Frankencode

During work on client bindings for AT-SPI this week python managed to surprise me in a couple of ways.

1. Lambda doesn’t work as I think it should.

   lambda x: del(x) results in a syntax error. This is clearly stated in the python language reference: lambda_form ::= "lambda" [parameter_list]: expression The del statement is not an expression; unsurprisingly its a statement. Its still pretty non-intuitive.

2. You cant weak reference a weak reference.

   This must be an implementation issue. I’m sure a weak reference of a weak reference makes sense. It did to me at the time!

3. __slots__ is the most useful thing in the world.

   Just take a look at this graph. Its the results of a totally scientific, completely well researched, test into the size of different structures in python. They are all holding roughly the same amount of information.

   

   Structure Type	Memory use (kB)
   Slot Object	18988
   Tuple	19252
   List	19476
   Dict	42768
   Object	44320

Hopefully everyone already knows that Debian & Ubuntu have let us all down over the past two years by shipping a woefully insecure OpenSSL package. Personally its destroyed a-lot of faith that I had in the Ubuntu operating system.

Most of us, who arn’t deeply involved in our OS, have to simply trust in the processes and people putting it together. I’m no exception. Before this happened I had no real understanding of the packaging / development process for Ubuntu, and no great interest in it either. More fool me. This one security breach has left me scrambling to find out what went wrong.

 Fixing the cause

This one isn’t going to go away because the fix has been shipped. There is still a serious flaw in the Ubuntu and Debian development process that I’m hopeful the developers are working this out on the mailing lists / irc right now.

Erich Schubert had to say about the maintainer who made the mistake ” But you bet he’s going to be a lot more careful with any change in the future: he has learned his lesson”. I’m sure he has, but as Erich mentioned shortly after , lots of other maintainers won’t. Nor is there going to be a massive increase in the code quality of upstream software, even for security-sensitive things like OpenSSL. Badly commented software and miscommunications are facts of life, what Ubuntu needs is processes that catch these mistakes in a little less time than 2 years.

 Regaining my trust (and perhaps others too)

I’m fairly sure that things are taking place to make sure this doesn’t happen again. But, like so many institutions, Ubuntu can’t just do right on this one. It has to be seen to do right. The solutions that they come up with must be timely, and extremely public. There are a huge amount of people and companies that use Debian & Ubuntu. Not all of them have time to trawl mailing lists and blogs. Its a biggie, If Canonical don’t start talking loudly about this its a real incentive to move to a different distribution.

Work is starting on the port of the AT-SPI framework to D-Bus. Codethink are, graciously, being funded by Nokia to undertake the work. Mike Gorse is working on the project full time, as part of his work for Novell.

Mike has got alot done and there are some initial D-Bus specifications, as well as alot of code on the ATK to AT-SPI adapter side. For the moment we’ll both be working in a git repository on Codethink. Hopefully we will be able to move the code into a repository on freedesktop one day.

The AT-SPI D-Bus work is important as it is attempting to eliminate the last vestiges of CORBA from Gnome and at the same time help with cross desktop accessibility. I’m hopeful that despite the transition we will be able to create a flexible and performant D-Bus protocol for AT-SPI.

I’ve written before about our results on D-Bus vs CORBA performance, done in preparation for this project. The results were a bit shocking for the D-Bus team so there need to be some significant changes to the IPC for things to remain snappy.

history|awk ‘{a[$2]++ } END{for(i in a){print a[i] ” ” i}}’|sort -rn|head
118 ls
104 vim
72 cd
67 make
14 rm
12 ./test-directory
11 git
10 ./mjpass
9 gvfs-mount
9 cp

It seems that the posts by Mikkel and Daniel were April fools jokes. My sense of humor was broken by about midday so I missed the gag. Next year I will avoid the internet all together on the 1st of April.

A few years ago I had an unpleasant experience with the police over here in the UK. My mum was contacted about a car accident that had taken place in the car park of a fabric store. She had no idea what had taken place, apparently a car had been damaged while someone was maneuvering. My mother’s number plate had been taken and she was going to be charged. The whole thing was utterly overblown, and she was never convicted. (For anyone’s reference, you apparently can’t be charged for most motoring offenses if they take place on private property.)

My part in the affair was accompanying my Mum to the police station for questioning. When we got there she was fingerprinted, had her DNA taken, and was questioned somewhat aggressively by two police officers. (Remember this is for possibly scratching a car in a car park).

I was so mad at myself for a long time afterward. The police were taking advantage of us because it was new and unexpected. What happened to Mikkel and Daniel, who were contacted unannounced by legal representatives of Apple, sounded like something similarly abusive, and bought back some of the anger.

Its a mess

I’ve been worried recently about how secure I am online. There has been a huge amount of news coverage over here in the UK about personal digital security. As someone who works as a software engineer, I always feel slightly smug when such stories are reported.

I really shouldn’t have done. On spending time looking at where account were held:

31 separate logins.

3 passwords used.

4 sites I could no longer log in to.

Although I had tried to separate out junk and secure passwords, there were some relatively insecure sites using the same password as places that had access to financial details. All in all, very insecure and a complete mess.

What can be done

As time goes by I think this situation may just get worse unless websites wise up. I felt much better about the e-commerce sites I had been to that offered paypal payment methods, or simply payment without having to open up an account. OpenID certainly has a role to play, although seems pretty flawed without some improvements in the phishing situation.

Until then I’ll have to spend the time, dull time, organizing my digital identity. As will everyone else.

I’ve taken part in a couple of phone calls this week, a quick conversation with Michael Meeks and a conference call with the open a11y group. Both about AT-SPI D-bus. There was a week of silence after my initial e-mail to lots of accessibility lists, and after that something of a storm. It was good to actually hear everyones opinion, I think people care, and AT-SPI D-Bus will probably happen sooner rather than later.

Thats pretty good news as Rob and I have spent LOTS of time discussing this one, with some of it being rather heated. Its all about “standardising” the AT-SPI interface, what constitutes a “component” system, and whether accessibility really needs object lifecycle management. Could anyone really have raised voices in a conversation about that?

I’m going to put together our thoughts / proposals for everyone to go through. (With heavy input / modification from Rob Taylor) Hopefully it will be up to scratch.

I really enjoy profiling and optimization, mainly for those WTF moments when results pop out the other end. Systems rarely behave the way anyone expects, and I doubt anyone would have expected this:

Wierd D-Bus performance

The graph is showing time taken to pass many many messages of different size fixed arrays over D-Bus and ORBit. At about 120k message size, Libdbus hits a performance brick wall. Its really hard for me to imagine whats going on here, but as soon as I have the time I’ll go back and do my best to find out.

As part of work we (Codethink) are doing for the Mozilla foundation I have been looking, at the performance of D-Bus vs ORBit. Its a well traveled road with Ross Burton, Havoc Pennington and Frank Dunigan all having posted results before. As far as AT-SPI is concerned though its Frank’s results that are quoted on the Open A11y wiki. “An alpha version of the D-Bus bindings for glib has been tested to be 18x slower than ORBit2″. Well this is no longer true, the tests were repeated and the results show a big improvement over time. D-Bus is now roughly 6 times slower. Its a wonder these haven’t been repeated before over the years. I guess the main thing is performance of the IPC for most apps just isn’t important. It might be for AT-SPI though, from the initial tests done on Orca, its a pretty heavy user.

All of the results can be found at:
http://live.gnome.org/GAP/AtSpiDbusInvestigation.