Rspec and pair programming

Friday I:

- pairprogrammed for real for the first time. Ping-pong method == fun

- forgot my root password, (which I've used several times daily for the last month)

- remembered my password

- installed Rspec

- used Rspec

- was amazed at how useful Rspec is

- got quizzed on my (very small) knowledge of SQL and databases

I need to do a lot more writing tests before I can do it quickly and easily but my long-ago JUnit experience actually helped me catch on reasonably quickly... although I may have seemed like a dumbass a few times when I was trying to figure out what should be tested next.

Saturday morning I was one of the judges for the IIT Ethics Bowl contest. It was entertaining and slightly informative. Met a few cool people. I might help edit cases next year. IIT-local competition is much less... controversial and regulated than national competition. Which is not unexpected.

Fireshepherd: a response to firesheep

So this guy wrote this thing that crashes Firesheep through a bug. -shrug- Which is cool. I'm going to test it out... maybe tomorrow. Today isn't a good time for it. (I found this because I set up a google alert that sends me blog posts that mention firesheep.)

http://notendur.hi.is/~gas15/FireShepherd/

FireShepherd, a small console program that floods the nearby wireless network with packets designed to turn off FireSheep, effectively shutting down nearby FireSheep programs every 0.5 sec or so, making you and the people around you secure from most people using FireSheep.
The program kills current version of FireSheep running nearby, but the user is still in danger of all other session hijacking mechanisms. Do not do anything over a untrusted network that you cannot share with everyone.

Optional command line switches:
-i *IP* Ip Destination for packets, local router is recommended. (A trivial facebook server is default)
The local router can be found with the tracert command. (For example the first hit from "tracert www.google.com")
-t *timeout* Timeout in ms for packet sending. About 200 is ok for a local router. (400 is default)
-h Shows this message

Note that a dot represents a packet being sent.

Download FireShepherd.exe (Win32)
Download Source code
Download Licence.txt

Note that by downloading/using you accept the terms found in licence.txt

Gunnar Atli Sigurdsson, University of Iceland, 2010
e: gas15 at_hi.is

Agile

I read http://martinfowler.com/articles/newMethodology.html and it was pretty excellent. I even took a few notes. It prompted me to do a few things, like add some dev books to my Amazon wishlist. And join this mailing list. http://tech.groups.yahoo.com/group/extremeprogramming/

I learned that XP stands for extreme programming, which is a flavor of agile dev. I met this XP website: http://www.extremeprogramming.org/ which has a list of "rules" i..e progceedures- very useful! I haven't read them yet. But they'll be useful. http://www.extremeprogramming.org/rules.html

To be honest, I feel like my brain is a little fried. It's kinda late in the day and it might be time to have a drink and not stare at a glowing screen. My laptop is running hot. I want hot cocoa.

Here's a site which is less simple and usable (to my eyes) than extremeprogramming.org but the article titles look like I want to read them. http://xprogramming.com/index.php (burn down vs. kanban board? locating bottlenecks. Scrum. http://xprogramming.com/articles/kate-oneal-burning-down/) Aha! pics on Google Images tell me that I have seen kanban boards before, at dfr's old workplace and at TW. (What was the name of dfr's old company? Dammit.)

Here is yet another shiny website. For some reason it has book reviews, but there are also Tests from a Hat! Mmmm. Shiny. http://www.xp123.com/g4p/hat/
Also, Scrum on a page! I think I've seen this before, though hell knows where. http://xp123.com/xplor/xp0507/Scrum-dev.pdf There's one for XP but it looks like an undergrad made it for a giveaway project. Oh gods, I probably just stuck my foot in it hardcore. But it does. Let's make new versions. ...Man, I constantly think of things that my professors could have done better. But if they had done all of those things, the students would have had a nervous breakdown. Or balked like overloaded goats.

Anyway. I just ordered this book (Fowler linked to it) because, honestly, it's one cent on amazon, plus shipping. And the description looks like it'd be useful. http://www.amazon.com/gp/product/0201616408/
Alistair Cockburn (Scrum/agile guy) has a blog but none of the recent titles caught my attention. Should review it delta time. http://alistair.cockburn.us/Blog?view=dlist

http://pettichord.com/ This guy mentions Selenium, which I've at least looked at although not used, and Watir, which I've never heard of. Time to change that.

Ah, Mingle. I think there's a free dl; it'd be interesting to run it locally. Free for up to five users, or for one year? Someone is pretty sure that the product will hook the customer. http://www.thoughtworks-studios.com/mingle-agile-project-management

Tasty essay to read later "What is software design?" http://www.bleading-edge.com/Publications/C++Journal/Cpjour2.htm

Basically a white paper on why people are important when doing dev. Probably related to the concept that a teally topnotch guru can program 1000(more more)x faster than a basic. http://alistair.cockburn.us/Characterizing+people+as+non-linear%2c+first-order+components+in+software+development Too complicated for me right now. Maybe later.

Agile Alliance homepage! Very StarWars-sounding. http://www.agilealliance.org/

Golly, Fowler has written a lot. http://martinfowler.com/articles.html If I ever run out of books in an airport I know what I can do with my time.

I think that CS ppl believe that the future is inevitable and that trying to slow it down is [negative word here: silly/stupid/futile/etc]

Omg the manifesto! Must read. Heh. http://www.agilemanifesto.org/ I think that this is the coolest link from that article.

Red/Green refactoring- makes sense. Also, code "smells" (I recently learned what these things are and therefore think that they're cool.) http://jamesshore.com/Blog/Red-Green-Refactor.html

Anyway, I've run out of tabs now.

Twitter API limits

I just found out that they existed... by hitting one. Limit of 150 api requests per hour? For me, that's about 10-20 min of heavy usage, and I did do a catchup binge this morning. Dammit. Interesting guidelines, though! Quoted in part below. Link: http://support.twitter.com/entries/15364-about-twitter-limits-update-api-dm-and-following

• Direct Messages: 250 per day.
• API Requests: 150 per hour.
• Updates: 1,000 per day. The daily update limit is further broken down into smaller limits for semi-hourly intervals. Retweets are counted as updates.
• Changes to Account Email: 4 per hour.
• Following (daily): Please note that this is a technical account limit only, and there are additional rules prohibiting aggressive following behavior. You can find detailed page describing following limits and prohibited behavior on the Follow Limits and Best Practices Page. The technical follow limit is 1,000 per day.
• Following (account-based): Once an account is following 2,000 other users, additional follow attempts are limited by account-specific ratios. The Follow Limits and Best Practices Page has more information.

Cool security blogs about Firesheep

http://erratasec.blogspot.com/2010/10/re-firesheep.html
http://blog.mozilla.com/security/2010/10/27/cooling-down-the-firesheep/

Database hilarity presentation

I need to find someone who likes and understands databases so I can share this hilarious hour-long podcast with them. Yes, I listened to the entire damn thing. Also sent it to a professor.

http://www.youtube.com/watch?v=uFLRc6y_O3s

this is by this guy https://twitter.com/#!/fuzzychef

His blog about it: http://it.toolbox.com/blogs/database-soup/wrecking-your-database-33298

everything all at once: firesheep, ettercap, Sahara, RAM

I'm educating myself through observation. Check out the comments.
http://github.com/codebutler/firesheep/pull/31
Just to note: I don't actually know what these guys are doing. Gotta read more code first. It would help if I were familiar with github.com already.
http://github.com/codebutler/firesheep/issuesearch?state=open&q=linux#issue/31
However, several people have gotten it working on *nix. So... win?

Ettercap: has a bit of a learning curve, but does what firesheep does and is for *nix
http://ettercap.sourceforge.net/

Note: I was playing with VirtualBox and the Sahara VM, but this is more interesting. I still read the Sahara:Eden listserv emails, and they still don't make sense, so I'm postponing that project.

Other issue:
My ubuntu kernel doesn't support more than 4gb of RAM. I have 8. Therefore, new kernel time! I'm learning how to use aptitude. ...the hard way.
http://stackoverflow.com/questions/423540/how-to-see-packages-installed-on-a-given-date-using-aptitude
http://ubuntuforums.org/showthread.php?t=243528

Firefox url bar search

This is really too tiny to mention but I just ended up doing it 5x in a couple hours because of a multitude of oops.

• In firefox URL bar, enter about:config
  If it tosses you a "zomg void warranty?" message, ignore it.
• in Filter box type keyword.url
• Doubleclick on the Value field and replace what's there with http://www.google.com/search?q=
• Now when you type keywords into your url bar, it'll google it instead of tossing an error or taking you to the result of an "I'm feeling lucky" search.

This is based off of what I learned from someone else's blog, but I can't find the damn thing any more.

Heroku, rvm, and why the hell are they not working yet?

My friend dfr and some of his friends made http://stumie.heroku.com/ during http://railsrumble.com/ and he was showing me how cool it was and he sent me a project invite and I got an account and tried to install the heroku ruby gem so I could play too.

(Two other spare time projects from dfr: jshell.heroku.com and Ezy.)

By the way, this is based on what I read out of
$ history > heroku-history.txt | gedit heroku-history.txt

Make account on Heroku.
Have dfr invite you to the project. Check you email and click the link.
Check that Ruby and Git are installed.
$ sudo gem install heroku
$ heroku add: keys
$ heroku info --app stumie
$ git clone git@heroku.com:stumie.git
- get the rumble branch because master is outdated

Problems:
heroku: command not found
caused by how ruby installs on ubuntu if it's installed using apt-get
$ sudo apt-get install libssl-dev libreadline5-dev
$ bash < <( curl http://rvm.beginrescueend.com/releases/rvm-install-head
$ rvm

If rvm doesn't install (i.e. after installing you can't call it) try these
$ gem install rvm
$ rvm install 1.9.2

Did that work? if not, try:
$ rvm-install
$ run rvm

And/or go to the official howto
http://rvm.beginrescueend.com/rvm/install/

and/or irc channel here: http://webchat.freenode.net/?channels=rvm

home page for the rvm: http://rvm.beginrescueend.com/
after you get it installed, do rvm install 1.9.2
and then
$ rvm use 1.9.2

I have to remember to not push anything upstream yet!

Notes:
to see what gems you have,
$ gem list

Firesheep

Firesheep, Force-TLS, KB SSl Enforcer. I am playing* with them. Which is to say, installed TLS and KB, still trying to get Firesheep to run on ubuntu. Might boot into windows soon so I can play with them there.

News: http://techcrunch.com/2010/10/24/firesheep-in-wolves-clothing-app-lets-you-hack-into-twitter-facebook-accounts-easily/

Force-TLS (for Firefox): https://addons.mozilla.org/en-US/firefox/addon/12714/

KB SSL Enforcer (for Chrome): https://chrome.google.com/extensions/detail/flcpelgcagfhfoegekianiofphddckof

Code for KB: http://kbsslenforcer.googlecode.com/svn/trunk/

Firesheep: http://codebutler.com/firesheep

Further on the topic of packet capture... my main interest is security (whitehat), and I like playing with the toys. I hope to make my own toys someday- maybe even someday soon.

Thought- how does firesheep deal with login via openid?

linux

http://www.tcpdump.org/

sudo tcpdump -A -i en1 tcp port 80
http://www.blogher.com/frame.php?url=http://www.engadget.com/2006/03/21/how-to-ssh-tunnels-for-secure-network-access/
http://www.engadget.com/2006/03/21/how-to-ssh-tunnels-for-secure-network-access/

Wireshark (I installed it on my Windows partition just now)

http://portforward.com/networking/wireshark.htm

http://wiki.wireshark.org/

Also, a link from the illustrious https://twitter.com/#!/LaMenta3

http://www.metageek.net/products/inssider

For firefox 4 protection: https://addons.mozilla.org/en-US/firefox/addon/246797/

My fav blogpost on it so far http://hossgifford.com/firesheep/

*And by playing I mean playing. I won't damage anyone's anything with this; I won't use someone's data for nefarious purposes. Yadda yadda.