Archive for April, 2009

High Performance Timing

Apr 23

A lot of times we need to know how long a process takes. The simple way to do this is

dim startDate as DateTime = DateTime.Now 

' do work 

dim elapsed as TimeSpan = startDate.Subtract(DateTime.Now)
Console.WriteLine(elapsed.TotalMilliseconds)

For a general sense of time this works fine but this is not entirely accurate. DateTime.Now pulls from a lower frequency clock and can be off by milliseconds (or more).

To use a highly accurate timing MS introduced the stopwatch  class in .NET 2.0. This class polls the high frequency clock to get accurate timings:

dim timer as Stopwatch = Stopwatch.StartNew

'do work

timer.Stop()
console.WriteLine(timer.ElapsedMilliseconds)

Another thing you can do is call Start() and Stop() on the timer multiple times and it will still keep summing up the time elapsed (just like a regular stopwatch).

Filed Under: General

Iterative Hashing: Less Secure Is More Secure (in theory)

Apr 23

*DISCLAIMER: This is only a theoretical idea. I have not confirmed that this could increase security of an iterative hash. Please take that into account when reading this.

I was explaining iterative hashing the other day and came up with an interesting theory: Using a weak algorithm may result in a stronger hash. The reason for this is collisions that can happen in algorithms like SHA0, SHA1, and MD5 (a collision is when two separate strings yield the exact same hash). By using a collisionable algorithm in an iterative hash we could potentially throw an attacker way off.

  Valid Attacker
Original Data HelloIAmData 56r335u8425
iteration 1 dfti34548247 fskwrtujrwf
iteration 2 est84354u544 rtietyrt3487
iteration 700 er54djrt5ejh 458432423uitd
iteration 701 dfsujweru5 6483247435u
iteration 702 ase6ae4rha ase6ae4rha
iteration 1000 a473uj4w5h a473uj4w5h

Iteration 701 is where things break down. The hash we had from iteration 702 (ase6ae4rha) has a collision on it. Both dfsujweru5 and 6483247435u will create that hash. In this case the attacker broke ase6ae4rha with 6483247435u not dfsujweru5. Now the attacker tries to break 6483247435u and the hash that results from that which has now put them on the totally wrong path and they will never crack this hash.

Now don’t run out and start using a lesser algorithm based on this information collisions do not happen that often. The collisions in SHA1 are only considered theoretically possible as it would take 2^69 operations to find a collision that matches an existing hash (for SHA0 it would take 2^39 operations).

As I do not have the processing power required to do this I can not calculate the chances of this actually happening. Nor can I vouch for if this is a feasible defence strategy.

Filed Under: Security

Things I Can’t Develop Without: Source Control

Apr 13

Source control is such a crucial tool that I will not develop without that I forgot about it when doing the “Thing’s I Can’t Develop Without” series.

For those of you that have never heard of source control (most people have but just in case you have not). It is a simple tool that allows you to check in code to a central repository that records your changes. This allows for several nice features.

  1. Versioning. You can easily view or rollback to old versions of code. This allows us to change or delete whatever we want knowing we can easily rollback the code to its previous state.
  2. Collaboration. It is really easy for multiple people to work on the same code base as the source control system is our central repository. Users can each work on their own tasks and then commit it to the central repository.
  3. Change Tracking. Comments can be added to checkins so that we can see who changed what and why (if the person who checked in the code actually put a comment in that is)
  4. Backup. The code is not just held on one place anymore. It is at least on the source control server and on one (or more) developers machines.

For me a project can not exist without being under source control. Even at home I have a source control system for my projects. I can not tell you the number of times I have used it’s functionality for even the simplest of projects.

There are lots of choices out there. The most common ones in the .NET community are Visual Source Safe, Team Foundation Server, and Subversion. Subversion is our choice so far as it is free and we find it much easier to work with than VSS or TFS. One that is growing in popularity is Git but I have not had the time to play with it yet.

There are lots of great articles out there on all these source control solutions so I will not repeat them.

Filed Under: General

Announcing My New Open Source Project: Fluent Build

Apr 9

I have created a fluent interface around doing builds, allowing users to write build scripts in a simple and terse manner.

The project is hosted at http://code.google.com/p/fluent-build/

It is just the start of the project but thought I would get it out there and get feedback earlier rather than later.

Here is a sample build class:

internal class MainBuildTask    {        private string directory_base;        private string directory_compile;        private string assembly_FluentBuild;        private string assembly_FluentBuild_Tests;        private string thirdparty_rhino;        private string thirdparty_nunit;        private string directory_tools;

        public void Execute()        {

            directory_base = Environment.CurrentDirectory;            directory_compile = directory_base.SubFolder("compile");            directory_tools = directory_base.SubFolder("tools");            assembly_FluentBuild = directory_compile.FileName("FluentBuild.dll");            assembly_FluentBuild_Tests = directory_compile.FileName("FluentBuild.Tests.dll");            thirdparty_nunit = directory_compile.FileName("nunit.framework.dll");            thirdparty_rhino = directory_compile.FileName("rhino.mocks.dll");                        DirectoryUtility.RecreateDirectory(directory_compile);            CompileSources();            CompileTests();            RunTests();        }                private void CompileSources()        {            FileSet sourceFiles = new FileSet().Include(directory_base.SubFolder("src").RecurseAllSubFolders().FileName("*.cs"));            CreateBuildTask.UsingCsc.AddSources(sourceFiles).OutputFileTo(assembly_FluentBuild).Execute();        }

        private void CompileTests()        {            var tools = new FileSet().Include(directory_tools.RecurseAllSubFolders().FileName("nunit.framework.dll"))                                     .Include(directory_tools.RecurseAllSubFolders().FileName("rhino.mocks.dll"));

            Copy.From(tools).To(directory_compile);            FileSet sourceFiles = new FileSet().Include(directory_base.SubFolder("tests").RecurseAllSubFolders().FileName("*.cs"));            CreateBuildTask.UsingCsc.AddSources(sourceFiles).AddRefences(thirdparty_rhino, thirdparty_nunit, assembly_FluentBuild).OutputFileTo(assembly_FluentBuild_Tests).Execute();        }

        private void RunTests()        {             Run.Executeable(directory_tools.SubFolder("nunit").FileName("nunit-console.exe")).WithArguments(assembly_FluentBuild).Execute();        }

    }
Filed Under: General