A Better SQL Security Approach

This is not only an SQL's problem, I am going talk about, this is a pretty general problem of all complex systems dealing with user permissions, however SQL constitutes the best possible illustration to the issue.The principal source of all evil is the generalized security policies, policies trying to cover the entire space of user actions by being formulated in basic general terms.
Read more →

An Embarrassing Security Hole In FFmpeg (how is it even possible?!)

A russian researcher Maxim Andreev (Максим Андреев) from cloud.mail.ru has discovered recently an appaling (and also embarrassing) security hole in FFmpeg (a popular open source video/audio processing library (yes, thanks god(s) it is open source)). The vulnerability may potentially lead to SSRF and local file read (which in turn may be pretty devastating). To put your computer at risk it is sufficient to keep it connected to the internet while processing with FFmpeg a specially crafted .mpeg file. So the attack may be aimed at servers and desktops as well, and it is important for the desktop users to know that nearly all GUI-oriented filemanagers and file-dialogs do run without a user's consent ALL the .mpeg files in the scope through the thumbnail creation procedure which is often built around FFmpeg library. Oh, my dear «user-friendliness»! Do you feel how problems are piling up?

The vulnerability is based upon the HLS (HTTP live streaming) feature (thanks to the reported vulnerability I now know what is live streaming — what a useful feature it must be). The core of the vulnerability is (as it happened many times before) a masquerade of filetypes multiplied by the stupidity of the modern days programmers. Effectively the worm is a PLAYLIST file masquerading as an ordinary .mpeg. And FFmpeg is programmed to process them «transparently» i.e. HIDE the distinction between them from the user. The playlist file is allowed to prescribe HTTP requeststs (supposedly to retrieve a file to play) and FFmpeg is eager to obey! Thus, FFmpeg being entitled to the access privileges of its caller SILENTLY sends HTTP-requests (full of potentially sensitive data) to an arbitrary HTTP-server in the internet.

Well done FFmpeg! well done!
And I personally send many non-sarcastic thanks to Maxim Andreev.

By the way, Maxim in his original article on habrahabr.ru describes some interesting practical exploits of the vulnerability, if anyone is interested, i can translate his article to English and post it here.

...and remember all vulnerabilities are deliberately created by someone.

There Is No Such Thing As Binary Data In This World

The «binary data» is a myth, created by very unintelligent people. This is just another undefined term in IT amongst millions of its brethren. Oh, dear! if you disagree I challenge you to define it or at least look up a definition. Seriously, give it a try.
I have challenged many advocates of «binary data» to define their beloved product of words. All of them (who are not indoctrinated enough to refuse the challenge altogether) immediately slipped into reasoning about text editors, terminals, and ASCII. But, wait, «my terminal can not display binary data» — is your terminal's problem and nothing more. Some terminals can not display unicode — is it «binary»? All different kinds of terminals unable to display different kinds of data. The same goes to the text editors — which particular byte sequences make a text editor cringe and glitch is specifically defined within the text editor and nowhere else.
Read more →

On Education, part 2: Middle School

(previous part: Elementary School)

There is an unspoken grievance bothering all us kids for the entierty of schooling. It feels like an earworm with a forgotten title, you hear it in your heead, but you can not articulate it no matter how hard you try. And it lasts for years. Here it is: «Why on Earth I must learn the disciplines that my teachers have failed to learn?! — If they are more stupid than I, why on Earth they are teachers in the first place?! — If it is just normal to be ignorant about the majority of the school curriculum, why do they teach me all the shit they themselves do not want to know and still have their jobs and live normal lives?!»

Yes, I am talking about the specialization of teachers, this ultimate manifest of ignorance! The very existence of your English literature teacher cries silently: «I don't give a damn about all your maths!». «I spit on your Shakespeare!» — is written all over the face of your maths teacher. An your biology teacher is completely happy being ignorant about maths, literature, geography, phisics, and the rest.

When you attend to all these compulsory courses you see the big picture: all these courses are in fact optional — the school lies to you at the very core of its doctrine. Every day the teachers as a whole demostrate you practically that every individual teacher preaches lies to you. This is how the school finishes your motivation off (if there was any remaining after the primary school). I can not concieve a more devastating impact on one's motivation that that.

And again the solution is way simpler than you might expect. It does not require any new institution, it requires a romoval job again. We must abolish the specialization of teachers. All compulsory courses must be taught by a single teacher from the very beginning of the school to the very end. One teacher for the complete curicullum — a role model of an educated person. Teachers must comply to the standards they impose on their pupils.

A Trap Hidden Deep Within Apache Cordova

During the development of the Cordova application «Siberian Dice» for Android I have encountered a particularly nasty trouble, so very tiny yet absolutely devastating. It was a very well hidden trap, and the experience of falling into this trap was so spectacular and puzzling that I was moved to create a stackoverflow.com account — imagine my frustration! It is a terrible feeling when you find out that the problem you just faced is not googleable, and even stackoverflow has no answer, not even a stupid one. So, I had to investigate it myself. I succeeded and (because I did not want anybody else to lose any more time on investigating the bug I already investigated) posted the solution on stackoverflow. And then I forgot the issue.
Read more →

On Education

Although the ideas I am about to formulate here predate this brilliant lecture by Doctor Russell Ackoff, the lecture formulates a challenge to which I am about to respond.

How shall we alter the educational system in order to preserve and nurture the natural curiosity in children, encourage creativity, and stop demotivating them to learn and explore? (Setting aside the fact that no government on Earth is interested in this cause.)
Read more →

This magic word "Cryptography"

This is a real life story. We were building an enterprise with micro-payments involved and stuff. We needed a terminal/kiosk network, and this task was bound to be outsourced. So my boss had found a company XYZ that offers ready-made solutions, and he asked me to investigate their offer. I returned to him with my verdict:
— we can't use this XYZ service, because they require our users to submit their passwords to XYZ and then XYZ logs into our system on user's behalf. This is plain out wrong, and should not be implemented ever.
He argued on the basis «a well established company can not possibly sell us junk» — so stunningly true! yeah! So he decided to carry out his own investigation.

A few days later he informed me of his decision:
— I have presented the XYZ's offer to a computer security specialist N. He advised us against using the XYZ's services because they do not employ cryptography.

So the story has ended quite happily. Thanks to the magic of the «cryptography».

Making A Game: Siberian Dice

I was asked to shed some light on the development process of Siberian Dice. Surprisingly, there are interesting aspects to speak about.

First of all, it was not meant to be a mobile application. It was all started as a purely mathematical endeavour. Initially, we wanted to investigate some properties of the game, once it appeared so elegant and sophisticated to us. At a certain point we decided to develop an AI, in order to produce some «real» games for further investigation, where by «some» I mean an amount orders of magnitude greater than a human can produce simply by playing the game full-time for several years.
So we did.
Read more →

A new game in town: Siberian Dice aka 37.6

Lame Heron has released a wonderful board game — embarrassingly simple albeit tremendously rich in strategies. This is an ancient game played by some indigenous tribes of Siberia isolated from the rest of the world for millennia. This marvelous game remained undiscovered until recently. Being invented and developed in nearly complete cultural isolation this game employs mechanisms very alien to a player of «western» origin. Although the mathematical and physical substance of the game is not from the parallel universe — it is still cubical dice and a hexagonal board well known to everybody — the dice are used in a very unorthodox manner, they are randomizers and the moving pieces at the same time. The goal of the game is also surprising, it does not fall in any usual category, it is not a «capture» goal, nor a «advance to» goal, neither is it a «connect» goal, not even a «dominate», yet it is a very simple condition clearly followed from the rules and easily readable on the board.
Read more →