Evolution of a Programmer
chekout this link.. this one's nice :) stumbled across it while lookin for some dev stuff..
http://weblogs.asp.net/israelio/archive/2004/08/31/223443.aspx

alternate links: http://www.icarus.net/johnjo/evolutio.htm
http://www.ariel.com.au/jokes/The_Evolution_of_a_Programmer.html

Movies in my To-Watch list
Over the Hedge
over the hedge, it's all food ;) the trailer, I just loved it.. it's funny.. great piece of animation.. expression of every character carefully crafted. environments beautifully made.. it's funny to see Steve Caroll burpin the ABCs :)) can't wait to see it.. but the only problem is, I've to suppress my excitement for now coz itz gonna be a while before I can see it.. releasing May 06 :(

Harry Potter and The Goblet of Fire
Releasing Nov 14. The trailer was pretty impressive. based on book and the trailer, seems like the movie's gonna be awesome.. Voldermort er.. sorry, you know who's gonna return in this one taking a proper form. so it's gonna be interesting.. unlike the previous movie (Harry Potter and The Prisoner of Azkaban), which was VERY poorly made, I guess this one's gonna rock.. might turn out to be the best in the series.. that's what I feel, but there's every possibility that I might go utterly wrong..

Corpse Bride
[a grave misunderstanding ;) ]
liked the trailer. tho the trailer wasn't all that funny, the concept of a Corpse Bride tickles my funny bones. I'm goin for it.. [particularly coz I love anmation :D] btw I dint know its already out! I dont follow movies much :(

Sin City
[walk down the right back alley in sin city... and you can find anythin]
haven't read the comic.. but glanced over a few pages sometime.. from the trailer, the movie has the same feel as the comic and 's nice. gotta see it.. it's already out.. but guess it's not bein played anywhere right now.. gotta find a VCD or somethin..

Doom
[if it breathes, ... kill it]
I'm plannin to watch this movie for the sole reason that I played the game (it's a different thing that I never got time to finish it.. psst.. in fact it scared the hell out of me.. that was one of the reasons why I dropped it halfway :D ) but otherwise, might not be a good idea to waste time on this movie.. the trailer feels a lot like Resident Evil to me.. xcept that the hunting is on Mars, I dont see much difference b/w them.. both r a lil sci-fi plus insane (I mean insane) action and huge monsters.. I'll give it to doom when it comes to the scary factor of the monsters.. might be a coincidence, but a similarity I couldn't help noticing was the Hell Knight (Doom) looks a lot like the Nemesis (Resident Evil) and the Imp (Doom) looks a lot like one of the huge monsters that appears in Resident Evil (I movie) towards the end of the movie when they're about to leave the underground..

Chicken Little
[some heroes are born great.. others have greatness, dropped upon them :)) ]
the sky is faling and our hero is out to save the planet. . . . . can he make it? I know the answer [provided i know the question;)] it seems interesting tho.. cant quite say the animation is excellent or anythin such, but well, it remains to be seen ;) I've just seen the trailer.. I'm goin for it..

Young, younger, youngest...
yesterday there was a lil discussion about my age.. people seem to find it surprising that I'm still 20.. well, I'm used to it.. wherever I go, beginning from my school till here, I usually end up being the youngest among my batchmates. and that is because I was born on 23rd Dec, 1984 while most of my friends' DOB falls in the range of mid 1982 - mid 1984. so when all my friends are 21-22, I'm always a year younger :)

here's a nice snippet of code that shows my current age.. if you find any bugs, blame the guys (/gals) at http://www.mathcats.com/explore/agecalculator.html.
and if you think the snippet is cool, you can appreciate my code scraping and refactoring skills :)

hover your mouse over this text area (or click on it) to find how just long have I been on this planet (ignoring all 'out of the world' voyages, just out of my noble intention to keep the code simple ;) )

[for some stupid reason, this works only in IE but not in FireFox (while I xpected it to be the other way around :( perhaps I shud giv a lil more time to the script]



[P.S. still lookin to find some code in the post?!]

Take my inn-sewer-ants, this book is worth a read..

This's about "The Colour of Magic" by Terry Pratchett. his first in the Discworld series. it's a pretty good read, with his Discworld and it's (lunatic? weird?) inhabitants.. read it about a week back, and became a Pratchett fan with it.. some people said it's not one of the Pratchett's best.. but I liked it, and am waiting to read his best.. and expectations of course are high.. right now I was reading "The Wyrd Sisters" - 6th novel in the Discworld series, but feel like it's not as good as the first one.. But considering that I'm still about halfway (and the fickle mind that I'm), I expect my opinion to change soon..

basically it's fantasy, with lots of humour in the way Pratchett chooses to express certain things.. It gets funny when Pratchett uses certain words in pretty foreign and disconnected way (inn-sewer-ants). And it's funny whenever there's Twoflower - carefree, curious and maybe a Tourist (a.k.a Stupid when translated to the local lingo of the city of Ankh-Morpork) It's funny when Rincewind (a wizard of sorts) is scared, or is baffled by the stupidity of Twoflower (he's a tourist after all) It gets really funny whenever Twoflower's luggage - a box made of Sapient Pearwood - comes into the scene making funny expressions (which in fact are scary for the people inside the story.. it's just that you're safe outside as a reader). and btw, Sapient Pearwood is believed to follow it's master ANYWHERE he goes.. even to death ;)

it's funny to see the Discworld gods playing a dice game (and cheating in that).. so is it to see the frustration of Death and Fate.. I can go on listing (and have half the novel out here, which definitely isn't good).

One of the pretty funny snippets I can remember goes something like this..
Rincewind begins to hear voices in his head.. he thinks "I'm going out of my mind".. and the voice replies, "That's good. It's getting very crowded in here"
Not a particularly funny snippet as such, unless you read it with the flow of the story..

Some snaps taken from my new Samsung X620 phone


Attempt to capture the Sun towards evening.. but not really during sunset


Some photogenic jungle bells


A flower (thought that aint obvious ;) )


One more..


Trying to be a little kanjoos about the resolution here coz I thought interfacing with my PC is hard. But it turned out to be really easy since my laptop had IrDA :). No more worrying about the image size..

And here's why you should avoid digital zoom, if possible..
Two of the otherwise nice snaps spoiled by my excitement to tryout the zoom :D
[psst.. I heard noob photographers tend to use zoom a lot ;) ]

Btw, all these photos were taken during my last visit to my native (which was yesterday ;) [15/10/2005])

my (short term?) laptop
well, last week I got a new laptop from my company. when they first told us of its specs, I thought it was a cheap crap, and good for nothing. but after having it, i feel its not all that bad. in fact its pretty good! [particularly after seeing Napster use a Dell in The Italian Job :)) ] its a Dell Latitude D505. has a 1.8GHz Pentium Mobile, 512MB RAM and a 40G HD. comes with 3 n/w interfaces! one is the regular one. one is IEEE 1394 (FireWire) and the other is Wireless. all Intel chipset, onboard things. tho I had to try a little hard to convince my Whoppix that there's a wireless interface ;)
now that I heard I can no more use this laptop coz I'm movin to client side and I'm not allowed to connect my 'personal' machine to client network. yea, I agree. they're stupid. if I really wanna steal, I can do it anyway, with or without a laptop, and irrespective of the monitors they use. I hate these people when they get paranoid and do things which just don't make sense!
fine.. now that I might have to gie back my laptop (coz I can't use it anyway), I thought of listing out the first things I did on this laptop :)

First song played: Eiffel65 - I'm Blue
First movie played: X-Files
First game installed: Painkiller
First game that failed to run: Painkiller ;)
First game to successfully run: UT2004 (runs pretty smooth)
First linux distro installed: Yoper
First site visited: yahoomail/gmail/orkut
First application (I) installed: IDA Pro 4.8 (or rather copied and ran)
First application to run: Lotus Notes (bad!) / WMP


(I'll add others as and when I remember) ;)

a little navodaya nostalgia
manju's mail on the teacher's day brings back the old memories. all the fun we had, all the stupid stunts we used to do, all the friends, all the enemies, all the teachers ... ah! it was so good... wish I could live that life again

I remember I took rampa's role on teacher's day (being his pet). well, I don't seem to remember his actual name now. but that's what he was called ;) I took the physics class for the XI std guys.. don't remember exactly what. but it had something to do with some springs.. or rather ropes...

it was my first time taking a class.. (so was it for everyone else). if it were some other time, I'd have been very nervous. but moving around the stage everyday during assembly or functions had filled in a little courage in me to face the people.. (yeah. the 'mic set guys' - me, sidda and EP being the third one usually, tho others used to butt in at times ;) )

oh yeah! I remember what I taught them, or rather thought I did ;) it was some part of "Waves and something I can't remember" well, I never studied in XI std. so I don't remember the chapter name. and the funny thing was I was gonna teach them something I've never learned myself! I thought of making the class a little interesting by demonstrating the wave transmission with the ropes example that was there in the book. But couldn't get the proper rope and the class ended up being just some boring mathematics.

I remember that was when I actually understood functions. I never understood what it exactly means by saying something is a function of something. i.e. I never really understood what does it mean by f(x). it was for taking this class that I first attempted to understand it! well, it was good understanding it and explaining all the mathematics to the class.

everything went fine, I came out of the class. I had only one period to take coz I said I become nervous on stage.. (tho they were my juniors) so manja assigned only 1 period for me. someone else took Physics for other classes. finally I asked one of the XI guys (divyananda perhaps) how did he like the class. he said the class was very good. well, I myself never thought it was good coz I dint do the demo with ropes. but well, all is well that ends well isn't it? so I thought its okay id he says he liked it. but well, he continued to say, many of us dint understand much of what you taught, coz the relevant basics haven't been covered in any of the prev classes. uh! what?! i should've asked one of them before I chose a topic to teach. I just chose something I found interesting at that time. I felt so stupid..

all the memories of everyone.. all the events that happened... now it makes me laugh. sometimes I was so stupid! and how we fought over the 'mic set'.

though I always used to do bad comments on navodaya, till about my X std, I like the place. though I never really realized it while I was there, it's a great place to be. (particularly if you become a pet of some teachers ;) )
it is the place that has made me, and all of us who were there, the people who we are now..

should definitely make time to attend the alumni this time..

What is Love?

Definitely not something i can define :( But why did this question pop up now?!
Something reminded me of the day I proposed her... for the second time! The memories of it used to be pretty hurting earlier. Slowly they turned out to be a little embarassing to myself. Coz I felt all that I did was pure nonsense and stupid. Now they seem a little funny. Like preserved records of my craziness. Make me laugh at myself.

The propossal kinda went like this.

I call her up. She already kind of knows why I called her since I just sent her a msg asking can I speak to u now? Stupid, isn't it? To ask someone if I can call her? well.. its not a secret that I'm stupid. anyways, she picks up the call and asks me "what?" I'm kinda nervous and dont say anythin for a while. She says dont be nervous. But I already am nervous! can't help it.
K.. I start something like.. you know I love you. She says something like: yea.. but what do you mean by u love me? I definitely didn't expect this, though I shud have. fine.. I say I feel like I can do anything for her but I don't feel the same for anyone else. She asks me: what so you mean by you can do anything for me?"
well.. it's true that I feel like that. but I myself dunno what it is! crap.. so I say, "I dunno. mybe that's not true. but I just feel like that." Such a stupid answer isn't it?
I say I miss her all the time she isn't around. So I cant concentrate on anything and blah blah... She asks me "why? we didn't interact much. its understandable if someone misses a person with whom he interacts regularly. but why do you miss me?" hmm.. I kno she's a lot brainy than I'm. But shud she ask all these questions? well, it's tough to answer many questions, particularly when u r nervous.
I try to explain her how I feel about her. But well, I rarely speak. And if I speak, it's usally some technical stuff that I can easily bluff about. which doesn't use up my brain cycles for thinking. now imagine how horrible I'd be putting into words some feelings that can only be felt by myself! .. that's what happened. she said, I don't understand ur feelings. I'dn't blame her for not understanding. coz I know the connection between my mind and my voice is screwed up ;) As a matter of fact, I can't remember a single instance where I was sucessful at explaining anything to anyone.
So it goes on for a little while. I knew her answer already. A simple NO. I knew I cant take that answer easy. A little sensitive stupid that I'm. I knew the answer, I knew it'd hurt me. but still I dared asking! not to say I'm courageous. but to say that it shows how stupid I was (or am!). K.. so it did end on a bad note :((
But after that I'm left with a lot of questions. The most important being What the hell is love? I still don't know the answer. In fact I began to doubt if it's really love. I even tried to convince myself that its not love but haven't been sucessful in that either :( I kept asking myself the question for about a week hoping to find an answer, but in vain. And I still don't know what's that 'anything' I was ready to do for her. :D
I initially thought I can somehow invoke the genius inside me to find answer for all these questions and get back to her with some good answers. But after two weeks, my brain returns me a NoGeniusFoundException. I shud have expected that too. But well.. finally I gave up trying to find any answers that might be lurking somewhere around.. ;)
I once used to think that Love made me stupid. Well, now I kno stupidity resides in my DNA and so I've learnt that I shud accept that. At least until a few years when all the science fictions become true and I'd be able to mutate myself ;)

Okay, back to the initial question of What is Love. Not that I know the answer. But now that the level of my craziness has come down a notch and that I've a little free time now (its a Saturday after all), I thought why not try again to find the hidden answers lurking around. And I found something that's closer to an answer, but not satisfactory. At least not to me.
Looking back at my past behaviour, and assuming it was really Love, "I'd say it's Love when you like someone for a reason that either doesn't exist or you don't know. It's when you like someone unconditionally and ideally without any expectations."
I say ideally coz I don't think mine was ideal coz I expected her to be in love with me, though I knew very well that me loving someone doesn't neccessarily mean the other way around. Setting expectations on anything does hurt when the expectations go awry. Particularly to someone hypersensitive like me. Or rather a stupid like me who expects everything to go as per his expectations.
Fine.. all of this definition and all the philosophy was assuming I was really in love. I'm trying to convince myself otherwise, but haven't been successful yet, though it's been long since this happened. Well.. 2 months becomes pretty long when things get screwed up to the extent that you're no more in speaking terms with the one you love the most. ;)
K.. what if you find out later that I wasn't in love? Well.. the definition still holds good, but the LHS should be changed to craziness. This definition would then be for craziness and remeber to watchout for these symptoms, or you might end up in a lunatic assylum ;)

K.. will be back here with a more sensible topic (technical I mean) :)

SQL Injection Attacks

This blog is gonna be about SQL injection attacks. I used to think almost everyone knows about this and there's no place where this might work. But recently (today, 19-04-2005) found a stupid site that blew up with SQL injection. So here's something on secure design with SQL.

SQL injection attack as the name says, basically involves injecting SQL snippet into some SQL statement. How to do it?

Well, if u r from VTU Comp. Science u might have done some Database application (or flicked one ) in 5th / 6th sem. Even otherwise, hope u have created/worked with some database application sometime. Most applications have a layer of so called SECURITY () which requires one to login with a userID and password to use the application. It's usual to have at least two categories of users as I've seen -the administrators and the other users. Security checks for the administrators are ususally more than for normal users.
How is the user authenticated? U get the userID into some textbox and get the password in a corresponding password box. Then u compare the (ID, password) pair against a database table with a statement that ususally goes like:
SELECT * FROM authenticated WHERE username =' value in username textbox' AND password = 'password textbox'

Usually usernames are unique, which means the above query returns either One record or None. So if the query successfully returns a record, the user is authenticated, otherwise not. Some people replace the '*' in the SQL to something like username or something else. i.e like:
SELECT credentials FROM authenticated WHERE username = 'value in username textbox' AND password = 'password textbox'
But this doesn't make any difference as long as you don't use the returned data for further authentication. But I've not seen many doing that. So all this was a brief intro to a typical authentication scenario.

Now I'll give u the example of a stupid SECURE page that was supposed to be opened by the ADMINs, but gave access to me even though I didn't know any userID for that.
Today I recieved a link from my friend which had a really good collection of Java e-Books for free download. The link was: http://dimpon.plus.ru/javabooks/ (Probably itz an illegal collection. But I'm not sure). I downloaded some books. Then I thought maybe the site has collection of other books too. But there were no links. So I just tried to explore around the site and landed in the admins section. (It was a very short exploration though). And as u might guess, it required me to know some stupid admin userID and of course the password, which I didn't have.

I thought why not try SQL injection? I never expected it to work anywhere (with the exception of the stupid DB applications submitted as mini projects ). But don't know which stupid did that app, it did work! I put in the login id as [ ' OR TRUE OR ' ] (excluding square brackets) and the same for the password. My expectation was to have the final SQL delivered to the server as:
SELECT FROM WHERE username=' ' OR TRUE OR ' ' AND password=' 'OR TRUE OR ' '
[i.e. the SQL in userID and password boxes is substituted in place of the placeholders in original SQL statements]

This is one of my favourite SQL injections. But it didn't work as expected for a lot of reasons. (Brush up ur SQL knwledge and figure out why ). But the stupid app puked out a much detailed info. It went to a php file (http://dimpon.plus.ru/admin/in.php) which eventually spat out an error message:
Couldn't execute SQL query!SELECT admin_id,is_su FROM admin WHERE login=' ' OR TRUE OR ' ' AND pass=' ' OR TRUE OR ' '

It's usual to have the application put out such detailed error messages when u r developing it (when u ususally run it in the debug mode), but never in a deployed application. Anyone can easily figure out how to proceed from here on. It's so detailed! Lesson to learn, never be verbose about the errors/exceptions ur application throws, at least not with the user.

So I just modified my input. My new login id was 'fool' (without quotes) and my password was:
' or login like '%
(with quotes)
Hence the final SQL constructed should be:
SELECT admin_id,is_su FROM admin WHERE login='fool' AND pass='' or login like '%'
which I know will return all the records. It seems the developer actually expected one login to return a lot of records. That's why he never made a check that only one record should be returned . He could have made my life a little more difficult by making that check, in which case I'd have to guess at least one valid username (thats quite easy too). But he never bothered to. I still don't understand what he did with the admin_id, is_su that he got from the query.

Okay, there was one thing that I felt bad about. The damn page was in some weird language (Couldn't figure out even after using Google Translator), with traces of english somewhere. So it was pretty much useless for me. The structure of the page gave a feeling as if it provided facility to add some users and add some content (wiki kind of thing?). So that's pretty much useless. The only thing I felt good was I cracked this without much efforts.

How to survive SQL injection?
Well, that's actually quite simple. Follow the well known rule. Never trust your user. Never trust user inputs. It can be anything stupid. So just validate user input everytime you get it and particularly before passing it to your SQL.

One solution to this would be checking user input for the existence of non alphanumeric characters. That's the simplest solution, provided you don't allow your user input to have special characters like spaces.

But what if you decide to allow your user to have spaces etc... in his password? Most of the popular sites provide this. (Yahoo!, Google etc...) One solution for this situation wouls be to hex encode the user input as is done with URLs. i.e. replacing spcial characters in the input by their hex value. A space gets replaced by and so on... This is very easy to do and is very effective.

But finally, the manthra to keep your application secure is to never trust the user inputs.

ha! my first entry in Blogger. Nothin better to write right now. 'll be back soon.