSL Headers

Apple stopped including the OpenSSL development headers on recent versions of OSX, trying to get people to move away from the old 0.9.8 version that’s been deprecated for a very long time. Making people stop using this shared library is a Good Thing to be sure but you may come across older software that you want to build for yourself.

If you try to compile a newer version of OpenSSL you will likely find that programs will fail to build against more recent versions because a lot of data structures have been hidden. You may see errors such as:

error: variable has incomplete type 'EVP_PKEY' (aka 'struct evp_pkey_st')

        EVP_PKEY pk;


/usr/local/include/openssl/ossl_typ.h:92:16: note: forward declaration of 'struct evp_pkey_st'

typedef struct evp_pkey_st EVP_PKEY;

If you want to get such code to compile there’s a quick and easy solution! OSX still ships with the 0.9.8 library, you just need to provide the headers. Remove any newer versions of OpenSSL, grab the 0.9.8 sources, and copy over the headers:

$ sudo cp -r include/openssl /usr/local/include/

And then you’re all set.