Clone a GitHub project into Eclipse

I've been using the Git command line tools to setup my workspaces against GitHub and then importing projects into Eclipse going back and forth to the command line to diff, commit and push back to origin. In my current project I've discovered the Git Repository Explorer in Eclipse and how it makes many of the tasks much easier.

To clone an existing GitHub repository add the perspective Git Repository Explorer

Choose to clone a repository

Add details about the remote repository

The URI can be found on the GitHub page for the repository you wish to clone

Select the branch to check out and in the next view tick the "Import all existing projects after clone finishes"

Then you got your project in your workspace as expected

Now the usual Eclipse goodies har here for you, to diff local changes is much clearer than the command line diff utility for example

The synchronize option to see all changes in your local copy

Inspecting the history of the file is also presented in a more readable manner

Commit and push to origin (GitHub in this case) is a single operation if you wish

Spice up your comments

I was searching for something on StackOverflow and found this off-topic thread on comments.
A few gems:


Exception up = new Exception("Something is really wrong.");
throw up; //ha ha


//When I wrote this, only God and I understood what I was doing
//Now, God only knows


// 
// Dear maintainer:
// 
// Once you are done trying to 'optimize' this routine,
// and have realized what a terrible mistake that was,
// please increment the following counter as a warning
// to the next guy:
// 
// total_hours_wasted_here = 42
// 


//Mr. Compiler, please do not read this.


// I dedicate all this code, all my work, to my wife, Darlene, who will 
// have to support me and our three children and the dog once it gets 
// released into the public.

// drunk, fix later


// Magic. Do not touch.


return 1; # returns 1

// If I from the future read this I'll back in time and kill myself.


double penetration; // ouch

/////////////////////////////////////// this is a well commented line

// I am not sure if we need this, but too scared to delete. 

// I am not responsible of this code.
// They made me write it, against my will.

//Dear future me. Please forgive me. 
//I can't even begin to express how sorry I am. 

options.BatchSize = 300; //Madness? THIS IS SPARTA!

// I have to find a better job

// hack for ie browser (assuming that ie is a browser)

} catch (PartInitException pie) {
// Mmm... pie
}

// John! If you'll svn remove this once more,
// I'll shut you, for God's sake!
// That piece of code is not “something strange”!
// That is THE AUTH VALIDATION.

try {

}
catch (SQLException ex) {
// Basically, without saying too much, you're screwed. Royally and totally.
}
catch(Exception ex)
{
//If you thought you were screwed before, boy have I news for you!!!
}

// Catching exceptions is for communists

// If you're reading this, that means you have been put in charge of my previous project.
// I am so, so sorry for you. God speed.


/**
* For the brave souls who get this far: You are the chosen ones,
* the valiant knights of programming who toil away, without rest,
* fixing our most awful code. To you, true saviors, kings of men,
* I say this: never gonna give you up, never gonna let you down,
* never gonna run around and desert you. Never gonna make you cry,
* never gonna say goodbye. Never gonna tell a lie and hurt you.
*/


// If this code works, it was written by Paul. If not, I don't know who wrote it


/**
* If you don't understand this code, you should be flipping burgers instead.
*/


//Abandon all hope yea who enter beyond this point



catch (Ex as Exception)
{
// oh crap, we should do something.
}

// TODO make this work


// This is crap code but it's 3 a.m. and I need to get this working.

Netflix on Linux Mint 14

Netflix uses Microsoft Silverlight in their web version which makes it impossible to watch Netflix on Linux machines since no native client is available. The Pipelight project has released a plugin that emulates Silverlight using the Netscape Plugin API and wine. So all browsers supporting the Netscape Plugin API like Firefox and Chrome should be able to use this trick.

This is tested on my Linux Mint 14 HTPC with Chrome and works like a charm. It is even faster then the earlier Linux Desktop Netflix client that was available as apt-get install. 

If you have an earlier version of Pipelight first remove it

sudo apt-get remove pipelight

Install the plugin and enable it

sudo apt-add-repository ppa:ehoover/compholio

sudo apt-add-repository ppa:mqchael/pipelight

sudo apt-get update

sudo apt-get install pipelight-multi

sudo pipelight-plugin --enable silverlight

That should be it. But the Netflix web site has a check that your browser is a Windows based browser. Emulate this by installing a plugin that enables you to choose which user agent your browser should mimick. I use the User Agent Shifter for Chrome.

If you use this one, switch to Windows Firefox 15 or similar in the menu.

Pipelight also supports Adobe Flash, so if you have need for that, install it via

pipelight-plugin --enable flash

Simple backups with rsync

Here's my notes on how I setup my home network backup system in case I forget it.
I was first thinking of backing everything to some cloud service like Google Drive or Dropbox, but it will be quite expensive since I have too much home movies, images and sound recordings. So what I've done is that I have one backup of the stuff on a USB harddrive and another duplicate on the HTPC server. The same technique could be used to backup to a server at a friends house to make the backups completely fire proof.

Using the old Unix command rsync it is really easy to automate this. I installed rsync via cygwin, google for cwrsync which is rsync for Windows. My HTPC is a Linux Mint server so I created a RSA keypair for my Linux user and stored the keys on my Windows desktop machine in directory c:\docume~1\Johan\.ssh\id_rsa_rsync_johanhtpc.

So now we can authenticate against the HTPC with ssh which rsync supports and I only need to create a configuration of what I want to synchronize.

I created a config command file like this.

@ECHO OFF

SETLOCAL

SET CWRSYNCHOME=%ProgramFiles(x86)%\CWRSYNC

SET CYGWIN=nontsec

SET HOME=%HOMEDRIVE%%HOMEPATH%

SET CWOLDPATH=%PATH%

SET PATH=%CWRSYNCHOME%\BIN;%PATH%



rsync -av --chmod u+rwx -e "ssh -i c:\docume~1\Johan\.ssh\id_rsa_rsync_johanhtpc" "/cygdrive/e/Dokument" johan@johanhtpc:PCBackups

rsync -av --chmod u+rwx -e "ssh -i c:\docume~1\Johan\.ssh\id_rsa_rsync_johanhtpc" "/cygdrive/e/Musik" johan@johanhtpc:PCBackups

rsync -av --chmod u+rwx -e "ssh -i c:\docume~1\Johan\.ssh\id_rsa_rsync_johanhtpc" "/cygdrive/e/Programmering" johan@johanhtpc:PCBackups

rsync -av --chmod u+rwx -e "ssh -i c:\docume~1\Johan\.ssh\id_rsa_rsync_johanhtpc" "/cygdrive/e/Bilder" johan@johanhtpc:PCBackups

rsync -av --chmod u+rwx -e "ssh -i c:\docume~1\Johan\.ssh\id_rsa_rsync_johanhtpc" "/cygdrive/e/Audiobooks" johan@johanhtpc:PCBackups

rsync -av --chmod u+rwx -e "ssh -i c:\docume~1\Johan\.ssh\id_rsa_rsync_johanhtpc" "/cygdrive/c/ws" johan@johanhtpc:PCBackups

rsync -av --chmod u+rwx -e "ssh -i c:\docume~1\Johan\.ssh\id_rsa_rsync_johanhtpc" "/cygdrive/c/recordings" johan@johanhtpc:PCBackups

rsync -av --chmod u+rwx -e "ssh -i c:\docume~1\Johan\.ssh\id_rsa_rsync_johanhtpc" "/cygdrive/c/render" johan@johanhtpc:PCBackups

So when run, rsync will check each folder on the Windows harddrive or external harddrive against the directory on the backup server. If new files have been created or existing files are updated they will be synchronized. No action will be taken for directories or files that are unchanged.

To automate this, I used the Windows scheduler. I added a task that will run each night at 00:59. It will simply run the above command.

Create server backdoors using SQL Injection

If you're a web programmer you are probably aware of the most common security mistakes we make. OWASP keeps statistics on what exploits are the most common. If you're not familiar with these, this should be mandatory reading https://www.owasp.org/index.php/Top_10_2010-Main.

As shown, injections are still one of the worse problems. If you're not familiar with SQL injection check out some basic ways to exploit it on vulnerable site. The examples are often about trying to select some sensitive data and getting the data to be rendered on the vulnerable site. 

I'm not a black hat hacker so I've always thought about SQL injection as something primarily putting the site and it's data into danger. But tag along to see that SQL injection can be the entry point of pwning the complete server and getting inside the firewall and the internal network.

Now, I was reading up on SQL the other day for a project at work and stumbled upon some SQL syntax I didn't know about. Combining this with an SQL injection vulnerability could be dynamite.

So first, assume you found a weakness on a site. There are tools for that, but basically try to append code to request parameters like ' or 'foo'='1 or similar to look for server crashes giving you a hint of SQL injection problems like Unknown column 'foo' in 'where clause'. Now you would "normally" start the tiresome work of finding something valuable in the database.

But, with the SQL syntax INTO FILE you can write files. Nice. So depending on what technology the server is based on you could write files that can be accessed via the web interface. If the file names in the URI don't give away what technology used look at the HTTP header value of Server. If for example the header talks about JBoss you can guess that the site is Java based and we could try to create JSP files. Similarly you could aim for creating PHP script files etc if that's whats dished out by the server.

So, by using something like this in the injection exploit (the red is what is supplied by the hacker via the request parameter injection)

SELECT a, b FROM someunknowntable WHERE someunknowncolumn = '' UNION SELECT '<?php system($_GET["cmd"]); ?>' INTO OUTFILE '/var/www/htdocs/pwn.php'; --

or similar for other scripting technologies like JSP, ASP etc you have created a public backdoor.

Catastrophe! 

Point you're browser to http://thesite.com/pwn.php?cmd=pwd

to print out the currect working directory of the web server process.

Now only imagination stops you. cmd=cat /etc/passwd /etc/shadow to dump all user credentials. If the web server is running as root it's too easy to start creating misery like keylogging the other users or dumping all databases.

The lesson from this is that if you have five web servers and databases hosting different sites on your server it is the weakest link of them that defines the total security. So by hacking the not so important server with an SQL injection weakness you can get to the data of the highly secured applications with no SQL injection weaknesses via a backdoor.

Some thought on avoiding this kind of problems

• Always use frameworks and libraries that removes the possibility of SQL injection. Java has prepared statements or some of the ORM technologies. The other languages has their own ways.
• Run the database process as a user with low file access priviligies so that it can't write files anywhere it shouldn't be able to. Or even better, run it on a separate machine.
• Same for the web server, don't run it as root. There are other ways of hacking web or application servers to gain shell access.
• A general good thought is not to reveal to much information about what technology serves the site if possible to make it harder to exploit knowledge about how it behaves. For example, don't show server versions in HTTP headers, don't show crash stacktraces in server responses in production mode and so on.

Sink Hole Animation

I made a little animation which fakes a sink hole in the platform outside the Umeå Östra train station. This relies on camera tracking which takes a real scene and incorporates it in a simulated 3D environment.

Prerequisities 

A camera, (in my case a Canon 550D), some bright post-its, Blender (free and open source), Gimp or other image processing software and a few hours of modelling time and a nights sleep for rendering the scene.

Pick a scene

Figure out a scene. To make the camera tracking easiser to automate, pick a bright scene so that you will have short shutter times. Also, (which I failed to follow) try to keep your camera steady and make pans slow and steady to avoid blurry and unsharp images in your film. Record in highest possible resolution of your camera.

Object tracking

You must find some high contrast objects in the scene which you will use to track during the movement of the real camera in order for Blender to figure out the relative position of these objects. Preferrably use objects which will have parallax shifts when you move around in the scene. Also use a few objects that lie in your ground plane (the train platform) so that you can create a correct coordinate system.

In this scene, I want good resolution around the sink hole, but there are few high contrast objects, so I scattered some yellow pieces of post it notes around the area. 

Record your movie, import it into Blender and use the new Movie Clip Editor, which has come in one of the latest releases, to tag tracking objects. In the best of worlds, the software can follow the movement of the high contrast objects through the whole movie clip. Didn't work like a charm for me, had to manually help the tracker when the camera panned fast, so that's a note to self for future trackings. When you solve the system, Blender will figure out how the camera has moved during the photo shoot and create a camera animation for that for the virtual camera used later when rendering.

Modelling and rendering

I made a real simple hole model in Blender with some gravel textures overlaying eachother. Then by using the composition features of Blender you can merge each frame in the original movie clip with the rendered model with the correct camera position. In this example, the large disk in the image representing the ground is not rendered in the final composition, but it can receive renderable shadows, so that you can have your own 3D objects cast shadows onto the ground in the movie.

For reference, the original movie looks like

This is based in an excellent explanation of the Blender camera tracking functionality by Andrew Price on BlenderGuru.

Hermanizer Power Pedal - A DIY Fuzz Box

For christmas gift to my brother I thought I'd try to make a guitar effect pedal. The main feature would be to have a nice sounding distortion effect, classic rock fuzz. I also found an article on Instructables by Harrymatic discussing adding a timer IC to the circuit to create a sound slicing/chopping kind of effect. This construction is based on his ideas.

So what you need is an amplifier IC, I used an LM386 circuit which can amplify a signal up to 200 times. To be able to control the amplification and the output signal, two potentiometers (resistors with variable resistance) acts as gain and volume controls. The sound slicing effect is created by a NE555 timer circuit which flips the voltage on its output pin high and low in a repeating fashion. The frequency of this is determined by a third potentiometer which is glued to a "effect rate" knob.

Circuit diagram of the effect pedal - click for larger picture

Depending on the state of the FX On/Off switches, pin 6 of the amplifier IC is fed by either a constant feed from the power source or a chopped up square wave from the timer IC.

So first step to try this out was connect everything on a breadboard.

If you buy your ICs with DIL8 sockets they will fit nicely on a standard breadboard. An important lesson from this setup is that you must ground both your input jack coming from your instrument and the output jack going to headphones/speakers/amplifiers or else you will get very disturbing hizzes and noises.

Once everything worked out on the breadboard I printed and soldered the circuits on a stripboard. The soldering is not shown in this picture since the circuits are on the backside of the stripboard.

For a case I bought a metal case and drilled the necessary holes for the potentiometers, switches and the power LED.

I bought the stuff I didn't already have at home from ELFA. It amounts to somewhere around 200 SEK. The integrated circuits are about 8 SEK each but the casing and the knobs turned out to be the most expensive stuff.

After stuffing everything inside the pedal works fine. When only using the distortion effect no hearable background fuzz is noticed. However, when enabling the chopping effect there is a constant background noise which is evident if no signal is coming from the instrument.

The final effect box

So how does the pedal sound? Well, this is the sound when applying quite a lot of distortion effect on an otherwise clean organ sound. I'm not a guitar player like my brother, but here's a few chords from my old Squire guitar lined directly into the effect pedal with pretty much distortion.

Here's a synth line which after a few seconds get the the chopper effect applied. In the end of the clip the rate of the effect is increased to maximum.