Hacks & Code

According to this page, the following 19 bytes of not quite valid "HTML" make IE crash (yes, I just tried it, and it works):

<style></style>@;/*

As requested in one comments, here are some tpp screenshots:

• a normal tpp slide


• tpp's slide overview


• tpp's formatting capabilities demonstrated


• that's what source code looks like with tpp

This weekend, I wrote tpp ("text presentation program"), an ncurses-based presentation tool. The idea is really simple: you write your presentation in a simple description language (similar to MagicPoint) using your favorite editor, and then display the slides on any text terminal that is supported ncurses, be it an old VT100, the Linux console w/ or w/o framebuffer or a simple xterm (or any other terminal emulator for X11).



I had the idea for tpp on my way home from Anif to Linz last friday, and as soon as I came home, I went to my computer, and started hacking it using Ruby. In the late evening, a first usable version was ready. And on saturday I made some cleanups and added a few more features. Actually, developing tpp went a lot quicker than I thought, but this is yet another example that Ruby is extremely good for rapid prototyping, and in this case, the prototype became the actual program. Or maybe not...? Rewrites of tpp in C & ncurses are gladly accepted.

I just stumbled across a pretty cool algorithm to compute Fibonacci number algorithm. So, I guess everybody knows the traditional recursive definition

fib(n) = fib(n-1) + fib(n-2)

fib(1) = 1

fib(0) = 1

Well, the disadvantage of this algorithm is that you can only compute fib(n) when you've computed fib(n-1) and fib(n-2) before. Well, with Binet's formula, you can compute the nth Fibonacci number without knowing any other Fibonacci number. The following C sample code shows how:

#include <math.h>

#include <stdio.h>



float fib(unsigned int n) {

  double a, b;

  a = (1.0/2.0)*(1.0+sqrt(5));

  b = (1.0/2.0)*(1.0-sqrt(5));

  return ((1.0/sqrt(5))*(pow(a,n+1)-pow(b,n+1)));

}





int main(void) {

  unsigned int n;

  for (n=0;n<100;++n) {

    printf("%f\n",fib(n));

  }

  return 0;

}

A few days ago, Clifford Wolf and I released trapdoor2. trapdoor2 allows remote users to execute local commands by sending 'magic cookies'. This is meant to be used to temporarily alter firewall rules, i.e. to open some kind of trapdoor so that users can access a service like ssh on a machine only from their current machine for a short period.



But trapdoor2 can be used for more than just that. Another ideas would be restarting services. For this use case, the WAP/WML (Wireless Application Protocol/Wireless Markup Language) support comes in handy: all you need is a mobile phone with GPRS to do important system administration tasks. Of course, trapdoor2 also support "traditional" HTML. For security reasons, trapdoor2 is HTTPS only. It even supports several SSL/TLS libraries, i.e. OpenSSL and GNU TLS. So you will be left in the rain when yet another vulnerability in OpenSSL is being found.

Some of my five readers might remember my little hack ContraPolice. Well, today, I did some little research out of pure boredom, and look where it is being referenced:

• The Annvix Project uses ContraPolice for hardening dietlibc.


• ContraPolice is in the bibliography to a vulnerability analysis seminar at the University of California in Santa Barbara.

This is just great. I never expected this little hack to spread so widely. But still, I'm happy that my code is being adopted, actually being used an probably making the (security) world a better place.