The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

    Mastodon

  • Twitter Updates

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,839 other subscribers

Archive for the ‘Software Development’ Category

« Previous Entries
Next Entries »

Multi-threading in C#: Back to Basics (Part 1 of N) – CodeProject

Posted by jpluimers on 2018/05/10

Hopefully by now the ToC has gotten bigger at [WayBack] Multi-threading in C#: Back to Basics (Part 1 of N) – CodeProject.

At the time of writing it was this:

–jeroen

Posted in .NET, Development, Software Development | Leave a Comment »

Procedural Programming: It’s Back? It Never Went Away – Kevlin Henney [ACCU 2018] – YouTube

Posted by jpluimers on 2018/05/09

If you haven’t been in the software development arena for the last 50 years, then watch this and learn all “modern” stuff has been around for ages:

Most if it comes from the era of Algol, make, AWK and the famous Structured Programming book (which is not about procedures, but about control flow).

So watch Procedural Programming: It’s Back? It Never Went Away – Kevlin Henney [ACCU 2018] – YouTube

Slide deck: Sideshare: Procedural Programming: It’s Back? It Never Went Away – Kevlin Henney [ACCU 2018]

Then read [WayBack] ISBN 9780122005503 – Structured Programming (A.P.I.C. studies in data processing, no. 8)

Via: [WayBack] Kevlin Henney – Google+

–jeroen

Read the rest of this entry »

Posted in Agile, Conference Topics, Conferences, Development, Event, Paradigms, Software Development | Leave a Comment »

Some links on how Windows detects if a program “is not responding”

Posted by jpluimers on 2018/05/09

For my research list:

–jeroen

Posted in Development, Software Development, The Old New Thing, Windows Development | Leave a Comment »

How to create a folder that inherits its parent’s ACL, and then overrides part of it – The Old New Thing

Posted by jpluimers on 2018/05/08

create the directory without an explicit security descriptor and let the experts create it with the default security descriptor, which takes into account all the inheritance rules. And then modify the security descriptor post-creation to include the new ACE you want. Fortunately, MSDN has sample code for how to add an ACE to an existing security descriptor.

via: [WayBack] How to create a folder that inherits its parent’s ACL, and then overrides part of it – The Old New Thing

–jeroen

Posted in Development, Software Development, The Old New Thing, Windows Development | Leave a Comment »

Containers, totally not a lightweight VM, and also not a hype.

Posted by jpluimers on 2018/05/08

If you start doing stuff with containers, be sure to read the below parts of a series “Containers, totally not a lightweight VM, and also not a hype.” by Kristian Köhntopp, Senior Scalability Engineer at Booking.com.

Be sure to read all the links below, including the comment threads as there is a wealth of information in them.

I’ve tried to summarise parts further below, but there is so much information in the links that you really should long read all the links.

Further reading, all by or via Kristian:

Some highlights of the parts

Read the rest of this entry »

Posted in Cloud Development, Development, Software Development | Leave a Comment »

GitLeaks – Search Engine for exposed secrets on the web

Posted by jpluimers on 2018/05/03

via: [WayBack] Yet another reason to be very careful with what you put in version control: GitLeaks – Search Engine for exposed secrets on the web https://gitleaks.com/ – This is why I Code – Google+

[Archive.is] GitLeaks – Search Engine for exposed secrets on the web

–jeroen

 

Posted in Development, Security, Software Development | Leave a Comment »

Client-Side Password Hashing – DelphiTools

Posted by jpluimers on 2018/05/03

Interesting thought on client-side password hashing: [Archive.is] Client-Side Password Hashing – DelphiTools.

I’ve ambivalent feelings on it, especially since it will expose salt and other settings to the client.

On the other hand it tremendously helps when there are transparent proxies in between. Read the article for full details; here is just one quote below.

Maybe dual hashing would be in place: once at the client to prevent plain-text to go over MITM channels, and a second hash server side with different settings like salt to prevent brute force attacks.

I need to give this more thought.

The quote:

If you are using a regular Windows and a regular browser, access to HTTPS will go through the regular certificate chain, using regular certificate authority. You also benefit from extra security layers like Public Key Pinning.

But when a custom Root CA is installed, all that goes through the window: the custom Root CA allows the corporate proxies to issue “valid” certificates for any website (even google.com and the rest), and the public key pinning features are disabled:

How does key pinning interact with local proxies and filters?

Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. 

A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites. “Data loss prevention” appliances, firewalls, content filters, and malware can use this feature to defeat the protections of key pinning.

All the major browsers have a similar behavior… because it is required to allow transparent proxies. And transparent proxies are the means through which the legal logging requirements are fulfilled.

So besides introducing a major MITM opportunity, this also means that there are legally-required corporate logs somewhere of all that went through HTTPS… including plain text passwords, if you did not hash them on the client-side.

These logs will have varying degrees of security when in the corporate domain… and next to none if they are ever requested by the legal system for an investigation.

–jeroen

 

Posted in Algorithms, Design Patterns, Development, Hashing, Power User, Security, Software Development | Leave a Comment »

Delphi .dproj file changed or not changed? Normalize it! | The Art of Delphi Programming

Posted by jpluimers on 2018/05/02

Cool tool that integrates into the Delphi IDE: [WayBack] Dproj changed or not changed? Normalize it! | The Art of Delphi Programming

Via: [WayBack] Introducing DprojNormalizer: http://www.uweraabe.de/Blog/2017/01/18/dproj-changed-or-not-changed/ – Uwe Raabe – Google+

Note there is also RadCLI that requires Python and does it via the command-line:[WayBack] joshkel/RadCli: Command-line utilities for RAD Studio / Delphi / C++Builder

DprojNormalizer supports Delphi XE7 and up.

Updates at [WayBack] Downloads | The Art of Delphi Programming: DprojNormalizer

Note that it requires an elevation to Administrator for installing. If you run Delphi as a normal user, then afterwards you need to register the package yourself, for instance with a batch file like this:

reg add "HKEY_CURRENT_USER\Software\Embarcadero\BDS\18.0\Known Packages" /v "C:\Program Files (x86)\DprojNormalizer\DprojNormalizer240.bpl" /t REG_SZ /d "Dproj Normalizer" /f
reg add "HKEY_CURRENT_USER\Software\Embarcadero\BDS\19.0\Known Packages" /v "C:\Program Files (x86)\DprojNormalizer\DprojNormalizer250.bpl" /t REG_SZ /d "Dproj Normalizer" /f

Adjust your BDS and DllSuffix in the BPL file names using the table at Delphi version info table: C# Builder, Delphi 8 through 10.2 Tokyo and Appbuilder.

If you want to temporarily disable it:

reg add "HKEY_CURRENT_USER\Software\Embarcadero\BDS\18.0\Disabled Packages" /v "C:\Program Files (x86)\DprojNormalizer\DprojNormalizer240.bpl" /t REG_SZ /d "Dproj Normalizer" /f
reg add "HKEY_CURRENT_USER\Software\Embarcadero\BDS\19.0\Disabled Packages" /v "C:\Program Files (x86)\DprojNormalizer\DprojNormalizer250.bpl" /t REG_SZ /d "Dproj Normalizer" /f

If you want to re-enable it: remove the values under Disabled Packages.

–jeroen

 

Posted in Conference Topics, Conferences, Delphi, Development, Event, Software Development | 1 Comment »

delphi – How to get rid of exception 80000003? – Stack Overflow

Posted by jpluimers on 2018/05/02

The [WayBack] delphi – How to get rid of exception 80000003? – Stack Overflow got me on the right track:

When I run my program (admittedly, it was built in debug mode), I get an error “External exception 80000003”.

According to Win32 Exception/Access Violation Errors it means 0x80000003 EXCEPTION_BREAKPOINT A breakpoint was encountered.

What happened was that during debugging a multi-threaded application doing quite a bit of Windows API stuff and CPU debugger Windows stuff by single-stepping through it.

Single-stepping involves the debugger putting a lot of temporary breakpoints similar to how other debuggers do this:

when stepping at the source level, the debugger uses temporary breakpoints to stop execution at the specified location

Source: [WayBack] ARM Information Center – ARM DS-5 Using the Debugger – Stepping through an application

On Intel platforms, temporary breakpoints are usually done using an INT 3 instruction as that encodes in the single-byte 0xCC opcode. which is very simple for the debugger to patch and remove: just keep a list of addresses and the original byte content.

Note that some debuggers even allow you to manually set temporary breakpoints that disappear after 1-time use; see [WayBack] Temporary Breakpoint – Now You See It, Now You Don’t – mohit.io:

Have you faced the problem of breakpoint clutter where breakpoints keep piling up only to hinder the debugging session?  It is then that one realizes that there are some breakpoints that can be deleted and others disabled. A useful feature in a debugger is a temporary breakpoint that automagically gets deleted when hit thereby reducing the clutter of unnecessary breakpoints.

Somehow this doesn’t work well all the time in the Delphi debugger when using multi-threading, but not in a reproducible way: you get a 0x80000003 exception at irregular moments, but more often when you use more threads.

The solution:

  • do not single step
  • configure the IDE to save the desktop (as that contains your breakpoint settings)
  • put regular breakpoints but configure them to be
    • non-breaking
    • log expressions you are interested in
    • put them in a breakpoint group organised by areas you are interested in
    • turn off/on breakpoint groups when certain breakpoints are hit

The above is far more painstaking than using single-stepping but suffers from far less problems.

–jeroen

PS: Thanks David Heffernan for indicating “Websearch for NTSTATUS. Knowledge of that macro name is the key.”

Posted in Delphi, Delphi XE8, Development, Software Development | 1 Comment »

Delphi: There is a FastMM4 fork with AVX support and multi-threaded enhancements (faster locking) – how will it impact floating point heavy applications (as Delphi uses SSE instructions for floating point)

Posted by jpluimers on 2018/05/01

Interesting fork of FastMM4 for which I now think I understand why it is not merged into the regular FastMM4 repository: [WayBack] GitHub – maximmasiutin/FastMM4-AVX: FastMM4 fork with AVX support and multi-threaded enhancements (faster locking).

The fork does two things:

  • it has multi-threading enhancements (faster locking)
  • AVX support which seems tough for floating point heavy applications as Delphi generates SSE instructions for them

Reminder to self: how big is that impact and could the locking be separately merged into the base repository?

Eric Grange:
Looking at https://github.com/pleriche/FastMM4/issues/36 and given than the compile generates SSE2 code for floating point, I guess using AVX may be problematic when your code also does a lot of floating point using Delphi code (rather than AVX asm)

It could be that this repository is using only AVX-128, which might not have a penalty as per Advanced Vector Extensions – Wikipedia:

The AVX instructions support both 128-bit and 256-bit SIMD. The 128-bit versions can be useful to improve old code without needing to widen the vectorization, and avoid the penalty of going from SSE to AVX, they are also faster on some early AMD implementations of AVX. This mode is sometimes known as AVX-128.

Via: [WayBack] Do you use Embarcadero version of FastMM or the “official” bleeding edge version of FastMM from the gitHub repository? Any idea what are the difference… – Tommi Prami – Google+

–jeroen

Posted in Delphi, Development, FastMM, Software Development | 6 Comments »

« Previous Entries
Next Entries »