Heartbleed and Passphrase

The news has been filled with stories about Heartbleed, a flaw in OpenSSL that puts web sites and information at risk. We're told to change passwords immediately.

What a pain! I've got usernames and passwords all over the web. Changing all of them, keeping track, and remembering later will be incredibly difficult. The Internet has a password problem. I can't wait until I have my own quantum cryptographic key generator so I don't have to remember.

So what to do? I came across a nice site called Diceware that spells out a recipe for generating pass phrases. I have a backgammon board in the house, which means that I have four dice handy at all times. But a fifth? I can't use the doubling cube very easily, can I? The idea of manually rolling dice to generate a key, going to the wordlist to look up a word, and recording that pass phrase for a given site seems like too much work, too many steps. So low tech!

Being a computer programmer, I'd rather spend a day coding a solution to a problem that would take five minutes to do by hand. So that's what I started working on last night. I finished it today and uploaded the result to a Github repository. It includes the source code for two Java classes: Die (a six-sided die that uses a random number generator to produce rolls) and PassphraseGenerator (a command line app that generates a random pass phrase using the Diceware recipe), the Diceware word list, and an executable JAR that makes execution in a command shell easy.

This exercise recalled the wonderful xkcd comic about password strength. I always loved the entropy calculation that gave a measure of password strength, so I incorporated the calculations into my application. I also gave a way to calculate the entropy of a given pass phrase using command line arguments. The first argument is the pass phrase, surrounded by double quotes if it contains spaces, and the second is the alphabet size used to generate the pass phrase. I've been using simple pass phrases on my work computer for years now. I put the one that I currently use in to see what its entropy was. It has 42 bits of entropy. At 1000 guesses per second, it would take 241 years to crack if my calculations are correct.

It was a fun and fruitful exercise. It made me happy, like my Mandelbrot solution from a few years back. I need to do more of that.

The last remaining problem is that most sites have ridiculous rules for passwords (e.g. "between 8 and 15 characters; must include one capital, one number, one special character") that actually make them weaker and harder to remember. I'd much rather generate some four word pass phrases and use those!

I'm struggling with software development lately. I'm trying to swallow a lot of new techniques. It makes me happy when I can solve a small problem like this once and for all. Uploading it to Github lends an air of permanence that I love: "Don't have to think about that problem anymore!"

Maybe that's the answer to all hard software problems: Decompose the big problems into lots of small ones that you can solve and upload to Github. Solve and forget that problem, make yourself happy, and move on to the next.

Building A Desktop Computer

I bought my first PC back in 1994. I spent a summer as adjunct faculty at the Hartford Graduate Center (now Rensselaer@Hartford, a much more prestigeous name) teaching partial differential equations to first semester masters candidates and earned a cool two grand. That was the going rate for a desktop PC back in those days; it was before Moore's Law kicked into overdrive. I had money in hand. More importantly, I had my wife's approval. After a career spent using Digital Equipment VAX minicomputers and Sun SPARC Unix workstations, I was finally going to have a machine in my own home.

I think I was vaguely aware of the World Wide Web. If my memory is correct, I had a Mosaic browser available to me on my computer at work. It was chicken, meet egg: I could have placed an order for my first PC on the Internet, but I needed a PC and Internet access at home.

I called Gateway 2000 to place my order. '2000' seemed so futuristic, so far away at the time. They were a serious player in the crowded PC market. The person on the other end of the phone was most pleasant and helpful. Windows 3.1? Very good, sir. Would you like two 3.5" floppy drives, or would you prefer one plus a CD ROM drive? Excellent choice, sir. 512MB of RAM? What will you do with all that? It arrived soon after with a monitor that I had to bundle into my arms to pick up.

I couldn't do much with the damn thing. I had to buy a slow modem to access the Internet, which was frustrating as it could be. I couldn't do serious engineering work on it - I could barely do the kind of work that I wanted on the most powerful workstations available to me. The compilers were limited. But I loved having it. I wrote code and prose as best I could. It served me well, but by the time it reached the end of its life I couldn't bear it anymore. I loathed that machine by the time I got rid of it.

I added a second hard drive and maxed out the RAM slots, but those last years weren't kind. I wasn't a hardware guy, so I didn't know how to do anything. I told myself that I was an engineer first, then a software guy. Hardware was someone else's problem. I would have studied electrical engineering if I wanted to know a lot about it.

I don't remember exactly how long I kept it, but it overstayed its welcome. I swore off Gateway, which was in trouble and about to be subsumed in a contraction of the overcrowded market. I went with a proven winner for my second computer: Dell. Their stock had risen and split several times during that period of irrational exuberance. If I'd been smart enough to invest whatever funds I had on hand early in the process I would have been a rich man.

Once again, I placed my order over the phone. The person on the other end of the phone was most pleasant and helpful. I don't remember much about the specs now. I think the operating system was Windows 95. I thought that this machine would last me a very long time, but I was disappointed again. Dell's stock might have been a winner, but their customer service wasn't. I had some long and memorable phone calls with their tech support that were worthy of the comedy series "Outsourced". Once again, I added a second hard drive and maxed out the RAM slots, but those last years weren't kind. I still wasn't a hardware guy; I still didn't know how to do anything.

If I loathed the Gateway, I detested the Dell. I swore I'd never touch another machine of theirs again. Surely HP would be better! I had the Internet at my fingertips in 2005, so I placed this order on line. I didn't need the approval of a salesperson. It was click! click! click! and I had the machine of my dreams: Windows XP! 4GB RAM! Dual core Intel processors! A 220GB hard drive! Surely this one wouldn't disappoint me!

That's the machine that I'm still using now. I'm happy to say that after six years I don't hate this set-up. It's long in the tooth, but Moore's Law gave me something that has weathered the storm better than the others. I can still do what I need to do. I've written a lot of prose, a lot of code, browsed a lot of Internet on this thing.

But I'm still not a hardware guy; I still don't know how to do anything. It's time to do something about that.

I've wanted to build my own machine ever since reading Jeff Atwood's Coding Horror blog about building a PC back in 2007. My HP was only two years old at the time, so I didn't think I needed to be in the market for another one so soon.

Now it's four years later, and I could use another machine. Capabilities have gone up and prices have come down. The world of hardware continues to race along. If I was going to buy another OEM PC I would go for an Apple and see what that's like.

But I've decided that I want to try my hand at assembling my own and installing a operating system for the first time. It's almost a professional requirement.

I'll have lots of help: a friend at work has done this in his sleep, so he was kind enough to offer a complete parts recommendation from Newegg.

So I finally pulled the trigger this afternoon: I set up an account at Newegg and placed an order. My federal tax return will more than cover it. I have my wife's blessing.

This won't make me a hardware guy, but it's a start. I hope it'll give me some base experience and enough awareness to do what's needed to keep the machine up as the years go by.

I want to install an operating system - no, make that several operating systems - from scratch. After spending an engineering career working on nothing but Unix hardware, I've been unable to get away from Windows during my second act as a software professional. When I was an engineer I thought like a guy who didn't care about being an admin on his machine. I used what I was given; I didn't install software.

I'd like to get back to Linux and rediscover what I missed. Setting up my own machine to dual boot to Ubuntu would be fabulous. I want to learn why software professionals say Unix/Linux is a great environment in which to write software. I want to learn sed and awk and rediscover tools that could make my software development life better.

Most of all, it's a chance to keep growing and expanding and learning. Stagnation and satisfaction are death; we all need to keep doing new things that we're afraid of, to expand that circle of light where knowledge and comfort live, and erode that ignorant darkness that's all around us.