Thursday, August 29, 2013

Schema conversion - AUTO_INCREMENT (MySQL) and SEQUENCE (PostgreSQL)

Auto increment is achieved in MySQL using the keyword AUTO_INCREMENT. It is achieved in PostgreSQL using a SEQUENCE statement. Consider the following problem: Create a table with a field, to auto increment starting with the value 5.

MySQL
CREATE TABLE hello (
    idHello int NOT NULL AUTO_INCREMENT
) AUTO_INCREMENT=5;


PostgreSQL
CREATE SEQUENCE hello_idHello_sequence START 5;
CREATE TABLE hello (
    idHello integer NOT NULL DEFAULT nextval('hello_idHello_sequence')
);
ALTER SEQUENCE hello_idHello_sequence OWNED BY hello.idHello;

Friday, August 16, 2013

Threat Modeling - STRIDE

While performing threat modeling on software, verify that every data item, end point crossing a boundary, open port etc are subject to the categorization defined by STRIDE. Each item under consideration may fall under more than one category.

STRIDE Definition

Spoofing User: Accessing and using a resource by masquerading as another user 
Tampering Data: Modifying data maliciously, so that the original data is unavailable and/or malicious                              data is introduced
Repudiation: Denying by a user or system, that an action has been performed by them
Information Disclosure: Disclosure of information to an unauthorized user or system
Denial of Service: Denying the Service to legitimate users or system
Elevation of Privilege: Unauthorized elevation of privileges by an unprivileged user

For more information, refer to Security Design by Threat Modeling



Sunday, August 11, 2013

Tomcat - Application System Error - Access is Denied

Application: Tomcat
OS: Windows
Error: Unable to open the service 'Tomcat7'

When you install Tomcat on a Windows machine, the following error is seen on rebooting the machine.


Reason: Tomcat7w.exe accesses resources that require administrator privileges.
Solutions: Configure Tomcat7w.exe to run as administrator. To configure Tomcat7w.exe run as administrator
    • Right-click on Tomcat7w.exe
    • Click on Properties
    • Click on Compatibility
    • Under Privilege Level, check the box 'Run this program as an administrator'
    • Click OK
    • Reboot the machine

Saturday, August 10, 2013

Programs for Windows Administration

This is a list of programs, that you can use for Windows administration.

  1. Computer Management: compmgmt.msc
  2. Component Services: comexp.msc 
  3. Event Viewer: eventvwr.exe 
  4. Local Security Policy: secpol.msc 
  5. ODBC Data Sources: odbcad32.exe
  6. Performance Monitor: perfmon.msc
  7. Print Management: printmanagement.msc
  8. Services: services.msc
  9. System Configuration: msconfig.exe 
  10. Task Scheduler:taskschd.msc
  11. Windows Firewall with Advanced Security: WF.msc 

Linux Commands

Here are some common Unix/Linux commands
  1. OS bitness 32 or 64: getconf KERNEL_BITS
  2. architecture of processor: file /usr/bin/w
  3. disk space usage: du
  4. enable backspace: stty erase hit_the_backspace_key
  5. split a vim screen vertically: Ctrl+wv
  6. list of open ports: netstat
  7. list of processes: ps
  8. rename a file: mv original_filename renamed_filename
  9. move a file: mv filepath/filename target_filepath/filename
  10. change permissions: chmod
  11. change owner: chown

Windows Batch Files - Common Tips

Lessons learnt while writing Windows Batch Scripts

  1. @echo off -> used as the first line in a batch script, to suppress the output of current command to console
  2. REM this is how a comment is made
  3. echo "this is how to print something to console"

Common Tools for Regular Use

I use a variety of tools during development. Here is a list of some of them. This list keeps growing as I use additional software.

  1. Beyond Compare: for file, folder comparison and file merge
  2. gVim: for file editing, comparison and merge
  3. WinMerge: file comparison and merge
  4. Application Verifier: runtime verification of c, c++ code on Windows
  5. Driver Verifier: Windows kernel mode driver runtime verifier
  6. WinDbg: debugging C and C++ code on Windows
  7. WireShark: network packet analysis and sniffing
  8. Maven: build, package
  9. Gradle: build, package, deploy
  10. Selenium: web site testing
  11. JUnit: framework for unit testing of Java code
  12. Fortify SCA: source code analysis
  13. Clover: code coverage for Java and Groovy code
  14. SonarQube: for trend analysis of various aspects in a project
  15. BlackDuck: open source software management
  16. VMWare Player: free virtual machine software
  17. psftp: sftp client
  18. putty: telnet client
  19. pscp: scp client
  20. tomcat: web server
  21. process explorer: Windows processes, open files, handles etc
  22. dependency finder: for finding dependencies in java code
  23. lattix: for finding dependencies in java/c/c++/.net/database code

Disclaimer: This is just a list of software that I used. I do not make any recommendations regarding the software that I listed here.

Java - Overriding hashCode() and equals()

Java provides a convenient way to calculate 'deep comparison' of objects via hashCode() and equals() methods. Every object has the default implementation for these methods. Deep comparison of objects can be implemented by overriding hashCode() and equals() methods. Several rules are defined by Java creators which we go through in the following sections. You can access these rules from Javadocs of Object.

Rules to override hashCode()

  1. Invocations of hashCode() should return the same value when fields of object do not change
  2. If two objects are equal based on equals() method, both the objects should return the same hashCode()
  3. It is not required that the hashCode() be dissimilar when two objects are not equal based on equals()

Rules to override equals()

  1. Reflexive: An object should be equal to itself: a.equals(a) is true
  2. Symmetric: If an object is equal to another object based on equals(), then these objects should be equal irrespective of which object's equal method is called: => if a.equals(b) is true then b.equals(a) is also true 
  3. Transitive: if two objects are equal based on equals(), then these objects are equal to any other objects that are equal to any of these objects: if a.equals(b) is true and b.equals(c) is true, then a.equals(c) is true
  4. Consistent: multiple invocations of equals() on objects should return the same value, if the underlying values used to check equality are not modified
  5. Equality check with null is false 

Example: Consider the following class that contains an int and the way hashCode() and equals() are overridden.

    class A
    {
        int x;
        public int setX(int x);
        {
            this.x = x;
        }
        public int getX()
        {
            return this.x;
        }
        public int hashCode()
        {
            return x;
        }
        public int equals(Object object)
        {
            boolean isEqual = true;
            if(object == null)
            {
                isEqual = false;
            }
            else if(Class.forName(object) != this.class))
            {
                isEqual = false;
            }
            else
            { 
                A compareObject = (A) object;
                if(this.x != compareObject.x)
                {
                    isEqual = false;
                }
            }
            return isEqual;
        }
    }

Verify that the rules for hashCode() and equals() are satisfied: Example:

A a,b,c,d;
a.setX(5);
b.setX(5);
c.setX(5);
d.setX(6);

Rules for hashCode():
  1. a.hashCode() will always return 5
  2. a.equals(b) is true. also, a.hashCode() and b.hashCode() return 5
  3. a.equals(d) is false (5 != 6). though a.hashCode() can be same as d.hashCode(), in our implementation they are different

Rules for equals():
  1. a.equals(a) will always return true
  2. a.equals(b) is true and b.equals(a) is true
  3. a.equals(b) is true and b.equals(c) is true and c.equals(a) is also true
  4. a.equals(b) is true as long as the 'x' value of the objects is not changed
  5. a.equals(null) is false