I passed all my exams, and my grades were pretty good. Not Straight-A-good, but Above-B-good at least. I’m very hopeful for next year, and I hope I will enjoy the courses as much as those I had this year.

And my plans for this summer, you might ask? Well, I will be visiting the Edinburgh Fringe again this year - and as a new thing, my sister will be joining me.
I will also be riding my bike around Denmark to see the countryside and to visit friends and family.

On the coding front I have a great project together with Thomas which I will tell you more about later.
If I’m feeling in a particularly good mood, I might even finalise my work on recurrence parsing in the iCalendar parser.

-fangel

This is great and all - but since I need to call my own API from Javascript I needed a way to do this algorithm in Javascript. Well, off to Google I went.
After a few misses I found the script made by Paj which is located at http://pajhome.org.uk/crypt/md5/sha1src.html.
This is also where I got the MD5 algorithm when I needed one of those.

The next step was to add a Mootools wrapper for it, so I can do things like "some string".hmac_sha1("key");

For this I conjured up this little piece of code:

/*
 * Mootools wrapper for the SHA1 functions.
 * This adds String.sha1 and String.hmac_sha1
 * Requires http://pajhome.org.uk/crypt/md5/sha1src.html
 */
String.extend({
	sha1: function(output) {
		if( output == 'base64' ) {
			return b64_sha1(this);
		} else if( output == 'hex' ) {
			return hex_sha1(this);
		} else {
			return str_sha1(this);
		}
	},
	hmac_sha1: function( key, output ) {
		if( output == 'base64' ) {
			return b64_hmac_sha1(key, this);
		} else if( output == 'hex' ) {
			return hex_hmac_sha1(key, this);
		} else {
			return str_hmac_sha1(key, this);
		}
	}
});

-fangel

It allows you to type in the URL of a iCalendar feed, and it will display the contents of the feed in a nice week-view calendar.

SG iCalReader Tryout (http://sevengoslings.net/try_ical/)

Note: The SG iCalReader Tryout is designed for Mac OS X and Safari. All other combinations might have graphic glitches or worse.

-fangel

Right now it’s getting close to some initial testing. Which is why I need you!

Do you have any need for parsing iCalendar files/feeds? If you do, I’d like to bounce some ideas on how to create the API.
Also - I’m looking for testing-material. If you have a custom-written iCalendar feed send it my way so I can see if my parser blows up.

The code I do have can be found here: https://svn.sevengoslings.net/icalreader.

The code is released under a Creative Commons license. More specifically the Attribution-Share Alike 2.5 Denmark license.

Update: There is now a nice test page: the SG iCalReader Tryout.

-fangel

• PHP - But I haven’t really coded anything or much worse: felt like coding anything in the while.
• Web Security - But I’m not sure I’m best suited for this. I might be better than some, which could make it worth while though.
• Macs and me buying a new one - But I haven’t yet.
• Microsoft (heart) Yahoo! - But it’s just darn depressing
• My addiction to watching TV series - But after Gorram It the post would probably stop because I started watching a new series.

So. Then what.

Since I might as well done one of these now - I’ll do the first one. Or more, my reasons for not writing something about PHP sooner.

I haven’t felt the need to do any programming in quite some time now. I force myself to code sometimes. It gets some work done. Other times I find cool projects that I would like to do. But after a few hours I kinda lose interest.

The last few things I worked on:

• My exam for my OOPD course. I got it done. I had to. I’m satisfied with how it turned out, and the first 80% was fun, quick and nicely done. The last 20% took more time that the first 80% because.. Well.. I don’t know why.
• Useful Account. Me and Jim Whimpeys joint project. It’s getting close, but some of the codes need re-factoring. I got some work done on it last weekend but none in this weekend.
• Playing around with Adobe Air. I have a project lined up, but it’s just not coming anywhere. It took a full 2 hours before I stopped working on it.

I just loose interest. I don’t know why. The periods of coding gets shorter and shorter, interrupted by me juuuust checking up on IRC and my email. After a while I find something else to do. Check Reddit, Boing Boing or watch some tv-series (uhh, cross-over to the 5th subject. Snap out of it!)
I distract myself. I admit. I do it, and I’m not proud of it. This was why I wanted to work at the office of my employee instead of from home. And it works. I don’t distract myself when working there. I know I am at work and getting paid and therefore force myself to actually work.

How about you? Have you ever been in the same situation? Any hints?

XOXO
Go… - No wait. Crossing over into TV series again.

Regards.

UPDATE:
This was a a build that worked - almost. You couldn’t get GD, PEAR or PECL working. So I set out to fix this issue. But what - Sean Coates had already found the right way of doing it. So instead, use his way:

http://blog.phpdoc.info/archives/83-php-5.2.5-on-Leopard.html

But if you feel like a almost working setup - here’s the original post:

For some reason Apple included MySQL, MySQLi, PDO SQLite and PDO SQLite2, but not PDO MySQL. And because Pundit is highly dependent on PDO MySQL I had to find a solution..

Well - here it is:

1. Install the XCode developer tools (from the Leopard install cd, or downloadable from Apple)

2. Download and install MySQL from http://dev.mysql.com

3. Download PHP Source from http://php.net

4. Create some symlinks for the MySQL libraries (otherwise PHP won’t find them)

> sudo mkdir /usr/local/mysql/lib/mysql
> sudo ln -sf /usr/local/mysql/lib/lib* /usr/local/mysql/lib/mysql/

5. Compile PHP - not as hard as it sounds..

> cd ~/where/you/placed/php
> ./configure ‐‐with-pdo-mysql=/usr/local/mysql ‐‐with-apxs2=/usr/sbin/apxs
   ‐‐with-mysql=/usr/local/mysql ‐‐prefix=/usr ‐‐mandir=/usr/share/man
   ‐‐infodir=/usr/share/info ‐‐disable-dependency-tracking
   ‐‐with-ldap=/usr ‐‐with-kerberos=/usr
   ‐‐enable-cli ‐‐with-zlib-dir=/usr ‐‐enable-trans-sid ‐‐with-xml
   ‐‐enable-exif ‐‐enable-ftp ‐‐enable-mbstring ‐‐enable-mbregex
   ‐‐enable-dbx ‐‐enable-sockets ‐‐with-iodbc=/usr ‐‐with-curl=/usr
   ‐‐with-config-file-path=/etc ‐‐sysconfdir=/private/etc
   ‐‐with-mysql-sock=/var/mysql
   ‐‐with-mysqli=/usr/local/mysql/bin/mysql_config
> make all
> make install

6. Restart Apache

sudo apachectl graceful

7. Check that it worked. There are a gazillion ways of doing so, here’s one:

> php -i | grep PDO

Check the output for a line like: PDO Driver for MySQL, client library version => 5.0.45

8. …

9. Profit!

Disclaimer: I have no idea if this breaks anything. It worked for me, and I haven’t found anything broken yet.. I didn’t break stuff, but it was the best either. Read update at top of post..

-fangel

Well, is it?

Yes.

The Power Of Example

At least that’s my opinion. Lets take a very simple example here: I,
for some reason or the other, got the hands on a very simple dataset:
username=darthvader&passwd=7d9b53f484b070d715252daf0a3f334b

Wauw - that looks all secure and protected. There is no way I am going
to know what password our dear Darth Vader used to protect his user
account, is there?

Well, let’s do a real life demonstration.

1. Google your way to a rainbow table.
2. Uhh, a Digg entry - let’s read that
3. Find the form to supply your hash to: Hash Cracker sounds just right
4. Supply your hash (sorry, post form - can’t link)
5. Find the resulting password: deathstar.

So yes - Darth Vader should have chosen a better password. But really,
deathstar isn’t that bad compared to many ordinary users password.

So, what can we learn from this? That Darth Vader has a very
narrow field of interest? That we shouldn’t use MD5?
In the same order: Yes and No.

To The Point — Please

By all means - continue using MD5. But this is the trick: Salt it.

And if you have no idea what salting your hash is, this is the short
version: Add a string of text that you know, but nobody else does in
the beginning or end of the string before hashing it.

So, instead of doing
$passwd = md5($userSuppliedPassword);

Use
$password = md5("MySalt_" . $userSuppliedPassword);

Do this every time you need to find the hash for a users password, both
setting and getting it. And the end result: Darth Vader’s hash ends up
being 721797113d36f5604089ed8f90b82ea9 instead.
And this hash isn’t in the rainbow table. And if you had (as you should)
used a better salt it shouldn’t be in any rainbow table.

A simple solution would be to define a constant in some file - preferably
outside your webroot - and pre- or append this constant to the user
supplied password at every check. Or if you feel like you are going to
forget to do this, create your own MD5-wrapper function that auto adds
the constant.

I already have my passwords as plain MD5 - now what?

Well, the methods above pretty much all require that they be implemented
prior to any users signing up and their password being stored. But we
all know that most user-databases are carried over from older setups.
So how do we add the salt without knowing the users password.

Well - I can come up with two methods:

1. Add a second field to the database where you will add the salted hash
   after their first login since the addition. This way all users will
   eventually have had the new hash set, and you can change over to
   using it.

2. Double-hash your password with your hash in the middle. A rough
   example is md5("MySalt_" . md5($userSuppliedPassword)). This is
   pretty much the same as before, but you can add this new hash to
   existing hashes. The drawback is that you now have to calculate the
   hash twice.

So, which one of these is the best? The first one is obviously the hardest
one to do, and will also require more resources in the near future. But
it does have a certain touch as it will eventually have the correct format.
Where as the format that options number two provides just smells of “I did
this poorly first time around, this is my have to make it better”. And we
don’t like that.

So - if you don’t mind smelly pseudo-hacks, go for options number two. It is
by far the easiest and quickest to implement. I would go for option
number one as it will, eventually, produce the best end result. Darth Vader
should tackle his most important problem first and come up with a replacement
for his poor choice of password. Then he should chose which salting option
suits him best. A good salting doesn’t turn bad passwords good.

But I Need The Code For This Handed To Me

No. No. And if you still think you should, then no. It is way more important
that you understand why than how. And if nothing else, you should know how.
And having the code brought to you on a silver platter gives you neither.

I hope that this post has spurred a few thoughts in you mind about why you
should care about salting your MD5-hashed passwords. And if you know why
the last part - the how - should come easily. I have given some examples that
should point you in the right direction.

And if you haven’t thought about anything but my silly Star Wars references,
then you’ve missed an important point. But you’ll live. Especially since we
are now able to easily figure out Darth Vaders passwords as he forgot to salt
his hash.

-fangel

No, his latest post Why PHP triumphs over Ruby is the triumphant return of his much beloved ruby-bashing posts which also includes such classics as Is Ruby the dog and PHP the dogfood?.

One of his points includes the fact that the holiday season is over (wait - just now? I started a month ago!) and so all the college kids have returned to their duties as soulless soldiers of the Ruby army

Ohh - yes. And he told me (yes - I’m sure he meant me personally) to plug this post - but really it deserves it..

In a side-note, in the The Web 2.0 or Star Wars Character? quiz that Chay mentioned I scored a meagre 27. Yes I admit my Crunch-foo is weak.

I will now end this Terry-Chay-loving even though I’m sure it’s mutually enjoyed.. Or something..

-fangel

I have been away on a intro-get-to-know-your-classmates-tour the last five days. I was expecting a bit more binge drinking and pressure on me to join in. But there wasn’t - so it was all a pleasant time with lots of info and games to get to know your class and more importantly classmates.

I will also be moving the last of my stuff to my apartment tomorrow, so as of tomorrow I will officially be living in Copenhagen. Feel free to stop by at virtually any time you like (except when sleeping or at Uni). Haven’t got my stove yet, so don’t expect the biggest feast, but hey.. Who needs food to have fun?

-fangel

Without further ado - my selected playlist of the day:

Dogfight at Underbelly, Cowgate. I kept seeing them handing out fliers on the Mile, and they had these wonderfully 50′ies era clothing on. So a quick viewing was in order. The show itself was about small town conflicts and was quite fast pasted with short scenes introduced by a headline from a recording of a small child. Not the best show I’ve seen, but by far not the worst.

Johanna at The Jazz Bar. This show which was originally a radio play was fantastic! The story was about a grand piano and its owners and adventures through the years. A really gripping story with its fair share of humorous delights in the form of the pianos thoughts. This show, if any, deserves a viewing because of its great story, good acting and lovely piano tunes.

A Beginners Guide To Fringe Greatness at Sweet City. This was a story about two guys writing a play for the Fringe. You get introduced to a lot of the genres available at the Fringe as seen though the minds of two adolescence wannabe play-writers. Their ideas went from Muppets, to “art”-theatre, to Sex-shows with girls in stockings, to Muppets to Joe Average shows to the Muppets. All in all a very fairly good show if you don’t mind it taking the piss on the whole concept.

Playing Life at Sweet ECA. This show about a jazz-singer and her troubles was fairly good. It was almost a one-woman-show with only the pianist assisting her, and he really didn’t have that many lines. All other characters were imitated by pieces of clothing which worked better than you should assume. Worth a showing if you have nothing to do a the time - but don’t cancel your plans to make time to see it.

All there is left now is for me to sleep, get up, pack up, head to the airport and then fly home. But this was a great week. Don’t know when I’ll have time to go though all the pictures (the amount of pictures is in the 250-300 range). But keep a keen eye on my Flickr page and they will appear sooner or later..

-fangel