On problems that plague the relationships between developers and business clients

Here is a fictitious story of a business client that orders software for a mobile phone to an embedded developer.

Take such a trivial feature of a mobile phone as a the possibility to store last calls. What do you know about it besides that it allows to view last incoming and outgoing calls? This is the level of knowledge that a typical client has and he will express it as a requirement the same way:

— I want that my mobile phone software to store last incoming and outgoing calls.

The developer has two choices: either assault the client with question based on unconfirmed assumptions or tacitly do exactly what was asked. He writes code that keeps two lists ordered by the call time, one list for incoming calls, another one — for outgoing calls.

Soon after, the client finds out that a competing company uses a different design and demands the software to display:

  • all calls together with their destination (incoming or outgoing)
  • missed calls
  • received calls
  • outgoing calls
  • rejected calls

Unfortunately, the previous code has already been written and is linked tightly to the UI code and to the rest of the mobile phone's OS.

So, instead of scapping the previous design and starting from scratch, the developer is now bound to implement new data structures that consists of one new list that combines incoming and outgoing calls in the right order to satisfy the first additional requirement, and three more lists for each of the 2nd, 3rd and 5th additional requirements.

This seems like nothing, but coupled to the synchronization code and error handling code, the result is likely to look cryptic for everyone, including its own developer.

Монетизация кармы для рядового участника у Слэшдота

А вот так слэшдот решил поощрять пользователей с высокой кармой. Приятно, что во времена повальной монетизации не все контент-провайдеры видят в пользователе одну лишь дойную корову.

Report on (successfully) installing Samsung SCX-2160 MFP on Debian Lenny

The summary is that the printer is indeed mostly working, but requires a bit of hacking.

Splix driver

I tried first using the Splix printer driver as it looked a bit more clean than the foo2qpdl recommended by the Open Printing Database.

The printer requires the libjbig library that is not available on Debian due to unclear licensing. However, Markus Kuhn distributes the jbig-kit package that can be compiled easily. The only strange annoyance being that its makefile has no install target, so I just copied the library and its header files to /usr/lib and /usr/include. After that, Splix compiled flawlessly and afer running make install, and restarting cups, the printer was available for configuration in the cups web interface

Samsung unified driver

The printer has a USB interface for scanning on a USB key, but I decided to install the Samsung unified driver, anyway. It is now intelligent enough to suggest adding existing users to the lp groups and after that, xsane is able to scan under non-root users.

The official printer driver does not print well (see image), all text appears bold and blurred, but I use the Splix driver am very satisfied with the results.

How to prosecute for posession of paedophilic images and video?

In light of the recent accusation of Richard Biefnot (PS), echevin of Housing and Urbanism in Mons, I was trying to figure out what kinds of images he actually possessed and on the basis of what laws he is being prosecuted.

Seems like this simple question is being deliberately obscured by media.

That is, there shall be a difference between possession of e.g. Hentai and of videos of children making sex because the whole point of prosecuting the buyers is to keep the children out of the danger of being abused by reducing the demand. Obviously, no child has been abused in the production of Hentai, or other purely fictional artwork, so this argument does not apply for Hentai.

Unfortunately, it is very hard to find the relevant legislation in order to check whether this distinction is maintained in the legislation, but I would not be surprised if it is not.

Update: Thanks to a fellow lawyer friend, I got a pointer to the relevant legislation, and, I as expected, there is no such distinction, indeed:

Code penal Chapitre VII. Des outrages publics aux bonnes mœurs

Art. 383bis

§ 1er.

К вопросу о технологическом прогрессе

Сегодня на Слэшдоте написали, что в Штатах больше не осталось никого, кто мог бы сделать боеголовку к ракете Трайдент.

И сегодня же я прочитал, что европейские космонавты и астронавты чехвостят проект ATV, потому что его стыковка и тем более расстыковка — сложнейший процесс, требующий чёткой и и слаженной работы двух человек экипажа на протяжении нескольких часов. Почему чехвостят? Да потому, что предыдущий грузовой корабль Прогресс хотя и не имел в названии слова автоматический, тем не менее отстыковывался сам по команде с Земли, причём обычно это происходило в то время, когда космонавты спали.

Новая идея измерения хабрасилы, кармы и т.д. от Пола Грэма

Как всегда, самое полезное — маленьким шрифтом в сносках ;-)

I tried ranking users by both average and median comment score, and average (with the high score thrown out) seemed the more accurate predictor of high quality. Median may be the more accurate predictor of low quality though.

То есть, можно использовать среднее арифметическое от веса комментариев для того, чтобы выяснить, кто хорош, а среднее — для того, чтобы выяснить кто плох. Таким образом, критерии хорошести и плохости становятся независимыми.

.
Tags: 

A first-hand account of a DDOS attack mitigation

A few days ago, I lived through a DDOS attack at one of the sites I run. It started with the general unavialability of Apache, although the system was idle and the ssh access functioned perfectly. As I already had some experience with DDOS attacks, I immediately looked at the network connections using netstat and saw over 300 IPs sending SYN_REC packets in mass. The attack was much more powerful than I ever experienced.

~# netstat -n -p | grep SYN_REC | awk '{print $5}' | awk -F: '{print $1}'| sort |uniq |wc -l
310

I immediately started the APF firewall with RAB enabled and a script to block the offending IPs in iptables, as I had these at hand from the previous DDOS attack:

BEGIN {
 pipe = "netstat -n|gawk '{print $5}'|gawk 'BEGIN{FS=\":\"}{print $1}'|sort|uniq -c |sort -n"
 while (( pipe| getline) > 0 )  {
   if ($1 > 29 && $2 != "") {
     command="/sbin/iptables -I INPUT -s " $2 " -j DROP"
     date="date"
     command | getline result
     date | getline dateresult
     print dateresult " - command: " command ", result: " result >>"/var/log/firewall.log"
     }
   }
   close(pipe)
}

After a few hours it became clear that the IPs are rotating too often and the size of the botnet is well over 10.000, so I was left with a choice of either dying under DDOS or dying due to the performance hit of the large pool of IP addresses in iptables. The SYN_REC part was being filtered easily by syncookies, APF activated them on launch. The real problem was the HTTP flood.

Pages