In der dynamischen Landschaft der Cybersicherheit hat der Schutz von Softwarecode vor neugierigen Blicken höchste Priorität. Die C++ Verschleierung tritt als raffinierte Technik auf, die von Entwicklern verwendet wird, um ihren Quellcode zu verschleiern und es Hackern sowie Reverse-Engineering-Spezialisten zu erschweren, diesen zu verstehen und zu manipulieren. Dieser kryptografische Ansatz verwandelt den herkömmlichen C++-Code in ein undurchsichtiges Labyrinth und erhöht so die Gesamtsicherheit von Anwendungen.

Die C++ Verschleierung beinhaltet die gezielte Einführung von Komplexitäten und Redundanzen in den Quellcode, ohne dabei dessen Funktionalität zu beeinträchtigen. Dieser Ansatz zielt darauf ab, Reverse-Engineering-Versuche zu vereiteln und es unbefugten Entitäten außerordentlich schwer zu machen, die ursprüngliche Logik zu entschlüsseln. Verschleierter Code kann verworrene Kontrollstrukturen und die strategische Einfügung irreführender Code-Konstrukte enthalten, wodurch ein komplexes Labyrinth für jeden entsteht, der versucht, die Software zu analysieren.

Eines der Hauptmotive für die C++ Verschleierung besteht darin, geistiges Eigentum und proprietäre Algorithmen zu schützen. Unternehmen, die erhebliche Ressourcen in die Entwicklung innovativer Lösungen investieren, suchen oft nach Möglichkeiten, zu verhindern, dass Konkurrenten oder bösartige Akteure ihren Code leicht verstehen und replizieren können. Die Verschleierung bietet eine zusätzliche Schutzschicht, indem sie den Code für selbst erfahrene Reverse-Engineering-Experten undurchschaubar macht.

Darüber hinaus kann verschleierter Code nicht autorisierte Änderungen abschrecken und vor Schwachstellen schützen, die von Angreifern ausgenutzt werden könnten. Durch die Einführung der Verschleierung können Entwickler das Risiko von Code-Manipulationen verringern, sicherstellen, dass die Software wie beabsichtigt funktioniert, und die Wahrscheinlichkeit von Sicherheitsverstößen reduzieren.

Trotz ihrer Vorteile ist die C++ Verschleierung nicht ohne Herausforderungen. Das Debuggen von verschleiertem Code wird für Entwickler zu einer komplexeren Aufgabe, da herkömmliche Tools Schwierigkeiten bei der Analyse der verworrenen Struktur haben können. Darüber hinaus kann die Leistungseinbuße, die durch verschleierten Code entsteht, ein zu berücksichtigender Faktor sein, obwohl Fortschritte in den Verschleierungstechniken darauf abzielen, diese Auswirkungen zu minimieren. Zusammenfassend steht die C++ Verschleierung als mächtiger Verbündeter im fortlaufenden Kampf um die Sicherheit von Software. Während Entwickler bestrebt sind, ihren Code vor Reverse Engineering und unbefugtem Zugriff zu schützen, bietet die Kunst der Verschleierung ein effektives Mittel, um die Integrität und Vertraulichkeit von proprietärer Software zu gewährleisten. In der sich ständig weiterentwickelnden Welt der Cybersicherheit erweist sich die C++ Verschleierung als kryptischer Schild, der wertvollen Code in einem Schleier aus Komplexität und Widerstandsfähigkeit verbirgt.

The post Die Entwirrung der Kunst der C++ Verschleierung: Code-Sicherung in einem kryptischen Web appeared first on Rene Windegger.

During the last years I was working on different projects, most of them involving non disclosure agreements.

That’s why it took some time for me to reappear. During that time I did some side development that got obsoleted by the European parliament when accepting the Directive on Copyright in the Digital Single Market.

When looking over the accumulated repositories a small little class caught my attention. It was not much but a neat little thing.

I started to ask around if it’s ok to LGPL the code. The feedback was good. So I started to extract the code into a fresh repository. The GitHub repository was born.

Starting an Open Source project

Starting an open source project is very straight forward. GitHub offers great support to get you started. And even offers you help to select the right license for your requirements.

The next thing after setting up the repository is getting a build setup. One of the easier ways to get going for your .Net project is using a service like appveyor.com. Setting up the build is very straight forward and happens in a nice integrate user interface. You select a repository from your linked GitHub account adjust some settings and the build is working.

After being able to build you need to be able to deploy the library. When using the .Net ecosystem there is only one good solution for dependency management and publishing.

Let me introduce nuget. Just create an account and you’re good to go. For the integration with appveyor add an API Key on nuget.org and use it during your build. After a short validation your new package will show up in the package feed.

Great it’s there let’s use it

After all that setup is done you figure out that you need to setup some documentation. GitHub even offers a quick solution for that. Activating GitHub pages on the repository will create a public facing website using Jekyll. There is a set of ready to use themes defined. And your README.md file will be automatically available.

So with the documentation in place let’s take a look at how to a reference can be added to RabbitExpress now. Using Visual Studio you can just use the Manage NuGet Packages menu entry. Searching for RabbitExpress will yield the result on the right.

When you use the Visual Studio window simply add the reference to RabbitExpress.JsonSerializer to your project. This will take care of all the dependencies required by RabbitExpress and allows you to use the QueueClient in your project.

Using RabbitExpress to talk with RabbitMQ

Integration is very easy. The Examples offer a great start for your use. All you need is an instance of RabbitMQ ready.

Using the RabbitExpress publisher

The Publisher just makes use of the Publish method.

View the code on Gist.

As you can see the code is pretty straight forward. Observe the call to Publish in Line 60. The object that is passed is just a plain object. The queue name is specified using the Queues enumeration and prevents typos.

Implementing a worker using RabbitExpress

A worker is a simple program that only has one concrete task. In our example the task of the worker is to output messages that it receives from the queue. The example randomly fails and adds the message back into the queue, so another worker can try to process the message or after some time the error is recovered and the current worker receives the message again. When the worker receives an empty message it just rejects the message without adding it to the queue again. Let’s take a look at the example.

View the code on Gist.

This example requires a little more knowledge. It is using the Methods of the QueuedMessage to signal failure or success. And when it receives the exit message, the loop will end.

You can see the different forms of rejection used in Line 63 and Line 82. In Line 73 you can see the call to Acknowledge.

What is next

The next thing to do is adding more serializers to the project. Serializers allow to pass data around in messages. At the moment you will only find a JSON serializer.

Implementing your own serializer is very easy. Just implement the IExpressSerializer interface. Only two methods need your attention to implement the interface.

View the code on Gist.

Over the next couple of weeks there will show up different serializers. A Protobuf serializer is already in development and development on a msgpack serializer will begin shortly. Do you have other ideas, let me know in the comments below. When multiple serializers are available adoption rate increases and with higher adoption rate new ideas spring up on it’s own.

Conclusion

Starting an open source project is quite easy. There is a lot of infrastructure already in place and starting the usage is free of charge. After the initial setup there are multiple channels your open source project gets listed. nuget became the predominant channel for package distribution in .Net. No the library is out in the wild. I’m looking forward to feedback. The project the class was extracted from is already using the new NuGet package. When you use the library and end up here drop a line in the comments.  When encounter an issues, make sure to create an issue on GitHub, also when you think you can contribute. Feel free to create Pull Requests on GitHub.

With all that said. I hope you enjoyed the post. Maybe I have another post sooner than the last time.

The post Release RabbitExpress appeared first on Rene Windegger.

What are barcodes?

When you like to transfer information in an analogue fashion you have to deal with encoding and decoding the information in an efficient manner. Optical Character Recognition (OCR) could be an efficient way to process human readable data, on the other hand it is very prone to error. Transporting information in a nonhuman readable way is more efficient than dealing with OCR. Barcodes use lines to represent information. The representation of a datum is called encoding. There are many different encodings on the market. Lately QR code became public. QR code is a different form of barcode. The EAN-13 barcode is classified as 1D barcode. That means that only one dimension of the analogue label contains information. QR code is a encoding that is called 2D barcode. 2D barcodes contain information on both dimensions on the label.

Why ECMA Script and SVG?

Scalable Vector Graphics in short SVG is a XML dialect that is able to describe graphics. Those graphics can be scaled to any size and thus are perfect to create printable labels. Every printed barcode needs to be crisp clear otherwise the reader can’t process the information. Some encodings are capable of error correction but still having the option to scale it up as large as you like makes SVG a great tool for creating a barcode.

Creating the generator in JavaScript ensured that the process is not relaying on server side infrastructure. On the other hand you can integrate it into a server side solution as well using node.js. It might even become possible to integrate it directly into different desktop publishing software.

The post Generateing EAN-13 barcodes with Javascript and SVG appeared first on Rene Windegger.

Another Startup

During my research, I found another company that will be interesting. The Canadian company, also named MediPrint, is providing 3D printed replacement bones. They even offer 48 hours turnaround time for your custom ordered replacement bones.

Conclusion

When you’re looking for some sectors to invest, you will find a lot of potential in HealthTech companies. There still is a lot of space for improvement. I can’t say if one of the two mentioned companies is a good investment. So make your decision to invest based on your own due diligence. And get someone with better Spanish knowledge than me.

The post NovaCast a 3D printed cast by MediPrint appeared first on Rene Windegger.

I totally agree with him about the open floor office. It’s horrible, you can’t focus on your work and get a flow going. It’s important to get in the state of mind where you can let the creativity flow, imaging software development as writing book, without the right state of mind you won’t be productive.

When it comes to office designs, distractions are a big nuisance when trying to get into the flow. When you get interrupted during the flow, it takes some minutes to get back into the flow again. Open offices tend to create interruptions.

I was once working in a small scale open floor office. It was a pain to teach the sales force to not simply come into the room and interrupt everyone. Sales persons tend to need input and they need their input now. Teaching them to prepare their questions in an ordered way and inviting the technician to a meeting does wonders in that regard.

That behavior is understand able, but could break a good flow of code. Joel notes that developers get 2 hours of uninterrupted coding time. During that time, I think the team I’m working with didn’t get that time at all.

How can you help your developers?

It should be easy to get your developers the uninterrupted daily flow time. The first step is to plan your office time well. Introduce a stand up meeting and enforce the a time constrain. Next start to use your meeting planing tools, block a fixed time slot every day. Figure out the most productive time for every of your developers and let them block that time in their calendar.

So when you see some issues in your current workforce, look at the environment they are working in. It might actually be that your workforce simply needs some flow time to get back on track. When you think your team lacks other issues as well feel free to contact me. It might be easy to get you back on track and make your team deliver great software in time. When you currently not able to answer 12 of 12 questions of the Joel Test with yes, contact me as well and we will figure out how to proceed.

The post GeekWire Interview with Joel Spolsky appeared first on Rene Windegger.

Immer wenn man es mit gestressten Menschen zu tun hat, sollte die erste Regel lauten Ruhe zu bewahren. Ich war an der Zufahrt positioniert und hatte den Posten gerade erst Übernommen. Bis zu diesem Zeitpunkt war an der Schleuse wenig Betrieb, das Entladen der Lastkraftwagen ging gut voran und der Annahme-stopp rückte immer näher. Es gab eine kleine Blockade am weg zur Ausstellungshalle und ich sollte die Fahrzeuge entsprechend einweisen.

Man könnte denken das Menschen ruhig sind, aber nicht wenn nur wenig Zeit für die Lieferung verbleibt. Als ich nun an der Schleuse stand kam ein Fahrzeug näher, der Fahrer wurde Langsamer und sagte etwas darüber das er zur Messehalle müsse. Er war sehr gestresst und nicht zu beruhigen. Ich versuchte ihm die Situation zu erklären und ihm zu vermitteln das er sich doch bitte hinter dem bereits wartenden Truck einreihen solle. Stattdessen hat er die Situation genutzt und ist direkt zur Halle weiter gefahren.

Im nächsten Auto war ein ruhiger Fahrer der sich ohne zu Zögern hinter dem wartenden einreihte, zumindest bis zum nächsten Auto. Nach einer kurzen Unterhaltung mit dem Fahrer des nächsten Fahrzeugs, habe ich ihm vermittelt er solle sich auch Einreihen und warten. Als ich zum nächsten Fahrzeug weiter ging und unmittelbar keinen Gedanken mehr an dieses Fahrzeug verlor. Als ich beim bereits wartenden Fahrzeug angekommen war, drehte ich mich um und sah, dass der Fahrer meine klaren Anweisungen ignoriert hat.

Dies hatte zur Folge, dass der Fahrer des ersten Fahrzeugs, den Hügel rauf gerannt kam. Er war noch immer sehr geladen und fing an herum zu schreien. Um ehrlich zu sein, war ich nicht wirklich im Stande seinen Ausführungen zu folgen, er war zu schnell und zu laut.

Nach einigen Minuten Geschrei sagte er zum Fahrer, welcher noch immer brav wartete das ein Fahrzeug den Weg zurück kam, er solle los fahren. Also was tun um die Situation nicht für alle beteiligen schlimmer zu machen? Man stellt sich mitten auf die Straße ohne angst Überrollt zu werden. Der gestresste Fahrer schrie noch immer und versuchte mich einzuschüchtern.

Wenige Minuten später kam ein Kollege zur Hilfe, und war tatsächlich in der Lage den Fahrer zu beruhigen. Das Fahrzeug welches den weg zur Halle blockiert hatte war dabei das Gelände zu verlassen und alles konnte seinen geordneten Lauf nehmen.

Währen der nächsten Tage kam der Fahrer auf mich zu und hat mich auf ein Getränk bei sich am Stand eingeladen. Für viele Menschen ist er bestimmt Einschüchternd aber sein Verhalten war wie Ausgewechselt.

Also was ist geschehen?

Nach meinen Beobachtungen, würde ich sagen ich habe ihn mit meinen Verhalten beeindruckt. Viele Menschen versuchen jemanden einzuschüchtern, aber solange man selbst ruhig bleibt und der Mensch mit dem man es zu tun hat nicht besser in einer Anstalt aufgehoben wäre, kann man davon ausgehen sicher zu sein. Behaltet das im Hinterkopf wenn ihr mit gestressten Menschen interagiert. Gib ihnen ein Ventil an dem sie den Druck ablassen können und versuche sie zu beruhigen. Nach einiger Zeit werden sie realisieren, dass ihr Verhalten nichts zum schnelleren verändern der Situation beiträgt.

Nachdem seine Aufgabe erledigt war fing der Fahrer an sich zu Entspannen. Er kam auf mich und meinen Kollegen zu, war freundlich und hat uns an seinen Stand eingeladen.

Währen der Messe hatte ich leider nicht die Zeit ihn zu Besuchen, aber als wir bereits mit dem Abbau der Veranstaltung angefangen hatten, kam er auf mich zu ich solle mir ein Getränk bei ihm holen. Als ich das tat gab er mir noch 2 Coupons für sein Restaurant. Also werde ich demnächst mal Claire’s besuchen. Ich denke ich mag sri-lankische Küche.

The post Ruhe bewahren und nicht Einschüchtern lassen appeared first on Rene Windegger.

Wie wurde es gemacht?

Da diese Seite WordPress verwendet benötigt eine Mehrsprachige Seite etwas arbeit. Ich habe mehrere mögliche Lösungen evaluiert und bin zur Erkenntnis gekommen, das WPML die richtige Wahl darstellt.

WPML ist ein tolles WordPress Plugin welches das Übersetzen von fast allen Seitenelementen erlaubt. Viele Premium Themes und Plugins haben WPML Unterstützung im Lieferumfang.

Die Installation von WPML ist sehr geradlinig und einfach, die Verwaltungsoberfläche bietet ausgezeichnete Wege um Seiten und Posts zu übersetzen. Abhängig von Ihrem Theme, ist die Integration in das Frontend einfach gestaltet.

Wenn Sie Unterstützung beim Konfigurieren und installieren von WPML in ihrer WordPress Umgebung benötigen, zögern Sie nicht Kontakt mit mir aufzunehmen. Ich werde Sie gerne Unterstützen.

The post Mehrsprachiger Blog appeared first on Rene Windegger.

Why do I tell you about the Simple Sabotage Field Manual?

It’s not that easy to answer. Actually I can somewhat relate to the manual and I’ve done some observations during my work life. There was a time in my work life, during that I faced some very strange feelings, that some of the stuff you get thought in business school, can kill all innovation and progress in a company.

After my study of the Simple Sabotage Field Manual, I knew that my feeling was on the right track.

I’m going to take a look at the section I found most interesting while reading the manual. Everything I’m going to talk about can be found in the chapter „(11) General Interference with Organizations and Production„.

The first section in that chapter lays the further rule set for the saboteur regarding corporations. Some of the stuff I could observe in multiple companies I’ve worked for and with. I would even say that some of that behavior can be found in almost every corporation. One of the examples I’ve actively noticed multiple times is about building committees.

A word about committees

What I’ve learned about committees is that as soon as you need a committee to solve a problem you’re doomed and have to deal with immense time scales. Nowadays most committees meet at defined times, once a month or even once a quarter year. During their meeting they need to have all the information available to make decisions. Since no one wants to be blamed for wrong decisions, in many cased that decisions get postponed. You can imaging what that means for a project.

About written orders

Another thing I’ve actually seen is the demand for written orders. Without written orders you’re doomed, when you have written order you might still be doomed. So there is not to much difference to having a written order or not. The only thing about a written order is you don’t have to discuss afterwards about what was included in the offer.

Little impact large issue

There is another thing managers tend to do unintentionally. Refer to point 7 in the manager section. It’s hard to believe that stuff like that really happens, but I’ve seen stuff like that happen. When dealing with data in large quantities from an unstructured source and import it in a structured manner, you almost always happen to have to deal with data issues. So let’s say we have a set of multiple millions of entities and then we have 4 to 5 errors. How would you approach that issues? I would say let’s have a look at that specific entries and see if we can solve the issue or if they simply don’t fit with the new data structure. You won’t handle that 5 corner cases in an automated way. You’re wrong, I’ve seen multiple project go way over time because of issues like that.

Multiply paperwork

Another thing I’ve noticed is point 12. In every company, there was some sort of time tracking. So you have to do time tracking for your attendance and about what you did during that time. That’s something that should be easily handle able by a single system. Everywhere I’ve worked there were at least 2 systems to solve this issue. The worst I saw, was a written paper form, that was signed by the customer, to be transferred into a digital system by the consultant. It’s all OK you would say but in that case there where 3 places to keep track of. Another example is filling out a form for one € 4,– USB Cable (even that’s something I was able to observe).

Conclusion

So why did I write this post. I always thought there must be a reason behind such behavior. Now that I’ve learned about the Simple Sabotage Field Manual i know better. I really wonder where and how the middle management get’s educated in that direction. Maybe there is a textbook out there, I don’t know about, that sheds a different light on behavior like that.

Feel free to discuss your thoughts or your stories you can recall that could come directly from the inside of the Simple Sabotage Field Manual.

The post A closer look at the Simple Sabotage Field Manual appeared first on Rene Windegger.

Looking for Solutions!

Over the years I was hosting multiple sites with different demands in traffic and size. During that process I came to the conclusion that the setup, of each of those sites, was a pain and maintenance more or less impossible. Since I came in contact with hosting the first time, I’ve moved from apache1 to apache2 to IIS to nginx as web daemon. The php execution engine has been updated since then multiple times.

Every time a component needed an upgrade you faced almost a new setup. The process of backup and restore was always tricky and using your own scripts to setup new vhosts where required. After some research I’ve discovered Automated Nginx Reverse Proxy for Docker by Jason Wilder and that led to some research and to the setup you can find in this post.

What else do we have to consider?

The preferred solution needs to be scale-able and distribute-able. Eventually a new player appeared on the software market that allows exactly to solve this.

Lets say hello to docker! Whale, whale!

What is docker?

Docker is an application container system and allows to prepare and configure applications for different environments. To cover docker is a complete different topic and will not be part of this post. But to get you started, just follow one of the guides at the docker site. When you want to scale and distribute have a look at docker swarm.

Get docker-compose ready!

docker-compose is required to start the different containers and setup networks in automated ways. So install docker-compose according to this guide and read on when you’re ready.

What are we going to do now?

Lets think about our infrastructure for a moment. To host our website in a scale able way we need to have multiple components up and running. For now, we settle with one nginx front end server to be easily able to create new vhosts. We employ one Varnish daemon in front of 2 nginx back end servers. Since nginx is only able to serve static content, we need to add a way to integrate PHP into our setup. To get us started we set up two fpm hosts. Since setting up a SQL cluster is out of scope for the moment, we use a single MariaDB host. Memcached1 is a memcached instance that can be utilized by the WordPress installation.

Now that we have our target architecture ready, we can think about how to handle the setup and how we’re still able to scale the instance out.

Let’s create a compose file!

To make it easy to run our site and start the whole environment with ease, we make use of docker-compose. Take a look at the source code of our docker-compose file. We have a closer look at the different things in a bit.

View the code on Gist.

As you can see, we create multiple nodes of different types. For more details on the different images look at my docker-hub profile. The nodes map their required volumes, for example the root volume for our site is mapped to „./.data/test.windegger.wtf/storage“. Depending on your docker setup you might need to adjust some volumes, drivers or networks.

The WordPress container!

The WordPress container is the heart of the installation, it is based on the official WordPress Dockerfile, but modified to use PHP 7. Since it’s using PHP 7 as base, it required some minor adjustments to the original file. For more information about the container take a look at the Hubpage.

After you start the composed environment using „docker-compose up“, you have your new and fresh WordPress installation up and running.

What comes next?

I continue to do research on different topics and cover my findings in my blog. I cover the different topics I’m faced with in my daily life. Prepare for some devops and other development updates.

You’re still reading, so you’ve not found what you came for. You need a trusted professional to handle your site in a managed manner? Don’t hesitate, use the contact form or leave a comment. You will receive a reply shortly.

The post WordPress running on PHP 7 made easy appeared first on Rene Windegger.

You’re here to find the answer.

The Scenario

You have a long running console application and want to create an UI for it. You don’t have the oppurtunity to integrate the console application as a library so you’re bound to run the executeable. You want to be able to spawn multiple processes at the same time and be able to limit the concurrent execution of the processes. You need to be able to set EnvironmentVariables for the process environment. You need to be able to respond to new lines on the StandardError and StandardInput. You might need to respond to the console application with input.

The Basics

The .Net Framework offers a handy class that allows most of the requirements the scenario holds. The class is called System.Diagnostics.Process. After I’m finished you will have a nice wrapper around the Process class that can be used in many different scenarios. How is the process class helping us? It’s pretty simple, the Process class is used to start a new process. You need to specify some information in the form of a ProcessStartInfo object and call the Start method on the Process.

Why do we need a wraper?

Since .Net Framework 4.5 we can use the TAP (Task-based Asynchronous Pattern) and that’s what I’m gonna faciliate to get a class that can be inherited for your own needs and allows you to run multiple instances of the application.

Getting Started

First we need the LimitedConcurrencyTaskScheduler I’ve provided in an earlier post. If you didn’t read that post yet go there now and atleast get the code set up in your project. While you do so leave a comment about your expirience.

Since we need a clean way to interact with the process we define an interface. This interface defines a set of properties that allow you to react to updates from the application. It also defines a set of methods that are used to generate the input for the application.

View the code on Gist.

Now that we have sepcified our Environment Builder Interface we are ready to implement our BaseProcess class.

The BaseProcess Class

The BaseProcess class specifies some static properties and a set of static methods. Since it is an abstract generic class those static properties and methods will be initialized per implementation. The static members are used for parallelization, we define our LimitedConcurrencyTaskScheduler used for scheduling our child processes and a LinkedList that will hold our processes. The static Start methods provide a way to enqueue a new process to the queue. The argument for that methods will be our environment builders. Our class defines two properties, the command line of the process to run and the environment that will be used during execution. The two fields are used to generate the console output, one for locking the StringBuilder and one to generate the output. The constructor of the class sets the command line so make sure to specify it in your implementation class. The protected Execute method does the actual work of spawning the new child process. The private methods are handlers for some of the events triggered by the System.Diagnostics.Process class. Those memebers will call the abstract members defined in the class.

View the code on Gist.

So Now that we have the Base Process class ready we can start to make use of it in one of our projects.

The post Capture command line output in C# appeared first on Rene Windegger.