My paper on Secure Virtualization

My paper on trusted computing to secure virtualization is now live at Microsoft website. You can find it here:

http://research.microsoft.com/apps/pubs/?id=157213

PS: I do not work at Microsoft anymore.

JavaCard 3 Specifications Released

After almost one year after the announcement of the Java Card 3.0, Sun finally releases it!
Java Card technology enables smart cards and other devices with very limited memory to run small applications, that employ Java technology. It provides smart card manufacturers with a secure and interoperable execution platform that can store and update multiple applications on a single device.

Deployed in markets as diverse as Telecommunications (SIM applications), Finance (EMV) and Citizen ID (Passports and ID Cards), Java Card technology is the most pervasive open platform for secure devices, with over 3.5 Billion Java Powered smart cards deployed worldwide.

Sun Microsystems has now released the latest specifications of its market leading Java Card technology, and industry experts believe it will revolutionize the way smart card services are conceived and deployed.

Next Generation Java Card technology will be available in two separate, yet coherent editions.

Java Card technology, Classic Edition is based on an evolution of the Java Card Platform, Version 2.2.2 and targets more resource-constrained devices that support traditional applet-based applications. It introduces several incremental changes to the previous version to ensure alignment with smart card and security standards.

Java Card technology, Connected Edition features a significantly enhanced execution environment and a new virtual machine. It includes new network-oriented features, such as support for web applications, and support for applets with extended and advanced capabilities.

Both Editions are compatible with applications written for previous versions. They also share key security features and build on the trust and expertise derived from ten years of deploying secure Java Card products.

The specifications can be downloaded from here.

Blogged with the Flock Browser

VMWare 6.5 Beta

Workstation 6.5 and ACE 2.5 beta are out and available for download. The most interesting feature added for me is the Support for Smart Cards and Smart Card Readers. Also an interesting new feature is the “Unity” that integrates applications on guest to be controlled from the host. Not sure at the moment how will it effect the debate on testing / debugging malware in a Virtual envrironment.

Blogged with the Flock Browser

Sun Labs, Sun SPOTs

If you are interested in robotics, wireless sensors, java, or embedded systems programming and you have not heard of SunSPOTs yet, you really live somewhere on Mars.

Sun SPOT (stands for Small Programmable Object Technology) are very powerful and sophisticated little devices, perfect for sensor-based applications, and pervasive computing.

It is a battery-operated (USB charged) platform for development of radio-controlled sensor networks, robotics, and personal consumer electronics. Each kit comes with a base station and two Spot devices, each of which, in turn, includes a processor, a radio, a sensor board, and battery. You can also add servo motors and your own sensors on top of the acceleration, temperature, and light sensors that come with each Spot. You program and build the Java VM-based Spots to do whatever it is you want to build; examples of Spot applications developed so far include microwave detection, robotic-arm control, and slot-car control.

Technically a Sun SPOT has the following:

• a 3-axis accelerometer (with two range settings: 2G or 6G)
• a temperature sensor
• a light sensor
• 8 tri-color LEDs
• 6 analog inputs readable by an ADC
• 2 momentary switches
• 5 general purpose I/O pins and 4 high current output pins

Sun has also introduced a Sun SPOT Open Grant Program and a Request for Proposal is currently open. For details go here.

Sun Labs staff engineer, David G. Simmons, has an extremely helpful Sun SPOT blog that is worth checking out. And even YouTube has some 40 Sun SPOT videos with slot cars, a pumpkin that screams and talks when shaken, video games and more to check out. Also, for more on Sun SPOTs check out Roger Meike’s blog; he’s senior director of area 51 and director of operations at Sun Labs.

Blogged with the Flock Browser

KDE on Windows

For all *nix freaks who use windows for some reason or another, KDE has been ported to Windows and can be downloaded from here.

Blogged with Flock

A talk on Open Source on Software Freedom Day

The world celebrated the Software Freedom Day on 15th September 2007. We had some 100+ countries and more than 300 groups covering the free software world in different form of activities, presentations and events. The webmasters of FAST-NU Karachi also organized an event and talk series on the day and I felt really honored and delighted when I got an invitation to speak before the undergraduates of what open source is and how it is used in the industry.

I chose the topic “Open Source in the enterprise” picking up the best open source projects I use frequently and have known to be used as solid, industry standard applications in different domains. It was a wonderful experience going back to my university and meeting with a bunch of brilliant future computer scientists.

The slides of the presentation can be found here.

Collections Versus Generics in .NET

A pretty common task these days at work is migration and upgrading of older 1.1 framework code to the 2.0 framework. Some of the code is really straight forward to port to for example the System.Management Namespace based classes. However to leverage the new features of 2.0 a few changes must be made.

For anyone developing in .Net 2.0, Generics are definitely a great tool, allowing cleaner and more type-safe code. I was interested in how the use of Microsoft’s provided Generic classes in System.Collections.Generics performed relative to their non-generic alternatives.

I am often running into a question of whether or not I should bother changing out liberal use of the Systems.Collections classes in older code to use Generics. So I ran some tests….

Probably the most common collection used in pre-2.0 code is the ArrayList, so in these test I have compared the System.Collections.ArrayList class to the System.Collections.Generic.List class.

I created a c# console app in Visual Studio 2005, that ran a set of common operations against the two collections.The Complete code listing can be found at the end of the post.

I did a worst-case load for both generics and collections, letting the collection dynamically resize for random integer insertion, which is followed by a sort, and a traversal using the Contains() method. All of the items are 32bit Integers.

The test for Arraylist is exactly the same as the List test, with the obvious exception of the collection declaration. I ran the series of operations against the two collections with increasing item counts, and programatically timed them.

Result Output:

Size: 10000
Time taken by Collection: 15.6042 ms
Time taken by Generic: 0.002 ms

Size: 100000
Time taken by Collection: 187.2504 ms
Time taken by Generic: 15.6042 ms

Size: 250000
Time taken by Collection: 546.147 ms
Time taken by Generic: 62.4168 ms

Size: 500000
Time taken by Collection: 1263.9402 ms
Time taken by Generic: 218.4588 ms

It’s pretty clear who the winner is here. The Generic.List collection comes out substantially ahead of the ArrayList.

Not only is the Generic class faster, but it appears to scale substantially more linearly than the ArrayList, and handles the 10 million items in <1 second, compared to the 21+ seconds of the ArrayList.

From running a few more tests, I learnt that the real bottleneck on the Arraylist was during sorting and traversing the list. Each item is stored as an object, so it must be typed runtime, and then compared for sorting/searching. On the other side, the Generic List had all its items typed compile time, which saves alot of workload during sorting and searching.

So the first thing that comes to my mind, was that perhaps the collection logic was improved for the List, and it was dynamically resizing in a smarter fashion, which helped give it such a substantial speed increase. So I ran an interesting test…. I modified my code to use a List<object> instead of List<int>, so in theory, it would perform just as the ArrayList unless some other collection logic had changed.

The results were surprising. A List<object> performed within 5 ticks of ArrayList on any number of items.

This confirms that the performance gain of Generic Collections is entirely due to dropping the Object wrapper, and ridding us from the need to use Reflection on each object. So in conclusion, I can’t imagine wherein you would EVER want to use an Arraylist or SortedList in your .Net 2.0 code.

Happy coding.

using System;
using System.Collections;
using System.Collections.Generic;

namespace GenericCollectionComparison
{
internal class Program
{
public static int Length = 100000; //Int32.MaxValue;
private ArrayList arrayList;
private List genericList;
public static DateTime startTime;
public static DateTime endTime;
public static TimeSpan timeSpan;
public Random randomNumber = new Random();

public void fillCollection()
{
arrayList = new ArrayList();

for (int i = 0; i < Length; i++)
{
arrayList.Add(randomNumber.Next());
}

arrayList.Sort();
arrayList.Contains(randomNumber.Next());
}

public void fillGenerics()
{
genericList = new List();

for (int i = 0; i < Length; i++)
{
genericList.Add(randomNumber.Next());
}

genericList.Sort();
genericList.Contains(randomNumber.Next());
}

private void Run()
{
Console.Out.WriteLine(“Size: ” + Length);
startTime = DateTime.Now;
fillCollection();
endTime = DateTime.Now;
timeSpan = endTime.Subtract(startTime);
Console.Out.WriteLine(“Time taken by Collection: ” + timeSpan.TotalMilliseconds + ” ms”);

startTime = DateTime.Now;
fillGenerics();
endTime = DateTime.Now;
timeSpan = endTime.Subtract(startTime);
Console.Out.WriteLine(“Time taken by Generic: ” + timeSpan.TotalMilliseconds + ” ms”);

Console.WriteLine(“”);
}

private static void Main()
{
Program program = new Program();
for (int i = 10000; i < Int32.MaxValue; i = i + 10000)
{
Length = i;
program.Run();
}
}
}
}

Playing with VMWare 6

My favourite virtualisation product VMWare is now in the sixth generation with its public beta available for testing in the holiday season. The product is continously being transformed for being the preferred tool for software engineers and security reasearchers due to its noticable features for ease of development, debugging and tracing.

Integration with Visual Studio for Debugging:

The first beta (build 36983) sports the much acclaimed integration with Microsoft Visual Studio and
Eclipse: when a new program must be tested developers can invoke run
and debug directly inside a virtual machine, always assuring a brand
new, secure and polished environment.

Headless mode:

Virtual machines can now run in background, without the VMware interface running. You can control the running VMs from an icon in the taskbar.

VNC Remote Control

Virtual machine can now be
controlled through VNC instead of using guest OS remote management
tools (no need to install VNC server inside the guest OS)

Cross-Platform Drag-and-Drop:

Files can be copied between host and guest level independently from the installed OSes

Increased RAM support:

Allocable RAM for VM has been increased from 3.6GB to 8GB. No more limits for maximum RAM allocable for all VMs.

New physical hardware support:

Support for USB 2.0 devices, 64bits sound cards and multiple monitors

New OS Support for Guests:

Includes Vista 32 and 64 bit editions i still need to get a hand to.

The beta roadmap defines another future killer feature called Replay. Workstation will be now able to record every moment of the virtual
machine life and reproduce it on demand, like in a VCR. The
revolutionary thing is Replay will not simply record what happens on
the screen, generating a traditional video, but will also record
computations made on VM, allowing developers to exactly verify what
happens during a fault inside virtual hardware for debugging purposes.

This article describes how the whole company offering can simplify development, testing and delivery of new applications),
but the most interesting thing anyway is introduced support for
VMI-paravirtualized Linux: despite company fail in achieving VMI
integration inside kernel, VMware seems to continue on its own way,
probably hoping that showing a completed and working solution will
increase chances to reconsider the approach.
So after introducing such support in an experimental version of Player, the company is distribuiting it mainstream through Workstation.

The beta is available here.

powered by performancing firefox

RemCom in OCS Inventory

Im pleased to announce that My Remote Command Executor Project RemCom is now officially being used in Open Computer and Software Inventory  Next Generation Project , which is one of the most widely used and successful hardware / software inventory, configuration and patch management open source project on sourceforge. You can see the link on this page for credits.

Special Thanks to Emmanuel GUILLORY of the OCS Inv Project for her insightful suggestions, recommendations and help.

powered by performancing firefox

Liscencing Update for RCE

I was recently requested that the liscencing of RCE (GPL Liscence) is too restrictive. I do not wish to debate over the difference liscences available for the open source community, yet I personally believe any kind of a restrictive clause in a liscence hurts the cause and the spirit of the foundation on which free software movement was built.

I tend to be quite flexible in distributing whatever code i write, so even though i was informed that my code will be used in a closed source proprietry application, still i did not hesitate in changing the liscencing structure.

So as of today, RCE is available under a revised BSD liscence.