Advice on the structure of the GCJ binary?
on
How C# Was Made
·
· Score: 1
Glock27, thanks for your reply. Of course I know that people generally think
of server code as safe. But all it takes is for one of thousands of Amazon
employees to provide a copy or a back door from one of maybe hundreds of
servers, and the security is compromised. We spend a lot of time thinking
about security, and it is easy to lose sight of the fact that "social
engineering" is simple in many cases. Remember that the code for doing
analysis of nuclear explosions from Los Alamos was available freely on the
Internet for years, even though Los Alamos was supposedly secure, and the
secrets were extremely valuable.
Also, there are many examples of cases where the code is available in byte
code format. Commercial products provide everything, of course.
You are right, I don't know enough about GCJ. This is the issue: How is the
binary formatted? Does GCJ bind the entire run-time library routines into the
binary as one contiguous code block? Or, does GCJ sort through the library and
build the library routines into the binary interspersed with the code? The
first case provides a binary that is easy to de-compile. The second is far
more secure, but still provides a machine method of de-compilation.
The problem is with the way that calls to the library are formatted in
languages originally meant to be interpreted. It is easy to look for the
structure of the calls, and once found, it is especially easy to see what the
calls are doing. Those who don't do disassembly or de-compilation may not
realize how easy it is.
In many programs, having the list of calls and their parameters would still
not be valuable, because it is difficult to understand how the programmer has
structured the program. However, most people don't realize that many of the
most valuable programs merely contain business rules. These are VERY complex
for a programmer to discover on his own, and very easy to copy.
Do you know enough about the structure of the GCJ binary to provide some
advice on this matter?
Obfuscation does nothing but keep casual viewers out. Sooner or later the code must be executed. A record of the execution can be decompiled, such as with an in-circuit emulator or software CPU emulator. In cases where there is a lot of business logic, such as in an e-commerce web site, it is extremely valuable to see how a successful competitor solved all the tricky, quirky problems of making e-commerce easy for visitors.
Anything with a runtime library like GCJ's is ...
on
How C# Was Made
·
· Score: 1
Quoting from the GCJ web site:
"Compiled applications are linked with the GCJ runtime, libgcj, which
provides the core class libraries, a garbage collector, and a bytecode
interpreter. libgcj can dynamically load and interpret class files, resulting
in mixed compiled/interpreted applications."
Anything with a runtime library like GCJ's is easily decompiled. That's
because the code largely consists of calls to the library.
Another thing: I understand that people who visit Slashdot sometimes have
less than the normal social sophistication. But it is possible to learn. The
first step in learning is to avoid attacking the other person when you
disagree.
I have expressed a reasonable opinion, I think. However, in this thread I've
been called a "dork conspiracy nut" and you said, "You obviously know nothing
about the subject", when you obviously didn't visit the GCJ web site and read
the second paragraph.
There is a VERY important issue here: The business logic of even something as
simple as an e-commerce web site is very, very complex. There nothing
difficult about it, but it is detailed and complex. The underlying issue is
that it is extremely easy to discover all the steps by de-compiling a business
application. There's no complex math. There's no complicated understanding
required. It is much easier to de-compile than to invent all the steps
yourself.
Microsoft's license agreement for its compilers specifically prevents its
customers from competing with Microsoft. How's that for an anti-trust
violation? Big companies are VERY aware of this issue. They cripple the
competition any way they can; that's their mentally disturbed idea of how to
live their lives. There's no conspiracy; that's just the way they do business.
I'm taking my time to give my opinion because giving it could make a
difference. We should all realize that C# is just another distraction from
working to get the language that we all really need. C# has nice features, but
someone should express some ideas that show that the success is very limited.
The designer of C# is just a cog in the adversarial business machine.
Server-side makes no difference...
on
How C# Was Made
·
· Score: 1
Server-side makes no difference for commercial products. The competitor merely buys a copy.
The compilers are not true compilers, as far as I know. They compile to byte code.
Yes, easily turned into assembly language...
on
How C# Was Made
·
· Score: 1
Yes, easily turned into assembly language, but it is much harder to decide what the assembly language is doing than with pseudo-compiled byte code that is a collection of obvious calls to the run-time library.
Why do big companies want pseudo-compiled langs?
on
How C# Was Made
·
· Score: 3, Insightful
It seems to me that big companies like Sun and Microsoft like pseudo-compiled languages like Java and those in.NET like C# for two reasons:
1) Pseudo-compiled languages are easily decompiled. If a small competitor writes an especially useful program, it is easy to see the logic by just decompiling the source code. In business programming, the business systems logic can be EXTREMELY complicated. It's easier to copy it from a competitor who has proven success. See these links for information about decompilation. Of course, the best methods of decompilation are not made public:
"I regularly use decompilers for Java classes. The last library I decompiled
is TupleSpace from IBM, a library for network communication (useful if doing
clustering). The result was of a shocking clarity.:) Thank you IBM.
"That was especially easy because the code had few local variables (in the
bytecode, local variables have an identifier that is a number) and no
obfuscation."
2) Pseudo-compiled languages are slower. That raises the cost of hardware. Sun makes most of its money from selling hardware. Slower software requires more expensive hardware. Microsoft makes most of its money selling operating systems. The customers most important to Microsoft are not you and I. Microsoft's important customers are the systems builders like Dell and HP. Systems builders want slow software so they can sell more hardware. Microsoft wants slow software so people buy more systems and therefore more operating systems licenses.
Another thing. Skype operates with a totally firewalled computer. When it finds that its ports are closed, it uses the browser port, port 80. This raises interesting questions of security. Anything can be transmitted over port 80.
It also raises interesting questions of writing an open source version of Skype that would hook to regular phone lines.
I've been using Skype to talk with a friend in France, from Oregon. The sound quality is excellent, much better than crackly old telephones. The link is computer to computer, and we both have high-speed internet connections.
Also, try OneSuite. 2.5 cents per minute to use a regular, scratchy traditional phone.
Both of these make me realize that the telephone companies are charging too much. When you talk, you are only transferring a few bits of digital information. Everyone's conversations are aggregated into a huge data stream that is very cheap to send by optical fiber.
The U.S. government has secret agencies. Their funding is secret, their
objectives are secret, and their methods are secret. The CIA, the NSA, the
FBI, and other agencies whose names are secret operate everywhere in the
world. They interfere with the politics of other countries. They sometimes
arrange to kill leaders or destroy property.
The secrecy began in the 1940s when oil companies asked the British and U.S.
governments to protect their interests. The countries in which they
operated began claiming the oil and oil facilities for themselves. On the one
hand, it is easy to see that the oil companies did not like their property
taken from them without sufficient payment. On the other hand, the oil
companies were paying very little for the oil, so the countries felt robbed.
The U.S. and British governments began trying to help the U.S. and British oil
companies by operating in secret. For example, the U.S. government's CIA
agency overthrew a democratically elected president in Iran. The U.S.
government supported a violent government instead, that of the Shah of Iran.
Years later, Iranians objected, and the Iranian government began terrorist
activities as a way of retaliating against continued secret U.S. government
operations in Iran.
The present terrorism against the U.S. people is the result of the U.S.
government's secret violence. About a year ago, I hastily put together a
short, incomplete history that shows what happened: History
surrounding the U.S. war with Iraq: Four short stories.
Those who work for the U.S. government's secret agencies have a huge conflict
of interest. If they cause trouble, or if they find some trouble and help make
it bigger, they are promoted. If they help assure that everyone lives together
in peace, they become less important, and some lose their jobs. So there is a
terrific pressure for them to cause trouble.
Democracy is founded on openness. If a government can do things without the
approval or even the knowledge of its people, it is not a democracy. Therefore the
secret side of the U.S. government has, in part, overthrown the real U.S.
government.
How corrupt is the U.S. government? Here's just one example: Mr. Dick Cheney,
who is now vice-president of the U.S., was once head of an oil company called
Halliburton. Mr. Cheney went into the U.S. defense department, and while
there, arranged that secretly awarding contracts would no longer be illegal.
Later it was arranged that Halliburton would secretly get a contract for work
in Iraq. Then the U.S. government invaded Iraq, with no reason, as we are now
seeing.
It's important to understand that oil companies do not want the oil. They want
the oil profits. The U.S. government's war in Iraq has allowed U.S. companies
to get Iraq oil profits. Before, the oil profits went to Iraqis. The amount of
oil coming from Iraq to the world has remained somewhat the same.
Anyone who reads this should understand that there may be inaccuracies due to the fact that secret government agencies are sometimes able to keep their operations secret, or are able to mislead the public about what they have done. The information here has been reported many times by many well-respected news agencies, and is believed completely accurate.
Linus Torvalds can go anywhere. It's probably no accident that he and the The Open Source Development Lab are in
Portland. (Beaverton is one of the towns that are part of the metropolitan
area of 1.4 million people called Portland.)
Portland has the largest
parkinside a city in the world. The park has over 74 miles of
wilderness hiking trails.
Portland is the home of Pink Martini, a
band that writes multi-cultural songs. One of Pink Martini's songs was once
one of the most popular songs in France. You can listen to the music video.
It's a 55 minute drive from downtown Portland to the
ski areas. "World Class
Skiing in Your Own Backyard."
The K-12 Linux Project, in
Portland, is one of the more successful projects for giving Linux to average
users, who in this case are students.
Portland borders on the confluence of the Willamette River and the Columbia River, one of the
largest rivers in the world. The Columbia River Gorge, on the eastern edge of
Portland, is a world class wind-surfing area.
On the other hand: Q. Why do hippies come to Portland? A. Because there are
no jobs.
Many people don't like the months of rain every year. They say Portland is the
perfect place for slugs and ducks. (However, the rain cleans the air.)
This is my guess: The articles referenced in the International Herald Tribune and the Financial Express are not real articles. They are advertisements by people who stand to gain financially if people read the articles and believe what they say. They are placed in the publications by public relations people. The publications may have been genuinely misled or someone there may have taken money to run them.
If you aren't Indian, India can be a miserable place to live. There are many cultural elements that a European would not want to imitate. And, you certainly would not want to be paid 1/5 or 1/10 what you are paid in Europe or the United States.
There may be a few inquiries from people who want to go to India as top-level managers paid Western salaries. Probably such openings are very, very few and would involve unpleasant compromises.
As far as I know, Microsoft has only made money in areas where the company has a temporary monopoly, or where being aggressive temporarily makes a profit.
Microsoft has a history of bad management, especially in thinking that the company can be aggressive toward customers, without paying any penalty.
If someone had a monopoly on water, he would make so much money that he would make Bill Gates look poor in just a few days. To unskilled observers, temporary monopolies make those associated with them look like skilled businesspeople.
When you are a billionaire, what is your biggest need? Is is to make more money? No, your biggest need is for connectedness with other people. By his aggressive behavior, Bill Gates has enforced disconnectedness, and he is in that sense a poor man.
"As a programmer, I've often wished that I've had some simple way of storing complex data without having to roll my own solution, or rely on PostgreSQL/MySQL."
I want that, too. Isn't this, from an earlier comment, the answer: SQLite?
The web site says that SQLite is implemented in less than 25K lines of C code, and is faster than MySQL and PostgreSQL for most operations.
I found the SQLite home address on the page you mentioned: SQLite -- An Embeddable SQL Database Engine. I downloaded it and tried the example. SQLite definitely looks like it is an answer. Thanks, that's definitely the kind of database I need. I didn't know about SQLite.
I believe FoxPro is written in C++. There is nothing about a database that would cause a problem with portability. Okay, so maybe there should be a small database that everyone uses, rather than one for every language.
I don't want to be an administrator of an enterprise-level database just because I want to store error messages in a database. I don't want to subject my users to that. There needs to be an intermediate level. There needs to be an easy interface.
This is a major hassle for me, also. Every computer language needs an associated simple database. There are many, many applications that require storing data in an ordered way that don't require a highly scalable enterprise-quality method like PostgreSQL. For example, it is convenient to store error messages in databases.
It's worth saying again. Every complete computer language should have a simple database and database administration tool as part of the definition of the language. Microsoft's FoxPro is an example of a small database. It can find any record in a million-record database instantaneously. But it is very proprietary.
Slashdot Mirror
Glock27, thanks for your reply. Of course I know that people generally think of server code as safe. But all it takes is for one of thousands of Amazon employees to provide a copy or a back door from one of maybe hundreds of servers, and the security is compromised. We spend a lot of time thinking about security, and it is easy to lose sight of the fact that "social engineering" is simple in many cases. Remember that the code for doing analysis of nuclear explosions from Los Alamos was available freely on the Internet for years, even though Los Alamos was supposedly secure, and the secrets were extremely valuable.
Also, there are many examples of cases where the code is available in byte code format. Commercial products provide everything, of course.
You are right, I don't know enough about GCJ. This is the issue: How is the binary formatted? Does GCJ bind the entire run-time library routines into the binary as one contiguous code block? Or, does GCJ sort through the library and build the library routines into the binary interspersed with the code? The first case provides a binary that is easy to de-compile. The second is far more secure, but still provides a machine method of de-compilation.
The problem is with the way that calls to the library are formatted in languages originally meant to be interpreted. It is easy to look for the structure of the calls, and once found, it is especially easy to see what the calls are doing. Those who don't do disassembly or de-compilation may not realize how easy it is.
In many programs, having the list of calls and their parameters would still not be valuable, because it is difficult to understand how the programmer has structured the program. However, most people don't realize that many of the most valuable programs merely contain business rules. These are VERY complex for a programmer to discover on his own, and very easy to copy.
Do you know enough about the structure of the GCJ binary to provide some advice on this matter?
Obfuscation does nothing but keep casual viewers out. Sooner or later the code must be executed. A record of the execution can be decompiled, such as with an in-circuit emulator or software CPU emulator. In cases where there is a lot of business logic, such as in an e-commerce web site, it is extremely valuable to see how a successful competitor solved all the tricky, quirky problems of making e-commerce easy for visitors.
Quoting from the GCJ web site: "Compiled applications are linked with the GCJ runtime, libgcj, which provides the core class libraries, a garbage collector, and a bytecode interpreter. libgcj can dynamically load and interpret class files, resulting in mixed compiled/interpreted applications."
Anything with a runtime library like GCJ's is easily decompiled. That's because the code largely consists of calls to the library.
Another thing: I understand that people who visit Slashdot sometimes have less than the normal social sophistication. But it is possible to learn. The first step in learning is to avoid attacking the other person when you disagree.
I have expressed a reasonable opinion, I think. However, in this thread I've been called a "dork conspiracy nut" and you said, "You obviously know nothing about the subject", when you obviously didn't visit the GCJ web site and read the second paragraph.
There is a VERY important issue here: The business logic of even something as simple as an e-commerce web site is very, very complex. There nothing difficult about it, but it is detailed and complex. The underlying issue is that it is extremely easy to discover all the steps by de-compiling a business application. There's no complex math. There's no complicated understanding required. It is much easier to de-compile than to invent all the steps yourself.
Microsoft's license agreement for its compilers specifically prevents its customers from competing with Microsoft. How's that for an anti-trust violation? Big companies are VERY aware of this issue. They cripple the competition any way they can; that's their mentally disturbed idea of how to live their lives. There's no conspiracy; that's just the way they do business.
I'm taking my time to give my opinion because giving it could make a difference. We should all realize that C# is just another distraction from working to get the language that we all really need. C# has nice features, but someone should express some ideas that show that the success is very limited. The designer of C# is just a cog in the adversarial business machine.
Server-side makes no difference for commercial products. The competitor merely buys a copy.
The compilers are not true compilers, as far as I know. They compile to byte code.
Yes, easily turned into assembly language, but it is much harder to decide what the assembly language is doing than with pseudo-compiled byte code that is a collection of obvious calls to the run-time library.
It seems to me that big companies like Sun and Microsoft like pseudo-compiled languages like Java and those in
1) Pseudo-compiled languages are easily decompiled. If a small competitor writes an especially useful program, it is easy to see the logic by just decompiling the source code. In business programming, the business systems logic can be EXTREMELY complicated. It's easier to copy it from a competitor who has proven success. See these links for information about decompilation. Of course, the best methods of decompilation are not made public:
Java Decompilers
A friend wrote this:
"I regularly use decompilers for Java classes. The last library I decompiled is TupleSpace from IBM, a library for network communication (useful if doing clustering). The result was of a shocking clarity.
"That was especially easy because the code had few local variables (in the bytecode, local variables have an identifier that is a number) and no obfuscation."
2) Pseudo-compiled languages are slower. That raises the cost of hardware. Sun makes most of its money from selling hardware. Slower software requires more expensive hardware. Microsoft makes most of its money selling operating systems. The customers most important to Microsoft are not you and I. Microsoft's important customers are the systems builders like Dell and HP. Systems builders want slow software so they can sell more hardware. Microsoft wants slow software so people buy more systems and therefore more operating systems licenses.
Or, try booting from a Mandrake install CD.
For those new to Windows, here's a complete fix for the vulnerabilities and sneakiness of RealPlayer:
Start / Settings / Control Panel / Add or Remove Programs / RealOne / Remove
I thought Asterisk required special hardware, but I guess not: "Asterisk needs no additional hardware for Voice over IP."
Anyone have any experience with Asterisk without special hardware? Can I connect to an Internet address directly?
Is the sound quality as good as Skype?
VoicePulse
There is already too much fiber. More than 50% is not being used.
Another thing. Skype operates with a totally firewalled computer. When it finds that its ports are closed, it uses the browser port, port 80. This raises interesting questions of security. Anything can be transmitted over port 80.
It also raises interesting questions of writing an open source version of Skype that would hook to regular phone lines.
Link: Skype
I've been using Skype to talk with a friend in France, from Oregon. The sound quality is excellent, much better than crackly old telephones. The link is computer to computer, and we both have high-speed internet connections.
Also, try OneSuite. 2.5 cents per minute to use a regular, scratchy traditional phone.
Both of these make me realize that the telephone companies are charging too much. When you talk, you are only transferring a few bits of digital information. Everyone's conversations are aggregated into a huge data stream that is very cheap to send by optical fiber.
Skype has better sound quality than a regular telephone, and it is free, for now.
The U.S. government has secret agencies. Their funding is secret, their objectives are secret, and their methods are secret. The CIA, the NSA, the FBI, and other agencies whose names are secret operate everywhere in the world. They interfere with the politics of other countries. They sometimes arrange to kill leaders or destroy property.
The secrecy began in the 1940s when oil companies asked the British and U.S. governments to protect their interests. The countries in which they operated began claiming the oil and oil facilities for themselves. On the one hand, it is easy to see that the oil companies did not like their property taken from them without sufficient payment. On the other hand, the oil companies were paying very little for the oil, so the countries felt robbed.
The U.S. and British governments began trying to help the U.S. and British oil companies by operating in secret. For example, the U.S. government's CIA agency overthrew a democratically elected president in Iran. The U.S. government supported a violent government instead, that of the Shah of Iran. Years later, Iranians objected, and the Iranian government began terrorist activities as a way of retaliating against continued secret U.S. government operations in Iran.
The present terrorism against the U.S. people is the result of the U.S. government's secret violence. About a year ago, I hastily put together a short, incomplete history that shows what happened: History surrounding the U.S. war with Iraq: Four short stories.
Those who work for the U.S. government's secret agencies have a huge conflict of interest. If they cause trouble, or if they find some trouble and help make it bigger, they are promoted. If they help assure that everyone lives together in peace, they become less important, and some lose their jobs. So there is a terrific pressure for them to cause trouble.
Democracy is founded on openness. If a government can do things without the approval or even the knowledge of its people, it is not a democracy. Therefore the secret side of the U.S. government has, in part, overthrown the real U.S. government.
How corrupt is the U.S. government? Here's just one example: Mr. Dick Cheney, who is now vice-president of the U.S., was once head of an oil company called Halliburton. Mr. Cheney went into the U.S. defense department, and while there, arranged that secretly awarding contracts would no longer be illegal. Later it was arranged that Halliburton would secretly get a contract for work in Iraq. Then the U.S. government invaded Iraq, with no reason, as we are now seeing.
It's important to understand that oil companies do not want the oil. They want the oil profits. The U.S. government's war in Iraq has allowed U.S. companies to get Iraq oil profits. Before, the oil profits went to Iraqis. The amount of oil coming from Iraq to the world has remained somewhat the same.
Anyone who reads this should understand that there may be inaccuracies due to the fact that secret government agencies are sometimes able to keep their operations secret, or are able to mislead the public about what they have done. The information here has been reported many times by many well-respected news agencies, and is believed completely accurate.
Linus Torvalds can go anywhere. It's probably no accident that he and the The Open Source Development Lab are in Portland. (Beaverton is one of the towns that are part of the metropolitan area of 1.4 million people called Portland.)
Portland has the largest bookstore in the world.
Portland has one of the largest and most successful dealers in contemporary art in the world. The gallery has a funny name, but shows the work of over 1,100 artists.
Portland has the largest park inside a city in the world. The park has over 74 miles of wilderness hiking trails.
Portland is the home of Pink Martini, a band that writes multi-cultural songs. One of Pink Martini's songs was once one of the most popular songs in France. You can listen to the music video.
It's a 55 minute drive from downtown Portland to the ski areas. "World Class Skiing in Your Own Backyard."
The K-12 Linux Project, in Portland, is one of the more successful projects for giving Linux to average users, who in this case are students.
Portland borders on the confluence of the Willamette River and the Columbia River, one of the largest rivers in the world. The Columbia River Gorge, on the eastern edge of Portland, is a world class wind-surfing area.
On the other hand: Q. Why do hippies come to Portland? A. Because there are no jobs.
Many people don't like the months of rain every year. They say Portland is the perfect place for slugs and ducks. (However, the rain cleans the air.)
Portland is also the home of 6 semiconductor fabrication plants that Intel uses to test development processors.
Slugs? Ducks?
This is my guess: The articles referenced in the International Herald Tribune and the Financial Express are not real articles. They are advertisements by people who stand to gain financially if people read the articles and believe what they say. They are placed in the publications by public relations people. The publications may have been genuinely misled or someone there may have taken money to run them.
If you aren't Indian, India can be a miserable place to live. There are many cultural elements that a European would not want to imitate. And, you certainly would not want to be paid 1/5 or 1/10 what you are paid in Europe or the United States.
There may be a few inquiries from people who want to go to India as top-level managers paid Western salaries. Probably such openings are very, very few and would involve unpleasant compromises.
I know someone who works programming Quicktime directly. Yes, it is very buggy, an Apple refuses to fix the bugs, or allow someone else to do so.
As far as I know, Microsoft has only made money in areas where the company has a temporary monopoly, or where being aggressive temporarily makes a profit.
Microsoft has a history of bad management, especially in thinking that the company can be aggressive toward customers, without paying any penalty.
If someone had a monopoly on water, he would make so much money that he would make Bill Gates look poor in just a few days. To unskilled observers, temporary monopolies make those associated with them look like skilled businesspeople.
When you are a billionaire, what is your biggest need? Is is to make more money? No, your biggest need is for connectedness with other people. By his aggressive behavior, Bill Gates has enforced disconnectedness, and he is in that sense a poor man.
"As a programmer, I've often wished that I've had some simple way of storing complex data without having to roll my own solution, or rely on PostgreSQL/MySQL."
I want that, too. Isn't this, from an earlier comment, the answer: SQLite?
The web site says that SQLite is implemented in less than 25K lines of C code, and is faster than MySQL and PostgreSQL for most operations.
I found the SQLite home address on the page you mentioned: SQLite -- An Embeddable SQL Database Engine. I downloaded it and tried the example. SQLite definitely looks like it is an answer. Thanks, that's definitely the kind of database I need. I didn't know about SQLite.
SQL 92 Features That SQLite Does Not Implement. Not many.
Very fancy, and supports every language and its sister:
Is this the answer? Are there any drawbacks? Anyone have experience with SQLite?
I believe FoxPro is written in C++. There is nothing about a database that would cause a problem with portability. Okay, so maybe there should be a small database that everyone uses, rather than one for every language.
I don't want to be an administrator of an enterprise-level database just because I want to store error messages in a database. I don't want to subject my users to that. There needs to be an intermediate level. There needs to be an easy interface.
This is a major hassle for me, also. Every computer language needs an associated simple database. There are many, many applications that require storing data in an ordered way that don't require a highly scalable enterprise-quality method like PostgreSQL. For example, it is convenient to store error messages in databases.
It's worth saying again. Every complete computer language should have a simple database and database administration tool as part of the definition of the language. Microsoft's FoxPro is an example of a small database. It can find any record in a million-record database instantaneously. But it is very proprietary.