Originally, I was just going to create a random string generation function that avoids these characters. Easy enough to do with the way these functions are written by just removing them from the source character set. But then I stumbled across a JavaScript code that created a human-readable string along the lines of what could be used by CAPTCHA functions.

First, let us look at a string generation function that Pamoxi wrote on the RealSoftware.com forums:

Function RandomString(nStringLength As Integer, IncludeNumbers As Boolean, IncludeLowerCase As Boolean, IncludeUpperCase As Boolean, IncludeSymbols As Boolean) As String
‘ Created by pamoxi from the RealSoftware.com forums!
Dim cSource As String = “”
if IncludeNumbers = True then cSource = cSource + “1234567890″
if IncludeLowerCase = True then cSource = cSource + “abcdefghijklmnopqrstuvwxyz”
if IncludeUpperCase = True then cSource = cSource + “ABCDEFGHIJKLMNOPQRSTUVWXYZ”
if IncludeSymbols = True then cSource = cSource + “|@#~$%()=^*+[]{}-_”
Dim cRetVal, cCharacter As String
Dim nNumberOfCharacters, nStart, nX As Integer
nNumberOfCharacters = cSource.Len( )
for nX = 1 To nStringLength
  Dim oRandom as New Random
  nStart = oRandom.InRange( 1, nNumberOfCharacters )
  cCharacter = cSource.Mid( nStart, 1 )
  cRetVal = cRetVal + cCharacter
Next
return cRetVal
End Function

This function generates strings that look like this:

My original purpose was to create a shorter string that a user could reliably type in, and yet was random. I could use this as a light weight validation that the visitor wasn’t a bot of some type to my website. So I converted the JavaScript function over to RealBasic:

Function RandomStringReadable(nStringLength AS Integer) As String
‘ Created by ThePeppersStudio from http://snipperize.todayclose.com/
‘ Converted to RealBasic by Kevin Cully
DIM cConstanants AS String = “BCDFGHJKLMNPQRSTVWXYZ”
DIM cVowels AS String = “AEIOU”
Dim cRetVal, cCharacter As String = “”
DIM nStart AS Integer
DO UNTIL cRetVal.Len() >= nStringLength
  Dim oRandom as New Random
  nStart = oRandom.InRange( 1, cConstanants.Len() )
  cCharacter = cConstanants.Mid( nStart, 1 )
  cRetVal = cRetVal + cCharacter
  oRandom = New Random
  nStart = oRandom.InRange( 1, cVowels.Len() )
  cCharacter = cVowels.Mid( nStart, 1 )
  cRetVal = cRetVal + cCharacter
LOOP
return cRetVal
End Function

And here is what the output looks like when I ask for a readable random string of 20 characters:

Even when I’m including the characters of what I thought was ambiguous, the human mind is able to identify the pattern and accurately enter the string. The output of this function is superior in readability to most CAPTCHA images. That might be on purpose. Of course it helps eliminating the numbers, including the zero. I hope you find this useful.

Over the years and years of my career, I think I’ve made every mistake possible, at some point. We’re going to talk about how to improve our practices in storing user passwords, by looking at various approaches that start to approach better practices.

Remember that security is a process, not a destination.

Here’s the old way of doing things. Storing the usernames and passwords in the same table, in clear text. If someone hacked your system, they’d have access to your system and it is possible that you’d never know what data was compromised. Don’t do this anymore. As of today, you know better.

Notice that you have the typical users that are using the absolute worst passwords ever conceived. This should send a shudder down your back. Another security procedure, is to not allow your users to use the most popular passwords.

Storing Passwords As Hashed Values

Thanks to Gilles Patrick, we have a native VFP access to the MD5 hashing process. Let us take our first small step. The difference between encryption and hashing, is that you can’t get the original values back from a hashed value. The hashed value just is a unique representation of a string no matter if that string is long or short.

In this adjustment to our original table, we have the hashed value of the password. We could then drop the password field. To log in users, we would find the user record, and see if the hashed value of the password entered on the login form, matches the hashed value stored in the table. If so, let the user in.


oMD5.tohash = c_User2.cpassword
REPLACE cmd5 WITH oMD5.Compute()


While this approach is a small bit better than storing passwords in the clear, it isn’t a good approach. The problem is that there is such a thing as rainbow tables. You can go out on the Intertubes and download a rainbow table of MD5 values and their corresponding passwords. This is the way to back into the passwords. Not only that, but you can test all of the passwords in a single pass. (More on this later.)

Hashing Passwords with Multiple Passes

So if storing passwords as hashed values is bad, can we improve things by making multiple passes? Yes, it’s better. In the example code, I hash the password, and then hash the hash value.

lcPassword = c_User3.cPassword
FOR lnX = 1 TO 3
  oMD5.tohash = lcPassword
  lcPassword = oMD5.Compute()
ENDFOR
REPLACE cmd5x3 WITH lcPassword


Notice that this approach makes it more difficult to use a rainbow table. You’d need a rainbow table that has values that have the exact same number of iterative loops. Also note, that you can always INCREASE the number of loops at any time and still retain the efficacy of the stored passwords. You can increase the number of loops from 3 to 6 or 60, just by replacing the passwords with the hashed value of nNewLoopValue – nOldLoopValue. (Example: 60 – 3)

This approach still isn’t satisfactory. You can still test against the entire database in one pass. It’s possible that there are rainbow tables that have your iteration values. We can still do better.

Storing Passwords With Salted Hashes

A ‘salt’ is introducing a value in addition to the original password. This salt value is unknown to the user. In fact, the user does not need to know the salt. It helps protect the passwords on the back end of the database. So, if a user has the awful password of “Password123″, then the salted value could be “AFUG” + “Password123″ or “Password123″ + “AFUG”.


lcPassword = lcSalt + c_User4.cPassword
FOR lnX = 1 TO 3
  oMD5.tohash = lcSalt + lcPassword
  lcPassword = oMD5.Compute()
ENDFOR
REPLACE cmd5Salt WITH lcPassword


Note that if you feel that your database was compromised, you could change your salt, zero out all passwords thus forcing all users to enter a new password, hopefully re-securing your user table and system. At this point, you can start to feel more confident that you are safer from rainbow tables, however hackers can still attack the entire user table in one pass.

Unique salts per user, passwords stored in external table

What if we used a different salt per user? … plus a system wide salt? With the multiple passes?


lcPassword = c_User5.cSalt + c_User5.cPassword
FOR lnX = 1 TO 3
  oMD5.tohash = c_User5.cSalt + lcPassword
  lcPassword = oMD5.Compute()
ENDFOR
INSERT INTO c_User5Password ( cMD5Salted, tLastUsed ) VALUES ( lcPassword, DATETIME() )


In addition to the above code, we don’t need to store the hashed value in the user table! If the hashed value is unique, there is no need to store it with the user values. We can then test the userid, get the salt, loop through the multiple hashed values, and then see if the result is stored in the hashed value tables. If the value exists after that process, then we have a good match between the user and password.

Oh yeah, don’t use MD5!

I used MD5 all over the examples because we have access to MD5 natively as VFP code. However, the MD5 process is too FAST! Hackers can make thousands of MD5 computations per second and attack your database faster and faster as computers get faster. There are other hashing techniques that are SLOWER, not GPU optimizable, and thus are more resistant to hacking attempts. Some of these approaches are BCRYPT and SCRYPT. There are plugins that can be purchased and integrated into your application. Also note that PHP (and others) have slower hashing approaches available to them, and thus is callable from within a VFP application to a PHP page that gets the hashed value back. (over SSL of course!)

Conclusion

While this post just scratches the surface of security, as a programmer it is time to make sure that we are taking advantage of the leading best practices of our day. If you refactor an old VFP application, take the time to update it’s security password mechanism. Use better practices.

lcHTML = MyTable.MyMemoFieldWithHTML
lcHTML = RemoveHTMLTag( lcHTML, "<font", [<span class="qs-bold-12-blue">] )
lcHTML = RemoveHTMLTag( lcHTML, "</font", "</span>" )
lcHTML = RemoveHTMLTag( lcHTML, "<strong", "" )
lcHTML = RemoveHTMLTag( lcHTML, "</strong", "" )

*!**********************************
*!* Program: RemoveHTMLTag
*!* Author: CULLY Technologies, LLC
*!* Date: 12/10/12 08:30:30 PM
*!* Copyright:
*!* Description:
*!* Revision Information:
FUNCTION RemoveHTMLTag( lcHTML, lcTag, lcReplacement )
lcHTMLSource = lcHTML
nTagCount = OCCURS( lcTag, lcHTMLSource )
nNewTagCount = nTagCount
DO WHILE nTagCount > 0
nOpenLoc = AT(lcTag, lcHTMLSource )
lcTemp = SUBSTR( lcHTMLSource, nOpenLoc+1 )
nCloseLoc = AT(">", lcTemp ) + nOpenLoc + 1
cTextToRemove = SUBSTR( lcHTMLSource, nOpenLoc, nCloseLoc - nOpenLoc )
lcHTMLSource = STRTRAN( lcHTMLSource, cTextToRemove, lcReplacement )
nNewTagCount = OCCURS( lcTag, lcHTMLSource )
IF nNewTagCount = nTagCount && We're making sure we're still removing tags and that the HTML isn't invalid which would create an endless loop.
SET STEP ON
EXIT
ENDIF
nTagCount = nNewTagCount
ENDDO
RETURN lcHTMLSource

I hope this helps someone out.

Here’s an update to the ‘Visual Foxpro to Real Studio Converter’. I’ve just released version 0.2Beta.

There are numerous updates including:

• The Real Studio project now properly identifies the forms as belonging to the project.
• More controls are converted such as the Option Groups and Image Controls
• The method code for the forms and command buttons are converted into the Real Studio Windows, but are commented out. This should make it so you can manually convert your code into RealBasic.
• The project is now under the MIT license which is very open and friendly.

I hope that you find the project interesting, and … helpful! If you make enhancements, or find a bug, just let me know.

I hope that you find Real Studio as easy and fun to develop in as I do.

-Kevin

One of the technologies that I’m moving to is Real Studio (RealBasic) by Real Software Inc., located in Austin, TX, USA. The joy and productivity that I had in VFP, I find in RS. Did I mention that it’s cross platform: Linux, Mac and Windows! There’s even a web edition!

Anyway, wouldn’t you wish that there was a utility to convert your VFP forms over to Real Studio? Well wish no more! Take a look.

Still here? Okay, lets look at the pros and cons:

PROS:

1. Converts your forms over from VFP to RS
2. Keeps the controls naming convention
3. The converter is free to use!
4. The converter is open sourced in that if there is a bug you could even fix it yourself and keep going!

Cons:

1. Not all controls are supported just yet.
2. Only converts forms; no reports, labels, menus, classes, programs
3. None of the method or even code code is converted
4. Not tested on heavily subclassed forms
5. Doesn’t make you taller or better looking
6. Who the hell is Kevin Cully anyway?

Well anyway, I do really like Real Studio and I hope you find this converter interesting. If you find a bug or need an enhancement, please drop me a line. It helps to incentivize me if you would tell me how this would make the world a better place for you. If you find (and fix) a bug or make an enhancement, let me know and give back! We can make version 0.2beta even better!

Download the VFPtoRS source code here! Version 0.1beta [60k]

Oh yes, I’m also speaking at the Real World Conference in May 2012 in Orlando. Come on down and learn more about Real Studio! If you are a VFP developer, I think you’ll like using it as a development platform as much as I do.

Thanks everyone!

I’m about to make a change to my A/V setup inside of my house. I was curious about how this would affect my power consumption. Out comes my Kill A WATT and I roll up my sleeve and go to work.

First, lets take a look at the TV just for comparison purposes. I’ve got a Vizio 47″ LCD TV.

Powered Off: 0.0a; 0.0w
On w no video feed blue screen: 1.7a; 209w
On to cable news show: 1.5a; 185w

I have a HTPC (Home Theater PC) that is an old Hewlett Packard business type PC. Not a video game setup but also not designed for low power. So without further ado, here’s the power consumption for comparison purposes:

Powered Off: 0.0a; 0.0w
On but not doing anything: 0.9a; 102w
On and playing a movie: 1.0a; 114w

So, what I’m going to be retiring soon is one of the two satellite providers. This is NOT an HD DVR, but it does have two tuners. These DVRs are famous for using a lot of power so I was curious about its consumption.

Powered Off: 0.4a; 31w
Powered on: 0.4a; 32w
Recording 1 show: 0.4a; 32w
Recording 2 shows: 0.4a; 32w

Interesting results here but not that surprising. If you think about it, this DVR is recording shows all the time but throwing the show away if I’m not setting it to record. I think this is why the power consumption is not that different from when it is ‘asleep’ and when it is recording shows including two shows at once.

So, lets take a look at the Boxee power consumption. I’ve got the Boxee Live TV USB dongle to let me play OTA (Over The Air) shows. Also, on that system, I’ll be playing shows over the Internet and via Netflix.

Powered Off: 0.0a; 0.0w
Powered On w Live TV USB: 0.2a; 13w
Powered On w/o Live TV USB: 0.2a; 13w
Sleep w/o Live TV USB: 0.2a; 11w
Sleep w Live TV USB: 0.2a; 13w
Playing Netflix show: 0.2a; 11w
Playing Internet show: 0.2a; 12w

There you go. The Boxee Box is quite conservative with power consumption. I’d guess that since this box is so quiet. There is some sort of fan, but it must be very small. The satellite DVR uses twice the power as the Boxee Box but that’s not too bad considering that it’s spinning a physical hard drive in the box, plus the fan. My HTPC is the pig in the story, but it also wasn’t designed to be low power.

The cost per year for these systems is very low, but I thought it would be a very interesting comparison to make. Bottom line, the TV is the big pig of this group.

On September 22nd, Google is updating their requirements for the feed they accept for their Merchant accounts. We were successfully uploading over 6,000 items into their feeds previously and I needed to check that our feed would be accepted.

Luckily for me, Google recently added the ability to ‘test’ the data feed. I tried our old feed: 0 (zero) items imported. After taking a closer look at the new requirements, basically there was a re-arranging of the deck chairs. I created a new data feed, with new captions and a couple of their new required fields. Still 0 (zero) items imported.

After scaling down my test from 6,000+ items to 10, I was able to quickly turn test iterations around and found the simple solution to get the import to work. The past data feed required double quotes around strings in their TAB delimited format. This new format requires that there not be any double quotes at all. Basically the TAB character does all delineation between fields. Make sure that none of your fields include a TAB character in any of the strings or you’ll lose that record on the import.

Simple solution but it took me a small bit to figure out the difference from the old feed to the new one. I hope this post saves you a few minutes as well.

No graphics show in Real Studio IDE on Ubuntu 11.04

A small problem however. No graphic images show up in the Real Studio interface. I switched Ubuntu back to GNOME classic thinking it may have been the Unity interface causing the problem. No good. The images in the IDE still were not showing up. Perhaps it was because I did an “Upgrade” from 10.10 to 11.04.

This upgrade takes a LOOOONG time because of the download time to get all of those files. I recommend doing a fresh install of Ubuntu. By downloading using a torrent, the ISO comes down in minutes. Install onto a flash drive and an install takes about 30 minutes total. With the upgrade route, you’re looking at a couple of hours.

I did a fresh install of 11.04 and still no good. I did a fresh install of 10.10 and … the images were there. I liked GNOME better than the current Unity interface anyway.

Please don’t think I’m bad mouthing Real Studio. William Yu responded quickly to my posting on the forum and they’ll be looking into it and will probably have it corrected for Real Studio 2011 release 2. Especially if I help them test in the next beta cycle. Yup, I can be of help for the issues that affect me. This is a situation where the rapid release cycle, and an open beta-testing program really helps.

This issues, I’m sure are a small one. Probably having to do somehow with the internal representation of pathing to the graphics that appear in the IDE. Straighten that out and Real Studio is back in business. In the mean time, hold off on upgrading to Ubuntu 11.04 if you do development in Linux until the next release.

I received an email from them describing the World Archives Memory Project.

The World Memory Project uses software and processes developed by the Ancestry World Archives Project, an established community that has spent years helping to preserve historical documents and make them available online for free.
It starts with the United States Holocaust Memorial Museum creating digital images of historical documents. Then, using special software developed by Ancestry.com, contributors like you help make these documents searchable online by typing or “keying” information from the digital images into a database.

Cool. I love to give back. I’d love to be able to help others research their forefathers, especially when it will be made available for free. I’m a good typist and I can code tags or whatever is needed. I’m ready to sign up and get more information on what I need to do…

The software is Windows only. Dang. Really? This is 2011. They describe that Mac users need to run this in a Virtual Machine. I’m a big Linux user and I could do the same thing but … dang. I know they’ve just lost a *LOT* of their contributors right there! A good number of their potential customers won’t know what a virtual machine is, even though Parallels is pretty easy.

I was hoping to be able to type in the information in OpenOffice (Libre Office) and then paste it into a web form, or even use some sort of AJAXy web application to enter the information. If I’ve got to start up a Virtual Machine, and probably one just to install this software on, and *then* hope it submits correctly to their service, well, that’s too much work.

I’m disappointed. I was hoping to be able to help some people out but I’m thinking this is too much work now. I’ve got a business to run, and I already volunteer a lot of my time to charity. I’m sorry customers of World Archives Project! It’s a darn shame.

notify-send -t 10 "Header" "Body"

After Googling around for a while, I ran across a message board confirming what I was suspecting. Evidently this has been the behavior since 2009 at least and people are asking for a change in the documentation.

I would agree that the documentation should be changed to reflect the current state of the command. I’m a bit sad that this change has been needed for several years now and someone hasn’t been able to get the change in the documentation, or better yet, change the command so the notification timeout is honored.

I hope this helps someone else confirm this behavior more quickly than I was able.