Kurt Gödel: hacking the U.S. constitution

I've been wandering through Wikipedia yesterday, and at one point ended up reading the page on Kurt Gödel. Gödel's achievements in the field of logic are indispensable to modern mathematics, and his incompleteness theorem has very far reaching implications in disciplines other than mathematics¹.

It is safe to say he was your typical deep thinker, and inward facing, not-too-closely in touch with reality type of person. This snippet from the page made me laugh real hard, because it so perfectly illustrates certain aspects of a math nerd. Listen:

Einstein and Morgenstern coached Gödel for his U.S. citizenship exam, concerned that their friend's unpredictable behavior might jeopardize his chances. When the Nazi regime was briefly mentioned, Gödel informed the presiding judge that he had discovered a way in which a dictatorship could be legally installed in the United States, through a logical contradiction in the U.S. Constitution. Neither judge, nor Einstein or Morgenstern allowed Gödel to finish his line of thought and he was awarded citizenship.

(emphasis mine)

Does anyone know whether he was allowed to finish his line of thought at some other time? (Not that I'd be personally interested in executing the idea, mind you.)

---

¹ Including the fact that free will of any mind is just an illusion it has because it can't contain a complete model of itself it could use for correctly predicting its own behaviour in advance. Enjoyable presentations of incompleteness theorem for layman include Douglas Hofstadter's "Gödel, Escher, Bach" (if you're 16 or older), or Raymond Smullyan's "The Lady or the Tiger?" (if you're under 16).

Sim City goes open source

The source code for the original Sim City (the game responsible for countless hours I spent sitting in front of a computer when I was 16), have been released under GPL v3. If you ever played it (you did, right?), you had to admire all the cross-interaction of your planning decisions and certainly wondered about the underlying mechanics. Well now, you can read it first hand!
One of insightful quotes from the announcement:

The modern challenge for game programming is to deconstruct games like SimCity into reusable components for making other games!

That is a very important point, and illustrates well the unique aspect of exponential utilization opportunities of open source software. (Even if I personally believe more liberal licenses than GPL contribute towards this aspect more).

Java 6 on Leopard. Well, almost

So, it looks like there's finally a developer preview of Java 6 for Mac OS X Leopard. Am I happy? Nope. Why? Here's why:

		CPU Architecture
		PowerPC	Intel
CPU bits	32-bit		Machines I have
	64-bit	Machines I have	Machines running Java 6

It only runs on Macs with 64-bit Intel CPU. Now, I have a 64-bit PowerPC Mac, and I have a 32-bit Intel Mac, but no 64-bit Intel Mac, so no cake for me. Darn. Hopefully the final release will run on all hardware that Leopard itself can run on.

Boot Camp experiences

So, I used Boot Camp (2.0, the one that comes with Leopard) to install Windows XP on a small (16 GB) partition on my MacBook Pro. Reason being that Half-Life 2 won't run under VMWare Fusion...

I'll summarize the experience here, with emphasis on problems I encountered and how to get around them.

First, the good things. In contrast with older Boot Camp versions (1.0 and 1.1 for Tiger), you no longer need to burn a CD with Windows device drivers for Apple hardware. They are now included on the Leopard install DVD, so after Windows is installed, you just need to pop in the Leopard DVD into the drive, and let Windows autorun feature start up the driver installer from it. It will also install Apple Software Update in Windows, and it will presumably keep the drivers up to date (there are no updates right now, so I can't verify this. It will offer to install QuickTime and iTunes though...). Mac keyboard extras work perfectly (volume control buttons, brightness control buttons, eject button). All hardware - graphics, sound, wireless seems to be perfectly supported. The trackpad gestures also work as expected. I only maybe wish they could have made the Windows recognize Cmd+Tab instead of Alt+Tab for application switching...

Now for the first obstacle: Windows would not display image on the external display attached to my MacBook Pro no matter what I did. Others reported the problem on various message boards, with different proposed solutions. After several dead ends, I went exploring on my own. (Note: this solution works for MacBook Pro machines with an ATI chipset.) I ended up downloading ATI Catalyst Software Suite. It unpacks into "C:\ATI" folder by default. Within that is "C:\ATI\CCC" (for "Catalyst Control Center") folder, with a "setup.exe". It will tell you that it needs .Net 2.0 runtime to run. You can get it here.

So, install .Net 2.0 runtime, then the Catalyst Control Center (CCC). Don't try to install the full ATI suite, as it will not succeed, only install CCC. Launch CCC after installed. There is a tab where you can enable/disable various outputs and specify their order. Turns out the ATI chip in my MacBook Pro has 3 outputs (built-in display and two externals), of which two are enabled (built-in and one external), and one external is disabled. The trick is to disable the default enabled external output, and enable the one that was disabled! Voila, the external display lits up! (Regardless of whether you're connecting directly via DVI, or, as I do, through a DVI-to-VGA adapter -- there were reports on the net claiming only DVI displays will work. Fortunately, this is wrong.) Finally, you can use CCC to swap the order of the displays; if you want the external display to be the primary display (one carrying the start button and the tray (as I do)), you'll also do this.

That's all there is to it.

Second obstacle: with a newly created Windows partition, Spotlight had problems after booting back to Leopard. It started indexing it, and never finished. It was pegged at "3 minutes remaining" for about a day, and couldn't be used for searching during this time. This was particularly painful for me, as Spotlight in Leopard is so much improved that I use it all the time, especially as a lightning-quick application launcher. Solution was to disable Spotlight for the Windows partition. I guess you could do it using Spotlight preferences, but I did it by typing

sudo mdutil -i off /Volumes/Windows \HD

from Terminal. (Of course, your Windows partition might be named differently, i.e. "NO NAME" instead of "Windows HD".) This immediately stopped indexing, and Spotlight was usable again. This might be a problem for you if you keep some content you wish to search on your Windows partition, but since I only keep few games on it, it's not a big deal for me.

Other than these two issues, I experienced no problems and am a happy camper (pun intended).

lolcatshost

Some people clearly have too much time on their hands, witness lolcatshost!
(Via Little Gamers)

UPDATE: actually, it seems like the site was inspired by that Little Gamers webcomic.

Terminus

Via Boing Boing:

A silent concrete monster follows a nervous businessman through Montreal in Terminus, an eerie and darkly funny short film directed by Trevor Cawood

Go here to watch, it's only eight minutes, well worth your time.

Bedtime

So, just as Christmas passes on December 26, I suddenly fall sick. Perfect. I haven't logged a single sick day for more than over a year, maybe even two years, and now that I'd have few spare days to spend on things I'd like to do, I'm more-or-less tied to bed. Don't worry, nothing too serious, just stuffed nose, terrible coughs, and enough fever and chills to keep me not wanting (or, in fact, being too able) to move anywhere outside of the bed. The usual "season's greetings", you might say.

I'm reading though. I read some wicked good books in the past months, including Charlie Stross' Glasshouse, as well as an überweird Cory Doctorow piece (Somebody Comes To Town, Somebody Leaves Town) as well as few Karl Schroeder novels. I'm through most of them by now and am tasting some Vernon Vinge momentarily, which isn't as good as the more contemporary guys (Stross and Schroeder) are, but is still much better than Iain M. Banks is.

Or even better, I listen to wife reading Mr. Pratchett's The Bromeliad Trilogy to kids (and me!). I picked up Truckers in a book store about a month ago without knowing it is targeted for children, but after reading it I realized it'd be great fun to read it to kids in the evenings. Usually it is me doing the reading, but with sore throat... So, we finished Truckers today (second reading for me), and started on the Diggers (which, along with the closing volume of the trilogy, Wings, I picked up today at the same bookstore. I have a habit of buying only the first novel in a series and making subsequent purchases based on whether I'm still interested in it after the first book ends. For me, Iain M. Bank's first Culture novel didn't hit the bar, so I'm avoiding it for now).

Anyway, my Mom was over for holidays, and listened in to our reading of Truckers. As a result, I gave her one of Discworld novels (Mort) to read on her way home. I'm pleased to say that Mr. Pratchett has obtained yet another (in this case, 58 year old) fan :-)

Anyway, days are a bit bleak. I'm usually not well enough to hack or even to play much with kids, or anything of the sort. Getting to a store to shop for groceries to get us through New Year's Eve was quite an effort and I felt much worse afterwards.

Oh, I also picked up Half Life 2 retail box three weeks ago on an impulse while shopping for Christmas presents. Tried to install it this morning (lacking better pastime since I couldn't sleep from my cough rush), and it claims the CD key is invalid. Swell. Valve support didn't answer within a workday. Knowing me, if I don't get to try playing it during the holidays, I probably won't find time for it anytime soon, so it's as good as money thrown out of the window if they don't resolve this quickly. Way to go, selling people unusable DVDs.

I also managed to drop my photo camera from a waist height on a hard stone floor during Christmas - I was trying to take pictures of kids while they were having fun with Sparklers. In response to the drop, the camera's objective developed a very ugly skew. Not entirely surprisingly, it doesn't work anymore... Closest Canon service (and the only one in the country) is of course, where else, in Budapest, 200km away. Buying a new one might be a more viable option.

Oh well. I guess I'm going back to bed. Sorry everyone for a bad-mood rant...

www.opensource.org hacked?

Does anyone know what happened to http://www.opensource.org? It's supposed to be the website of Open Source Initiative, but it looks like right now it serves the same content as http://hyperreal.org, whatever that might be... It is either hacked, or maybe the two sites are collocated on the same physical HTTP server and there was a config glitch. Anyway, quite annoying...

Rhino in Spring 1.2

So, I've used some free time around the holidays to put the finishing touches on a new release of Rhino in Spring. The new release is 1.2, and it has one major new feature (as well as few featurettes). The major big thing: it is now fully clusterable with Terracotta!

Actually, that's pretty much it. There's few other featurettes as well, but the real big leap forward was restructuring of the internals so that it plays nicely in Terracotta distributed clusters. Configuration for clustering is dead easy: it comes with a Terracotta "configuration module", a special JAR file hosting an XML file with clustering declarations for the code. You just reference it in your tc-config.xml and that's it. The rest is Terracotta magic :-)

FreeMarker 2.3.11 released

We released FreeMarker 2.3.11 on Wednesday. There are few new feature goodies as well as some significant performance improvements (both speed and memory) in there, not to mention bugfixes, so you might consider upgrading from earlier 2.3.x version. Head over to the project website for more info and download.

13949712720901ForOSX

13949712720901ForOSX

Working Java 6 on Mac OS X - but not from Apple

Turns out there's a working Java 6 for both Mac OS X Tiger and Leopard. It is a port of the Java Research License licensed codebase for BSD, so to use it legally, you need to agree to JRL first. It's developed by a person named Landon Fuller, and he says on the page:

The Mac OS X work is based heavily on the BSD Java port, which is licensed under the JRL. The BSDs develop Java under the JRL; FreeBSD has negotiated a license with Sun to distribute FreeBSD Java binaries based on the JRL sources.

As the Mac port stabilizes, I am merging my work upstream into the BSD port, and in turn, it is a goal of the FreeBSD Java project to merge their work into OpenJDK. I've signed a Sun Contributor Agreement in preparation for this...

There are some minor features lacking (minor if you're like me, using Java for server side): sound doesn't work yet, nor is there a native Aqua Swing UI.

Via Charlie Nutter (who also perftested it with JRuby and sounds quite impressed).

New MacBooks finally have 3D graphics in hardware

I just noticed that new MacBook models ship with Intel GMA X3100 graphics chipset instead of GMA 950 in previous models. Notable difference is that X3100 has 3D rendering hardware - a shader processor with 8 execution units fully supporting transform & lighting, with support for DirectX 10.

That's quite a big news for people who previously dismissed MacBook as an option because of weak graphics chipset (i.e. people who'd dual boot into Windows for gaming).

On the downside, GMA X3100 still doesn't have dedicated RAM, and it'll actually take away 144MB of system RAM (160 if you use an external display), compared to 80MB that GMA 950 used, so YMMV.

"Some thoughts on security after ten years of qmail 1.0"

There's a paper "Some thoughts on security after ten years of qmail 1.0" written by qmail's author, Daniel J. Bernstein. (I found it though Bruce Schneier's weblog). The paper is well worth reading because Daniel is extremely security-conscious. As he says:

In March 1997, I took the unusual step of publicly offering $500 to the first person to publish a verifiable security hole in the latest version of qmail: for example, a way for a user to exploit qmail to take over another account. My offer still stands. Nobody has found any security holes in qmail. I hereby increase the offer to $1000.

He actually gives lots of practical advice on how to make your code more secure: security holes are bugs, so you should strive to eliminate bugs in general. Also, you should strive to eliminate code (as number of bugs is usually proportional to number of bugs). Finally, you should minimize the amount of trusted code and have all untrusted code run in a sandbox (using his words, a "prison").

Now, to reflect a bit on sandboxing myself from a Java point of view, Java is fortunately quite well suited for minimizing trusted code. When you run a Java program under a security manager, code gains privileges based on where it came from, and the privileges of the current stack frame are the intersection of privileges of its code and all of its callers down the call stack.
There's a facility for privileged execution, SecurityController.doPrivileged(), where the code within the privileged block will run with full set of its own privileges, and not get narrowed down further with security restrictions placed on its callers. It can be a dangerous feature, and must be used judiciously lest you create an exploit vector through it. I.e. if your code accepts a file path from its callers, reads the file in a privileged block, and returns the file content to the caller, then a caller can potentially exploit this to gain access to contents of files it would otherwise not be able to see.
I'm actually quite conscious to enable easy integration with Java security manager in software I write - you will find a PolicySecurityController class in Rhino, as well as a SecureTemplateLoader in FreeMarker, both allowing running JavaScript code or FreeMarker templates, respectively, with their own set of privileges defined in the effective JVM-wide security policy based on where they're loaded from or whether they're digitally signed (same aspects are used to assign privileges to Java code). FreeMarker also uses SecurityController.doPrivileged() in few places judiciously.

Anyway, back to Daneil's paper: there's a wealth of food-for-thought for any practicing software developer: how we often sacrifice security for speed, how hidden data flow (global variables and singletons, people!) leads to security issues, and how this can be fixed by further decoupling of components with explicit narrow communication (i.e. message passing across processes), and so on.
A section entitled "Avoiding parsing" also speaks very closely to my heart.
So, recommended reading.

Wired profiles Randall Munroe

Wired has a profile article on Randall Munroe. Munroe is the Xkcd guy. If you didn't know Xkcd before, you can thank me later for pointing it out for you.

"JVM Dynamic Languages Metaobject Protocol" now released

I finally got around to packaging up the current state-of-art of my metaobject protocol library as a downloadable release (source + binaries + documentation), plus putting up a very basic website (hosting an information page + JavaDoc) for it.

I haven't got around to setting up dynalang.org yet, so the website is for now hosted at http://dynalang.sourceforge.net.

The fact there is now a release does not intend to confer either a sense of completeness or rigidity. It is versioned at humble 0.3. It is pretty much open to modifications and is also probably not complete yet (i.e. I fully expect people to need further features for integrating with their particular language runtime). The release just strives to make it easier for people to get started with it, as it's now available as a HTTP download instead of only through SVN. Also, having a release means there's now a baseline for purposes of tracking changes in a changelog file etc. Unit tests cover about 75% of the code right now, so it's fairly safe to say it does what it is intended to do, but of course, bugs are always to be expected.

In completely unrelated news, today's my birthday too :-)

Leopard firewall breaks Skype

Apparently, Skype.app on Mac self-modifies its application package. Leopard OTOH digitally signs application packages after you download them from the net and allow them to run, and also when you allow them to accept connections through firewall. Skype's self-modification causes the signatures to get invalidated. After this, Skype will completely fail to launch. It'll bounce twice in the dock, and that's it.

Options: (a) don't use Skype (b) disable firewall. Damn. I'm going with (a) until Skype fixes this. Actually, I tried disabling the firewall, and for me even that didn't help. Double damn.

New Language Features for JDK7 - from the Java Community

A newsletter from Belgian Java User Group (BeJUG) landed in my Inbox yesterday, and boy, am I glad to see it. You can read it here. Basically, BeJUG is submitting the JSR for closures in Java, based on Neal Gafter's proposal. This is huge news for several reasons. Reason one, we need closures in Java NOW. Reason two, this is the first JSR filed by a Java Users Group, and also the first Java language JSR led outside of Sun Microsystems.

The second jolly good news in the same newsletter is that Google also submitted a JSR for a "collection of smaller language features". Smaller? They're proposing type inference, extension methods, catch for multiple exception types (Brian Goetz will be glad. Hell, me too!), and improved syntax for easing the catch-rethrow pattern. These ain't small in my book.

We need to realize that C# has had type inference, extension methods, object initializers, anonymous types, and lambda expressions for two years now. It'd be about time for Java to catch up with the times, and I'm really glad to see community finally taking initiative to make it happen and not waiting for Sun.

Network traffic prioritization by specific cost

I've been following with some interest the recent Comcast scandal where the ISP started inserting TCP reset packets into BitTorrent traffic of its clients, thus disrupting it.

Comcast claims they do it to protect the ability of "normal" users to use the bandwidth from "excessively using" users that hog it.

(I personally believe Comcast tries to minimize the overall amount of traffic that flows out of its network to other ISPs as it costs them money in the fiscal clearing of cross-ISP traffic.)

But let's entertain the idea for a moment that Comcast would really like to protect their "normal" (read: low-traffic) users from their "excessively using" users. How would I go about implementing a fair system that achieves this goal?

Well, certainly not by disrupting the traffic.

Below is an idea that I believe would result in fair allocation of bandwidth within the network of a single ISP with paying customers. I must forewarn you that while I design software systems for living and often need to deal with management of limited resources, I'm just a layman when it comes to the narrow field of packet-switched network traffic management, so what's written below might not make sense at all because of some arcane aspect or the other that I know nothing of :-)

Anyway, here it goes:

The ISPs already measure the amount of traffic generated by every user within a billing period, that's how they are able to detect "excessively using" users today. However, instead of handicapping a user that "excessively" uses the bandwidth, the metrics would be used only to select which user's packet to drop when there is insufficient bandwidth on the routers' outbound lines, but only then.

The strategy would be to always drop the packet coming from the IP address of the user who had the highest traffic in the billing period so far. Or, in case of differently priced packages, or even different billing periods, the user with highest traffic/fee ratio for his current billing period, expressed nominally in byte/dollar.

This way, the proverbial "only checking his mail" user would always experience a fast connection, followed by a user who listens to online radios and watches some amount of online videos, while the "excessive" p2p users would be only competing for leftover bandwidth among themselves.

It'd be easy to suitably extend the idea to a nondeterministic scheme where a packet to be dropped is picked randomly, but the probabilities are weighted by their user's dollar/byte ratio. That'd give a user who heavily used p2p at the start of the month a standing chance to still be able to check his e-mail even when another user comes along who floods the network with p2p traffic near the end of the month.

Feel free to point out why this wouldn't work, doesn't make sense, or is already invented in this or similar form and used somewhere :-) I've tried uncovering this technique using Google, but have found only port/service/application based QoS prioritizing, and didn't find anything specifically describing this -- namely, prioritizing based on user's specific monetary cost of traffic, amortized over a billing period.

As far as I can tell, this method preserves network neutrality, as it does not discriminate based on either the type of traffic or the destination of the data. It also doesn't degrade the throughput for anyone in any way as long as there is sufficient free bandwidth.

Leopard so far

This Thursday, I upgraded my MacBook Pro to Mac OS X 10.5 Leopard. It was a holiday over here, so I had four days (Thursday to Sunday) to work out the wrinkles in case something didn't work. I did the usual precautions: mirror the boot drive to an external drive, boot from the mirror to make sure it works, then shut down the computer, physically disconnect the external drive, and only after all this start the OS install.

I decided to give myself a chance to avoid reinstalling everything, and thus chose the "Upgrade" option instead of a clean install. After an hour of DVD consistency check and an hour of copying files, the machine rebooted and I was greeted by a working Leopard. It went incredibly smoothly.

I proceeded checking whether everything works. First on the list was Cisco VPN Client which I need for work. I was sceptical, as the Cisco VPN client integrates tightly into the system, installing kernel extensions for networking. To my very pleasant surprise - it worked! Next was ssh, which also worked. VMWare also works, no problems there.

Then there's some more arcane stuff:

An unsupported printer driver for my Xerox Windows-GDI printer, cross compiled to a PowerPC binary from a Linux CUPS driver - works!

My heavily customized, start-on-boot MySQL setup - works!

There's of course no Java 6 yet, as discussed earlier, but the good news is Java 5 is at least upgraded from 1.5.0_07 (found in Tiger) to currently latest 1.5.0_13 in Leopard.

Eclipse 3.2.2 works overall. There are keyboard issues though. I.e. if I press Command+Shift+U ("Occurrences in File"), it brings up a context menu (to choose among "Identifier", "Implementing Methods", and "Throwing Exceptions"). However, both the menu and editor window receive the keyboard events for arrows, and when I hit Return, the context menu disappears altogether (without performing the selected operation), and the key is interpreted by the editor (i.e. inserts a new line...). That's one minor annoyance.

One of my pet peeves is also fixed finally: I can finally use the Return key to activate the "Allow" button in Keychain Access' "Copy to Clipboard" dialog. Oh, progress! Previously, if I didn't want mousing, I had to do Tab-Tab-Tab-Return. Still no keyboard equivalent to invoke the said dialog though... Also, the "new password assistant" palette now syncs with the password field, so I needn't copy/paste a generated password back to the main editor window of Keychain Access anymore. Yeah, small things, but they do matter.

Also, there was something amiss in my user account in Tiger - lots of programs forgot their license number when I logged off (Delicious Library and Disco most prominently), and it also lost my keyboard shortcuts whenever I logged off, so after a while I lost the habit of using custom shortcuts, as you can imagine... Upgrading to Leopard fixed both issues.

The system is noticeably snappier. Tiger had the tendency to stall under heavy load. "Heavy" is when I run a Terracotta server and two clustered Tomcat instance on the MacBook Pro, talking to a special Linux appliance running in VMWare, occasionally recompiling the code or interactively debugging from Eclipse. Oh, and running a BitTorrent client in the background to boot it. Now, Tiger did have issues with this even with 2GB of RAM, to the point of UI freezing up for 20-30 seconds whenever I switched applications with Command-Tab. Leopard tolerates such loads much better. I guess virtual memory management got smarter with regard to handling applications' working sets, and there are probably lots of minor kernel optimizations and reentrancy improvements. Overall, noticeably better. Lot less beachball sightings.

As for games: Diablo II works nicely even on an Intel mac (it's a PowerPC binary). Of course, only when you install it using the "carbonized" installer, the version on the CD requires Classic subsystem, which is gone from Leopard.

Age of Empires III has issues though. In single player, all is dandy, but playing in network is completely borked by network sync issues. Few seconds into a multiplayer session it'll say "Out of sync. Exit and try again". Truth be told, the other machine still had Tiger on it when my son and me tried it; I installed Leopard on it since.

After two days when I was sufficiently convinced that it works okay, I installed it on my wife's iMac G5 as well, and faced an interesting limitation. You know those custom iChat backgrounds Apple showcases as new iChat features? The ones where you can have the room behind your back replaced with a moving Niagara falls scenery? Well, you won't get them on a PowerPC Mac. I wanted to try it out for fun between our two machines, but the iMac's 2.1GHz G5 CPU is apparently not strong enough for them. Intel Macs only. Now, come on, Apple, I don't buy it. You probably just had a nice hand-optimized assembly with MMX and SSE instructions in there somewhere, and couldn't be bothered to port it over to PowerPC AltiVec. You know, the one you touted as being the superior vector unit. I think we're experiencing the first signs of PowerPC users falling out of grace. I don't want to sound dramatic, but I mean, I can maybe, just maybe understand a G4 not being strong enough for this task, but a 2.1 GHz G5? What about people with dual or quad G5s? This is a minor, but sad letdown.

Also, my MacBook Pro took on the habit of waking up at precisely 1:00:00 AM every night after the Leopard upgrade, without anything being set in the com.apple.AutoWake.plist file. Since 1 AM in my timezone (GMT+1) is actually midnight GMT, I suspected this to be some stray zero making its way into EFI or something. Pretty much, after I overwrote it by setting "Start or wake up every day" in Energy Saver to 9 AM, the phenomenon went away.

Well, that's it so far. I'm also fooling around with XCode 3. It's a very polished development environment, and I'm toying with the idea of creating some native Mac OS app. Y'know, just to unbox myself a bit from my "server side Java" box and try the "desktop app in Objective-C" world for change.