Jobfox.com is a scam

For people looking for work, beware of Jobfox.com. I got hit by their scam when I was looking for work last week. Based on the various reviews about this company out there about this company, I can safely say that they are a scam.

The scam works like this: Jobfox.com has a number of job postings on their web site; once you sign up with them, they quickly send you an email that they have looked at your resume. They then tell you that your resume sucks, and that you should pay them $400 to improve your resume to have a chance in the job market.

They give this form letter to everyone who signs up for one of their postings on their site, giving out a letter like this: “Your resume does not pass the 30-second test, and the content is not up to the standards one would expect from a candidate like you. Countless studies have proven that resume quality is the key determinant as to whether a candidate is selected to be interviewed. Your resume needs a boost from a visual, content, and overall writing standpoint to engage the reader. It needs to make them want to learn more about you. I didn’t find it to be exciting, and it didn’t make me want to run to the phone to call you. In short, your resume is effectively sabotaging your job search.”

It does not matter how well-written one’s resume is. It does not matter if one has the best resume that was ever made. After Jobfox.com has their spambot scan your resume, they give you the above scathing criticism. Indeed, according to one anonymous poster, resumes written by Jobfox.com’s own resume writers get the above very negative review.

Googling the exact above phrase gives multiple results. Why am I not surprised?

Deadwood on OpenWRT; The case for 32-bit Skein

When I was designing Deadwood, I made sure to make the program work really nicely on 32-bit processors, while retaining compatibility on 64-bit processors. In the places where word size really matters, namely the hash compression function and the cryptographic random number generator, I went out of my way to use 32-bit algorithms (my own home-grown algorithm for the 32-bit hash compression function; RadioGatun[32] for the random number generator).

During Deadwood’s development cycle, I even gave a nod to systems that can work with both 16-bit and 32-bit numbers, by having it so “int” in the source code means “something that can fit in 16 bits”, and using int32_t for anything that would need more than 16 bits (near the end of the Deadwood development cycle, I went from “int32_t” to “int_fast32_t” for “integer that needs more than 16 bits”). This is untested—I don’t think there are any systems in use today capable of routing packets that have 16-bit wide registers—but allows it to be at least possible to port Deadwood to a 16-bit system.

The reason for all this attention to detail was because my target platform while developing Deadwood was to have it run nicely on the 32-bit router in the corner used to connect people to the internet. And, I have succeeded.

Sebastian Müller has already gotten Deadwood to recursively process queries on an embedded router and is working on porting Deadwood to a number of platforms. He was able to pull this off in a single afternoon because Deadwood is, from beginning to end, an architecture-independent recursive DNS server optimized for 32-bit platforms.

Of course, Deadwood also runs nicely on 64-bit platforms; one of my regressions I perform when building Deadwood is to make sure nothing breaks in 64-bit. The only issue is that some operations (the hash compression, the cryptographic random number generator) are less efficient because they were written to run on 32-bit systems. [1]

Now, while Deadwood does run nicely on various 32-bit embedded systems, I unfortunately can not readily support these configurations because I run Deadwood on x86_32 and can not solve problems for people running it on different systems. It works, but people want to do this are on their own and need to take responsibility for any problems they see.

---

This leads us to Skein, a proposed hash primitive for SHA-3. Skein is a very good hash with a lot of features, including having, in its core, Threefish, the only tweakable block cipher primitive that appears secure.

However, I can’t use Skein because there’s no native 32-bit version of it, even though such a thing is possible. When I pointed out this problem on Schneier’s blog, I was dismissed by another poster with “all 32-bit desktop processors (and even some ARM chips) have instructions that can do math on pairs of 64-bit numbers”.

That’s all well and good, but Deadwood isn’t just for the desktop. It’s also for the embedded 32-bit space and that means no MMX/SSE instructions that work on 64-bit numbers.

One of the reasons why I feel so frustrated is because I can’t just make a 32-bit Skein variant. Not without possibly making 10 different errors that could destroy its security.

I understand why Schneier, et. al. don’t feel comfortable coming out with some rotation constants to make a 32-bit Skein variant; if they did make such a Skein variant and some cryptographers found weaknesses in them, it would make them look bad. So, they are being very conservative about what they will declare to be the official “magic numbers” for Skein. Numbers I simply do not feel comfortable changing.

If I were to use one of the SHA-3 submissions for Deadwood’s PRNG, I would use Keccak. Like Skein, it can output a stream of infinite length from any input of any length. Unlike Skein, it is more 32-bit compatible; not only is there a 32-bit “reduced word length” variant officially blessed by the algorithm’s creators, but also 64-bit Keccak more easily scales down to 32-bits than Skein, since the only operations done are permutes, rotates, and exclusive ORs.

32-bits is still very much a reality today. While the transition to 64-bit desktops is well underway, it will be a few years before 64-bit desktops become more common than 32-bit desktops. The embedded space is very slowly letting go of 8-bit systems, replacing them with 32-bit systems. I wouldn’t be surprised if 32-bit is still around in 2038, when we will have to worry about systems with 32-bit time_t overflowing (Deadwood will run until 2143 on systems with a 32-bit time_t, uses 64-bit timestamps internally, and won’t overflow in 2143 if compiled on a system with a 64-bit time_t).

Yes, we are making the transition to 64-bit. But we can’t make the transition with solutions like Skein that pretend 32-bit no longer exists.

---

[1] In terms of making a full 64-bit port of Deadwood, I would have to:

• Make most, but not all, of the int32_t declarations int_fast32_t declarations (64-bit compilers should make int_fast32_t 64 bits wide)
• Use RadioGatun[64] instead of RadioGatun[32] (because of how I wrote the RadioGatun code, this is a fairly quick change)
• Replace the hash compression core with one using 64-bit instead of 32-bit operations. The most difficult part of this is making a 63-bit random prime number; we can quickly brute-force test the primality of a 31-bit number, but not for a 63-bit number.

No, I don’t have plans to do this before MaraDNS 2.0 is released.

An eulogy for DNScurve

OpenDNS is probably the strongest DNScurve proponent out there. So, when they start making moves to look for a DNSSEC engineer (as an aside, the position is no longer open; they finally convinced one of their own engineers to implement DNSSEC, probably while holding their nose), you know that DNSSEC has won.

DNScurve, with all due respect, never had a chance. It didn’t have a chance when I last talked about it a year ago. It’s downright moribund today.

Sure, on a technical level it has some really cool technology—in particular, I really like the (2^(255)) - 19 curve it uses for cryptography; a “stock” DNS packet can only fit 512 bytes of information (we can make the packet about 1280 bytes in size if we use EDNS), so a public key cryptographic primitive that offers strong security without needing to push around 3072-bit RSA signatures (the approximate size needed with RSA to get the same level of security as DJB’s “25519” curve) is very appealing.

But, unfortunately, standards are not judged solely on their technical merits. They are also judged on how well the people who work on the standards get along and are willing to make compromises.

DJB, as far as I can tell, was never willing to work with other people on DNScurve. He wanted it to be an end-to-end DJB-exclusive invention: His own “25519” curve for public key cryptography, his own Salsa20 stream cipher for encryption (a nice enough cipher, but it uses 32-bit words everywhere and doesn’t have a mode using 64-bit words), and his own “Poly1305”.

To top it off, DJB didn’t even implement a reference implementation of DNScurve. He wasn’t even willing to walk far enough outside of his ivory tower to make an implementation, make said implementation public, and allow people to see how it ran in the real world.

And, indeed, no one else implemented DNScurve either. The most notable implementation of DNScurve was GbDNS, but that was replaced by something called “QRP” a year ago. OpenDNS was the only other place that implemented DNScurve, but they’re now looking to implement DNSSEC.

DNScurve also suffered from being a solution looking for a problem. The only real issue DNScurve solved was the problem of being able to sniff DNS traffic and spoofing replies based on the traffic seen. It didn’t solve the problem of an upstream DNS server sending spoofed traffic. Quite bluntly, this is a problem OpenDNS’ current business model doesn’t want to see solved (they make their money from NX redirects and from having google.com point to their own web page), so it’s no surprise they advocated DNScurve for as long as they did.

DNSSEC, on the other hand, is already seeing wide adoption. BIND has always supported it, of course, and Unbound supports it. GbDNS also now has gone from supporting DNScurve to support DNSSEC. PowerDNS is getting DNSSEC support.

If things in my life ever change and I got a six-month paid sabbatical, I would also implement DNSSEC and make it part of Deadwood; I regret the fact I don’t have time to make a compact pure-C implementation of DNSSEC.

If you want to make a standard real, work with standards committees. I know DJB can do this; his excellent Salsa20 cipher is part of the eSTREAM portfolio (but, again, I’d like to see a 64-bit Salsa20, or, even better, a 64-bit version of Cha-Cha I would call Merengue, or even Merequetengue). It’s a shame he didn’t do the same with DNScurve. Hopefully, the 25519 curve can become a public key algorithm used in future revisions to the DNSSEC standard.

- Sam

New Deadwood snapshot: Non-A records now resolve

I guess not that many people are testing Deadwood.

Let me be honest about the type of testing I’m doing with Deadwood: I am testing Deadwood’s as a DNS server used for casual web surfing on today’s internet. That means that most of the queries done are A queries; I don’t do much testing with AAAA (IPv6) queries because, quite bluntly, my ISP doesn’t offer IPv6 service and I can think of only one site on the Internet with an AAAA record: ipv6.google.com.

Likewise, I haven’t done any testing with MX records. I haven’t touched MX records at all because I’m not using Deadwood with a mail hub. So, it came as an unpleasant shock to me when I discovered last night that Deadwood hasn’t been properly resolving MX records for over a year.

In Deadwood 2.4.05 (released August 9, 2009), I added the ability to rotate resource records. Unknown to me, this feature broke Deadwood with any variable-length record, such as a MX record pair where the hostnames are of different lengths.

The advantage of using Deadwood’s robust string library with almost all of Deadwood’s DNS processing is that this bug did not result in any memory corruption or cause any other problems; the only issue has been that Deadwood would not resolve MX or other variable length records.

The idea that some freetards advocate that open source software is magically tested and that all bugs become shallow is nothing more than so much—how should I say this—mental masturbation. The author of Mailman, John Viega, points out how wrong this is in his excellent essay “The Myth of Open Source Security”.

Excuse me for the blunt wording, but I am a little frustrated right now: I have devoted a decade of my life to MaraDNS, and I haven’t even been able to get a job because of my hard work; while I have had a couple of interviews I would not have had because of MaraDNS, so far I have gotten no offers. Yes, those are interviews I would not had have if it weren’t for MaraDNS, and, yes, MaraDNS kept my skills from getting completely rusty during the ’00s when I was concentrating on learning Spanish and living in Mexico. But, looking back, I really wish I had spent more time learning C++ and object oriented programming and less time editing the Wikipedia or posting to /..

It looks like Deadwood isn’t getting much external testing; not one person saw Deadwood’s issue with MX records in the year Deadwood has had this bug. So, yeah, like everything else with MaraDNS, I’m responsible for just about all of the testing. This isn’t a complete loss; people have asked me in interviews about my testing methodology for MaraDNS.

I have just uploaded a snapshot which fixes the issue with rotating records like MX records:

http://maradns.org/deadwood/snap/

As a side benefit, since I have fixed this issue, TTL aging and RR rotation now work with ANY records.

Next: Set up a test for this issue, as well as DNS compression tests for all of the resource record types MaraDNS supports. If I get time, I will also set up tests to make sure Deadwood correctly handles things like SRV records with compression pointers, and that Deadwood doesn’t compress SRV records.

New Deadwood snapshot: neustar.biz fixed

While doing my own “dogfood” testing for Deadwood, I discovered that the host name “neustar.biz” did not resolve. The issue was that I never bothered to make DNS queries case-insensitive.

The solution is to convert all DNS queries in to their lower-case form before looking them up in the cache or sending another query out to resolve a glueless NS/incomplete CNAME (in the case of “neustar.biz”, the issue was that the CNAMEs were in upper case). In addition, since there may very well be some stub resolvers out there that won’t accept an answer unless it’s in the same case as the question, I now have Deadwood preserve the case in the original form of the query to give back to the stub resolver, using a variable called “orig_query”.

It can be downloaded here:

http://maradns.org/deadwood/snap/

The patch can also be looked at.

I can see the program is getting some attention by the number of clueless emails I am getting asking for private Deadwood support. It would be nice if these people would pay me once I give them the usual form reply asking for money. That has not happened; people who do not have enough courtesy to heed multiple disclosures that email is only for paying customers are not courteous enough to decide to pay for support. It’s a form of the internet dork rule: The anonymity of the internet coupled with the ease of getting on a soapbox attracts all kinds of unpleasant people; the corollary to this rule is that any unmoderated forum is soon overrun by unpleasant people, since anyone who doesn’t want to waste time getting in to a flame war is soon chased away by the trolls and flamers.

Hopefully this attention will soon translate in to a job with a living wage. Things are tough in this economy, and looking for work is sometimes very frustrating. The only serious interest I have gotten is from people who know about MaraDNS or from connections. Simply putting my resume out there on Monster or Dice so far hasn’t resulted in anything.

Deadwood 2.5.03 released: Memory leak plugged

While working on Deadwood 2.6.03, I found a memory leak that affects the 2.5 “stable” branch of Deadwood (but not the 2.3 branch); I have backported the plug for this memory leak to the 2.5 branch of Deadwood and have just released Deadwood 2.5.03:

http://maradns.org/deadwood/stable/

As an aside, the 2.5 stable branch of Deadwood is going to no longer be maintained when Deadwood 2.9.01 is released, hopefully in a week or two. I only made the Deadwood 2.4 and 2.5 stable branches because the fully recursive Deadwood code was taking longer than I expected, and I wanted a version of Deadwood taking advantage of all of the infrastructure I was building up for use until I had a fully recursive Deadwood out the door.

Now that I am very close to having Deadwood be fully recursive, there soon will no longer be a need to use Deadwood 2.4/2.5. I will maintain Deadwood 2.3 for the foreseeable future, since it nicely fills the niche of an open-source tiny (32k) little non-recursive caching (or non-caching if you prefer) DNS server.

That in mind, this release of Deadwood does not include a TCC version for easy compiling on Windows; people who want to compile Deadwood in Windows without installing MinGW (or Cygwin, for that matter) should compile Deadwood 2.6.03.

---

Google search fail: Around 2007, Stephen G. Hartke made some freely available fonts and put them up on a Geocities page. These fonts were then rounded up by the various “download this font” websites out there (Font Squirrel, etc.). Because of how Google indexes pages, the sites that mirrored the font appear first in the Google’s search results.

This would not be a problem, except for the fact that the GeoCities page has since been taken down. It took me 30 minutes of searching to find the official page for Stephen G. Hartke’s fonts (most notably Aurulent Sans).

My general experience is that Google has not handled the expansion of the internet in the first 2000s decade very well. It used to be that search results would quickly put you on interesting pages made by enthusiasts with truly useful content. These days, searches for things like obscure video games or what not will pop up a list of pages for the topic in question on the same small list of websites which happen to have a high Google ranking, regardless of whether the page in question has any interesting content. It often times takes a lot of digging around to find actually useful information.

Why C programming experience is relevant

One thing I have noticed in American culture and the US
job market is that you really can't get experience without a job, and you can’t get a job without experience. It’s even worse in the technology sector: There are a lot of, quite bluntly, clueless HR and headhunters out there who don’t understand that someone who has programmed in C for over 20 years but has programmed in PHP for three months is probably a better programmer than someone who has programmed in PHP for a year, but has no other programming experience. Or heaven forbid, if a job candidate tells someone “OK, I’ve never programmed in Ruby, but I have programmed in C for 20 years, Perl for over 10 years, PHP for a couple of years, as well as a number of other programming languages. I’m sure I can pick Ruby in a day or two”; to a clueless HR person, the person can’t do the job if it has “Ruby” in the job title.

The fact of the matter is this: C is hard (free the mallocs, close the open sockets, no native string handling, etc.). DNS is hard. Recursive DNS is really hard. Thread-free recursive DNS is even harder. Thread-free recursive DNS in pure C is a downright pain in the butt. I have done some of the work that is in vogue right now: PHP and other scripting, as well as some GUI development. All of that is a cakewalk compared to the work I am doing in MaraDNS right now.

Asking someone who has written a fully recursive DNS server in C (and, for added benefit, is almost done rewriting said fully recursive DNS server to not use threads) whether they can write a PHP script or a GUI application is like asking someone who can drive a large truck with a manual transmission if they can drive a compact family car with an automatic transmission.

That said, one reason why some companies don’t like programmers with a lot of old-school experience is that they want younger people (it lowers health insurance premiums), or they feel that they can’t teach an old dog new tricks. In my case, I program in C (not C++, not Java, not Objective C, but plain old C) not because I like the language (I don’t; PHP and Python as well as Java are far easier to program in) but because there is a tradition in the open-source world of writing programs in plain C: It proves that the developer can do the truly hard programming.

I am an old dog, yes, but I can learn new tricks: I very quickly picked up PHP when I needed to use it, do use Python in MaraDNS (the BIND zone file converter is written in Python, and MaraDNS’ as well as Deadwood’s configuration files use Python-compatible syntax), and have been using Perl for over a decade. Programming languages have been getting easier to program in (I’m glad I don’t have to program in 6502 assembly any more), not harder, and a good programmer is a good programmer. Regardless of the language he is programming in.

Placing text ads on samiam.org or maradns.org

Every now and then, I get someone who sends me an email wanting to participate in a "link exchange program" or to pay me a little to place a text ad on one of my websites.

For example, about a year ago, during the worst of the recession, I had someone offer to pay me a little money to place a text ad up on maradns.org and samiam.org. The person insisted that the ad be permanent. I told him I wasn’t going to do that; he got agitated and I finally handled it by ignoring the person. Nothing is forever.

I finally have come up with a policy and pricing structure for these people (the price is, yes, a little high, but that is a case of giving invoice therapy):

The fee for a simple text-based ad on samiam.org is $50 per month. The fee for a simple text-based ad at maradns.org is $100 per month. This fee is paid by sending money to my PayPal account; the text ad will be placed after 100% of the first month's fee is paid. This fee is to be paid in full one week before the first day of the month when the text ad appears. The fee is not prorated; if you wish a text-based ad to be placed immediately, you must pay for the entire month.

Please allow up to seven calendar days for a given text ad request to be processed.

Multiple months can be paid for, but fractional months are not allowed (I would just pocket the extra money). There is a 10% discount if you pay for an entire year's worth of text-based ads.

Anyone willing to pay this fee will be listed as a sponsor on the MaraDNS list of sponsors for the foreseeable future; this listing will include the content of your text-based ad.

Simple text-based ads will be placed at the top of the content area of the "portal" page before my main content, and separated from my content with a <hr> HTML tag. Text based ads can include links, but the only other markup allowed is italics.

All text-based ads must be approved by me before being placed on my site; any changes to text-based ads are subject to prior approval. Text ads for pornography or advocating any illegal activity (as per US law) will not be accepted. Fees paid for rejected text ads are non-refundable.

Why I don’t do free private email support

Every now and then, I get someone who gets really angry at me when I give them the “pay up or take it to the mailing list” form reply from me after sending me a request for unpaid private MaraDNS support. This is not very good for the user in question; since the form reply makes it clear I can make replies to my form letter public, they end up publicly embarrassed when I forward their rude email to the MaraDNS list.

The reason why I don’t do unpaid support is because MaraDNS is an open-source project. Open source fundamentally changes the customer-supplier relationship; the thinking behind open source is that I supply something that benefits the community as a whole. The community, in return, benefits MaraDNS.

If I answer a private MaraDNS support email for free, I am not doing anything to benefit the MaraDNS community. I am only benefiting one particular user of MaraDNS.

MaraDNS users with support concerns should help MaraDNS by either paying me (which encourages me to work harder on MaraDNS), or by making their support concern public; this way any reply to their email is public and the next person with the same concern can quickly find the answer to their question in the MaraDNS mailing list archives.

There is no such thing as a perfectly secure program

Back in 2007, I posted this criticism of DjbDNS on their mailing list. As you can imagine, the people on the mailing list were not happy.

What has changed with DjbDNS since I wrote this criticism:

• DjbDNS has finally been made open-source
• Three security holes have been discovered in DjbDNS
• The DjbDNS tarball on the official download page is still the outdated 1.05 version of DjbDNS

I can not help but observe that, ever since those three security holes have been discovered in DjbDNS, DJB advocates have been a lot more quiet about how ultra-secure DjbDNS is.

In comparison, MaraDNS has had 12 security problems in its near-decade of existence. OK, so I have four security problems for every security problem DjbDNS has. Then again, of those 12 holes:

• Four were only in unstable development releases of MaraDNS
• One was caused by broken behavior in the Linux kernel and not by MaraDNS
• Two were patches against theoretical problems in AES that do not have any real-world exploits
• The remaining five problems only allowed an attacker to perform a denial of service against MaraDNS; the one I patched yesterday only works in the unusual case of an attacker being able to give MaraDNS a csv2 zone file

To make this an apples-to-apples comparison, there have only been five practically exploitable security problems in stable releases of MaraDNS caused by my own coding errors. None of them have been worse than denial of service.

I should also point out the hole I patched yesterday only exists because I decided it was good to have a more attractive zone file format for MaraDNS.

The idea that there exists an uber-genius programmer who can magically make code without any security problems that never needs to be updated was a myth DJB advocates liked to present in the first decade of the 2000s. This is nothing more than a myth, shattered by the three security holes people have discovered in DJBdns (not to mention the backscatter spam problem in Qmail, which is a security problem).

Security is a process. Programmers, no matter how experienced or skilled, make errors. To criticize a programmer for making a mistake is unreasonable and unrealistic. The best we can do is make a program with a coding style that minimizes security problems; considering that MaraDNS has had only four (maybe five) practically exploitable security problems in stable releases is a very good record.

If you want security, you want to use a program that the programmer stands behind and continues to support. Which is what I have been doing with MaraDNS for nearly a decade and which I have no plans to stop doing.

Why I don’t buy stuff from Apple

As someone who has been involved in the computer industry for 15 years, I will let you guys in on a little secret: I have never bought hardware from Apple. Seriously.

The thing is this: I don’t like how Steve Jobs tightly controls the hardware. For example, with an iPhone...what if I want to install an application that isn’t part of Steve Jobs’ walled garden (The iPhone application store?). Well, I can’t unless I break in to (“jailbreak”) my own iPhone.

I’m sorry, but I shouldn’t have to do something that voids the warranty of my product and risks bricking it just to download and run an application on it.

My Nokia 5310 has one thing going for it: I can download and put any J2ME (Java for mobiles) game or application on it and it runs like a charm. I have a nice Spanish-English dictionary, for example, and didn’t have to pay a dime for it. Ditto with the open-source games I have on my phone.

As for the iPad, my question is this: What does an iPad have that a netbook doesn’t have? Like a netbook, the iPad doesn’t fit in my pocket. Unlike a netbook, the iPad doesn’t have a real keyboard and costs twice as much. With a standard under-$300 Dell Mini 10, unlike an iPad, I can run all of the applications I run on Windows, including a full C and *NIX-like development environment. If I don’t like Windows, I can run Linux. Or even MacOS X...wait, take that back, Apple made a change to the latest Snow Leopard kernel so it won’t boot on an Atom processor.

Who besides Apple would be able to get away with deliberately disabling their software on hardware customers want to run it on?

Cool blog on the problems of freetards

There is a cool blog entry on the problems of the attitudes freetards have, and the issues with “free content”. There is no such thing as a free lunch, and the new economy hasn’t changed that.

People who think open-source software (OSS) makes it possible for all content to be free don’t understand how OSS changes the relationship between the developer and the user. A lot of people think an OSS program is like a commercial program, but free, and that they can ask for features or get support for free, and it gets pretty tiring to have people email me asking for free support, even though I make it clear that I don't provide free email support for my program.

The thinking behind OSS is that I donate some of my coding time and effort to the greater community. In return, people are free to contribute bug fixes or improvements to the program, or supply support on the mailing list. For example, someone wanted better IPv6 support, supplied patches, and now MaraDNS has good IPv6 support. Another person wanted better Windows service support, and supplied patches to make MaraDNS’ new recursive core be a full Windows service. Other people answer user's questions on the mailing list or translate documentation. Webconquest very generously provides me a free Linux shell account and hosting for the web site.

Likewise, I found an OSS Doom random generator I liked and provided bug fixes and improvements to it; when I lost interest in it, another person became the maintainer and improvements continue to be made even though I no longer work on that code. And, there is a Free Windows Civilization clone for Windows which I have provided a bug fix and extended the documentation with.

OSS doesn’t mean we have the right to demand all content be free or that we are justified in pirating media and software. OSS means that we can, together, make free content which complements the for-pay content out there.

Deadwood support clarification

OK, it finally happened: Someone emailed me with a Deadwood support concern. So, I have just updated the Deadwood page and the page with my email address to clarify the following (which is in Deadwood's INSTALL.txt):

The channels of support for Deadwood are the same as for MaraDNS: Post it to the MaraDNS mailing list or pay me for support via email. Details are at http://www.maradns.org.

Sorry, guys. I'm not being paid for my time writing these programs, yet give these programs away free of charge with very liberal (BSD) licensing terms. I used to provide free MaraDNS email support, but this no longer became practical about two years ago; the backlog became too big for me to answer in a timely manner. Please either pay me or use the mailing list if you need support. Ditto with blog comments; please don't ask questions on the blog; the place for free support is the MaraDNS list.

Rant: Using open source to justify piracy

This last weekend, Slashdot had yet another idiotic since open source software exists, it's OK to be a pirate thread.

This type of freetard thinking annoys me greatly. The thinking amounts to this:

• Artists, movie makers, musicians, and other generators of intellectual property have an inherit desire to generate these things
• These people don't care if they are paid or not
• Therefore, all media should be free and there should be no intellectual property

This completely ignores the obvious truth that artists, movie producers, musicians, software developers, and other creators of intellectual property, do indeed care whether or not they get paid.

Freetards with this thinking look at the free software movement to justify this asinine thinking. More annoyingly, many of these freetards think they can have the same customer-provider relationship with a free software developer that they have with a piece of commercial software paid for.

People with this thinking generally do not understand the collaborative nature of open source development. They think, in so many words "I want you to work hard making this and am unwilling to pay your nor to lift one finger helping you". They do not understand that, if they want better documentation for a program, they can write it themselves. If they want better artwork for an open-source video game, they can draw it themselves. If they want to see a feature implemented, they can implement it themselves.

They think they can just demand that the developer/artists/whoever do this work for them "for fun and for free".

This is the thinking of a small extremist minority; the internet allows all sorts of wild and fringe theories to be propagated and supported in online bulletin boards.

Docbook sucks

This message is my reply to a Facebook message claiming Docbook is better than HTML because you can’t add a table of contents (TOC) to an HTML document.

Docbook sucks. It is too complicated for its own good. In the early 2000s, people were clamoring for a standard documentation format for MaraDNS. I whipped out Perl and made a script to convert a subset of HTML (which I call “ej”) in to *ROFF man pages, along with a couple of other scripts to make HTML documents and ASCII text files.

People complained because it wasn’t docbook. I told them I looked at docbook; my rant (which I didn’t publish) was that the language was too complicated and the tools too primitive for my tastes. I still use this subset of HTML for documents that are converted in the *ROFF man pages (such as Deadwood’s man page).

HTML is the universal text markup language and using anything else is foolishness. And, yes, making a TOC for HTML documents is easy (as long as the HTML document is structured). Just last week I made a tutorial in a word processor, converted it to HTML, and added a TOC like this:

cat Tutorial.html | awk -F\> '/<\/b><p>/ {a=$2;sub(/<\/b/,"",a);gsub(/[ -]/,"",a);print "<A name=" a "> </A>"} {print}' > foo.html

mv foo.html Tutorial.html

cat Tutorial.html | awk -F\> '/<\/b><p>/ {a=$2;sub(/<\/b/,"",a);b=a;gsub(/[ -]/,"",a);print "<A href=#" a ">"b"</A><br>"}' > TOC

vi Tutorial.html
{move cursor down to area just past the BODY tag}
:r TOC
:wq

And, oh, docbook.org points directly to some ads asking me to buy their books (Update: To be fair, you can read this book for free on their web page). No thank you. I can spend five minutes whipping up an AWK script to add a TOC to a HTML document; did I mention that the GAWK manual is a free download, not a $40 download? (Update: Again, one of the books is free to read on their webpage)

Final update:

Another cool linky:

http://en.wikipedia.org/wiki/Comparison_of_document_markup_languages

Invasion of the spammers

A lot of spammers have been trying to put spam in blog comments here. Since I moderate all comments posted here with some strict guidelines (no spammers, no flamers, no completely off-topic posts, no support requests) none of these posts were made visible, but still it's annoying to have seven posts to moderate and have them all be spam.

A lot of spam blogs use CSS to hide the button to report the blog; to report a spam Blogger blog, go to this link (or this link) to report the offending URL.

Clarification about MaraDNS roadmap

Since some anonymous freetard responded to my last blog entry by trying to put some BS on the MaraDNS Wikipedia entry, let me clarify my roadmap:

• I have no plans to quit working on MaraDNS. “Quit working” implies I will no longer fix bugs or answer email on the list. This is false.
• My current plan is to continue to fix bugs after the 2.0 release of MaraDNS. I plan on continuing to fix bugs in 2.0 and the upcoming 1.4 release of MaraDNS for the foreseeable future.
• I will continue to monitor the mailing list and answer questions I deem appropriate to answer.
• I will still provide for-pay private email support for MaraDNS
• I will still add features to MaraDNS that people are willing to sponsor

Now, let me give you guys a rant about freetards. A freetard is someone who expects something for nothing. They feel they have an entitled right to download pirated software and media, and that companies who try to protect their intellectual property are somehow in the wrong (or that intellectual property should not exist). They feel they are entitled to free private email MaraDNS support (I get about one idiot like this a month) even though I make it clear I don’t provide this kind of support. They feel I should spend my free time writing MaraDNS “for fun and for free” and try to put untrue negative statements about MaraDNS on the Wikipedia if I don’t give them something they think they are entitled to.

One of the biggest hassles developing MaraDNS is the number of freetards out there. People who don’t lift a finger to help make MaraDNS a better server, but expect me to waste time answering their email asking for the same feature 10 other freetards have already asked for. People whose net contribution to MaraDNS has been to annoy me.

About a month ago, I had an interesting discussion on Slashdot about user’s expectations for open-source software. The conclusion: Many users of open-source software expect to be treated like customers, but are unwilling to pay a single dime for open-source software.

Bottom line: If you want to be treated like a customer of MaraDNS, you first must become a customer of MaraDNS. If you make a modest donation to MaraDNS, I will be happy to answer your email; the charge, for the record, is US $50 per private email support incident, more if I need to add a feature to MaraDNS to resolve your concern.

If you want to be a freetard and send me a private email, I’ll spend about 10 seconds scanning your email to make sure you didn’t make a donation, then send you the “Show me the money” form reply. Yes, this includes bug reports. Yes, this includes feature requests. Yes, this includes whatever discussion you want to have with me about MaraDNS in private email. All of this belongs on the list, not in my personal mailbox—unless you include a check in your email.

An open source developer grows up

A lot of open-source forums are full of naive and innocent people. People who honestly believe that software can be developed and media can be made by nothing more than people working for fun and for free in their free time. Indeed, people point to Linux and say "Look! This great software project made for fun and for free!"

That's not how software development works. Linux? It's very disorganized; there is no central authority to standardize on things like the Desktop interface to use, the ABI for drivers, and what not. This results in Linux being a mess: A hodge-podge of driver ABIs (sound is so bas that it's nay-to-unusable in Linux), desktop GUI interfaces (Qt, GTK, FLTK, Xaw, TCL/TK, Motif and its Lesstif clone, to name just a very few), programs at various stages of development, etc. The only thing Linux can seem to agree on at all is POSIX, which is so old and quaint, the only networking protocol it talks about is UUCP [1].

Linux makes a very good server OS for someone who knows what they are doing, but it is not and never will be an end-user desktop.

For example, the Linux sound system. What happened was that the main developer for Linux's sound system one day grew up and realized that the work needed to make open-source software compared to the reward he was getting was just not worth it. So he tried to make it commercial; other Linux kernel developers wanted to keep everything open source, so they threw out all of his work (never mind that his system was the standard system for doing sound with Linux for years) and reimplemented it, more poorly. Linux's sound is a mess to this very day, with dozens of half-baked audio systems in place, none of which works as good as the original system.

OK, let me go back to why this happened: The main developer grew up. He realized that open source software development for fun and for free is plain simply not worth it. He left the project. No other Linux developer was able to make the same quality of code he did.

Another example: Xconq, which I talked about in this blog posting. Summary: The principal author, after nearly two decades of work on the project on and off, finally lost interest in the project and development just came to a halt without any formal announcement. Many open source projects die like this; the developer loses interest, but never puts closure on the project. Instead of giving the project a proper burial, the project becomes a zombie, dead but pretending to be alive.

Another example: FVWM. Rob Nation realized one day that it was a far more productive use of his time to be with his wife and kids than to work on open-source software, so he stopped FVWM development. He handed over maintenance to other people who, IMHO, did not do as good of a job as Rob Nation developing the software; while FVWM2 has more features than FVWM1, the code is more unstable and more bloated. Indeed, I still use the last release of Rob Nation's FVWM1 today when I'm using Linux. FVWM1 ended with proper closure; FVWM2's development has slowed down but still appears to be actively development (albeit at a glacial pace); the last stable release was done in 2006, but a beta release was done as recently as last month.

Another example: People's Tactics. The developer made a free beer "grogger" wargame for Windows that simulates the old 1970s and 1980s wargames groggers played with hex maps and a zillion tiles on the maps (Squad Leader and other games from Avalon Hill, SPI, Axis & Allies which didn't use hexes but was probably the most popular wargame of this type, etc.) He realized that he should be paid for his work (software development, support, etc.), so removed the website for his older free game, and replaced it with a website for his for-pay Advanced Tactics game.

And, yes, I'm coming to the realization I need to put closure on MaraDNS. This means my next release of MaraDNS (MaraDNS 2.0) will be my last release of MaraDNS. MaraDNS 2.0 will have real Windows service support for the recursive code, in addition to a rewritten thread-free recursive core. I've done about two thirds of this work on and off for two years; I made a lot of progress in late 2007, and even more progress in the first two thirds of 2009, but come September I hit a roadblock when I hit the point of starting to implement full recursion. I have made some progress chipping away at that roadblock, but it's slow progress.

I also hit a point where I realized it is more fun to do things like research Chess variants that no one plays (openings, best opening setup, midgame strategy, etc.) than to finish up my DNS server. Indeed, I feel this software is holding me back; it's written in C (which is next-to-useless on a resume unless you also have C++ or Objective C; come to think of it, with all the companies outsourcing development to India, C development in any form might be useless at this point) in a day and age when the buzzwords people look for on resumes are things like "Java", ".net framework", "PHP", and "SharePoint".

I have been spending my time working on MaraDNS instead of getting my resume out there (it's pretty discouraging in this economy, but I shouldn't give up) or updating my skills. I have been spending my time working on MaraDNS instead of doing what it takes to reach my goals: To have a job making a living wage so I can support myself and my girl comfortably in the US (ideally somewhere where it is sunny like California, my home).

So, yeah, what I'm saying is that I'm taking a break from MaraDNS. I have every plan to finish up the Deadwood code and come out with MaraDNS 2.0. But it isn't going to be the end of 2009. Maybe I'll start work on MaraDNS again next week; maybe I'll just let it rest until 2010 sometime, just as I stopped Deadwood development for most of 2008 and only started development up again in early 2009.

Do I want to finish up Deadwood and release MaraDNS 2.0? Yes. Am I going to do it anytime soon? Probably not. I'm having fun downloading and trying out various turn-based strategy video games; I would rather do that right now (or research Chess variants) than develop a program which has only made a very little amount of money for the amount of work I've put in to the code.

I'm growing up and realize that there are more important things than making programs for fun and for free. Yes, I do want to finish up Deadwood mainly to put closure on the project, but I don't think I'll do any MaraDNS development besides basic bug fixes after MaraDNS 2.0 comes out.

- Sam

[1] UUCP: You don't want to know. I remember when an ISP I worked for dropped UUCP support; UUCP was a nightmare to configure and we simply no longer had anyone who could configure our UUCP servers. The *only* thing UUCP can be used for is email and Usenet.

Rant: Putting closure on a project

OK, one of my rants about open-source projects: A lot of open-source developers have a hard time putting closure on a project. For example, in the 1980s, Stan Shebs created a game called Xconq. He revised it and even rewrote it in the 1990s. In the early 2000s, he posted to the Xconq mailing list a roadmap for Xconq. A few years after this, Xconq languished; it was transferred to Sourceforge around 2005, with the last release being done on June 12, 2005.

In 2006, when someone asked if Xconq was dead on the mailing list, they were told “It's not dead, it's... resting.”. But, at this point, Xconq was dead; while a few CVS changes were done after this, the last CVS commit was done in 2007 and the project has been completely moribund since then.

Xconq is dead.

OK, big deal. A lot of open source projects come and go. My issue is this: As an open-source developer, I have a responsibility to put closure on my projects. When a given open-source project is something I realize I have no interest in working on any more, I let the project go, via a formal announcement. For example, I announced the end of my Kiwi Spam program on October 17, 2001; while I got a couple of emails expressing disappointment the project had ended, I never got a maintainer for the project. Recently, after making a few minor updates to ObHack, my fork of a random map generator for Doom-type games, I announced I would no longer be working on this code. There was enough interest in the code I was able to hand over maintenance duties over to Fritz, who has since then fixed a bug I never fixed and made a couple of releases of ObHack.

Closure is, IMO, very important for an open-source project. It tells the world “I’m responsible enough to know when to start a project, and, just as importantly, when to finish a project.” It allows the community of users to know you’re no longer interested in a project, making it possible for them to become the maintainer if there is still interest in a given project (such as what happened with ObHack).

Everything has a beginning and an end. A responsibly done open-source project is one that knows when it’s time to pack up and go home.

Firefox 3.5 now works; Deadwood minor update

OK, a week or so ago I reinstalled my operating system, zapping all of my Firefox configuration data. Once I did this, I tried installing Firefox 3.5 again. This time, everything worked without significant problem; I am able to use Firefox 3.5 without significant freeze-ups while loading background tabs.

For other people who are seeing these freeze-ups, try resetting your Firefox profile to see if the problem goes away.

---

I have released a minor update to Deadwood today.