At this time, I would like to write about a project that I have been working on for several months. This project is based on the awesome Commander X 16 project created by YouTuber Dave Murray (The 8-bit Guy). Here are two videos where he goes into his vision for the project:
To be clear, other than being a member of the project’s Facebook group, I have no direct involvement with this project. Still, I thought it might be interesting to explore aspects of this new machine. Some ideas that came to mind were:
Documenting interesting aspects of the W65C02S processor, especially how this was different from the classic MOS TECH 6502 of years gone by. Special attention was paid to bug fixes for old problems and those quirks that still remain to frustrate the unprepared.
Creating an easy to understand memory map of the I/O page and the vital first four pages of RAM.
Writing some utility macros to ease the job of writing applications in assembly language. So far these include 16 bit utilities and enhanced branches.
Exploring interesting aspects of the design like memory mapping, bank switching, and timing.
Looking at virtual machine design as it could apply to this computer.
This has gone fairly well, but now things have been shifting about a bit. The study of virtual machines, began as a simple port of the old Apple ][ Sweet-16 soft processor. Based on information published in the May and November 1977 issues of Byte magazine, I created a port of this interpreter to the newer chip, using newer development tools.
I just couldn’t leave it there though. I then embarked on a deep dive look at the design of virtual machine interpreters from the point of view of implementation on the Commander X 16 and its W65C02S processor.
To be fair, I know that it’s gotten a bit out of hand. The scope of this effort just keeps growing. Soon, I will have to come to my senses and split the VM study off into a separate project so that the Commander X 16 part can be wrapped up.
For now, they are still together. You can see what has been written, warts and all, here on GitHub. Just remember that this is still very much… a work in progress.
There are things you don’t want to see when you review your code. Here’s one:
What’s worse, this message was hard to track down. There was no way (that I found) to have GitHub tell me about all the code that was affected. I’d have to check each one manually until I had found and fixed them all.
I had several things going for me. The alerts were all caused by one thing; the discovery of a bug in the “rake” gem. Here’s one version of the bug report I found:
It was discovered that Rake incorrectly handled certain files. An attacker could use this issue to possibly execute arbitrary commands.
USN-4295-1: Rake vulnerability
Now, in theory, one could do an in depth analysis of this bug and conclude that it has no impact on your code. I do not recommend this approach. I would not have confidence that I could see all the devious ways this fault could be exploited. Further, I know I cannot possibly predict every move by the criminals. That is why I will now focus on ensuring that my code specifies a version of rake that does not have this defect. That is we need to specify versions of rake with version greater than or equal to 12.3.3.
I write Ruby Gems and for those gems, dependencies are specified in the <gem_name>.gemspec file. Let’s see some rake dependency entries and see how they stack up to our security requirement:
spec.add_development_dependency “rake”, “~> 10.0”
This was the dependency entry that generated my alert messages. To translate into plain English, it says that any version of rake is OK, so long as it was version 10.something. The last such release was 10.5.0 which clearly has the bug and thus generates a warning. This entry clearly must be replaced.
Now many of my Ruby Gems had the following entry that did not result in a warning, but still leaves something to be desired:
spec.add_development_dependency “rake”, “~> 12.0”
This entry says to accept any version of rake so long as it was version 12.something. The last such release was 12.3.3 which is clear and free of the bug! So, yes, this is much better, but it suffers from the fact that it limits rake to version 12. Version 13 is already out and forcing the use of an older version may not be a good idea. I chose to replace these entries as well.
So, we now examine the simplest and most permissive specification:
This translates to anythings goes, but use the very latest if it’s not already installed. This is very simple, it generated no warnings, and it can get the latest. It will also settle for much older versions, including those with the bug. This too must be updated.
This is the entry recommended for use by the alert:
This translates to “Anything from 12.3.3 or later”. This ensures that we will not use older versions of (buggy) code, and that we won’t exclude newer versions of code either.
Now there may be legitimate reasons to stick to older code. I know there are working web sites using ancient versions of rails running on equally old versions of ruby. Even so, there are (too many to list here) real risks to running obsolete code. If at all possible, keep up-to-date. It may require some effort, but it is worth it. Test your code with newer versions before pushing them out into the wild. If problems/issues arise, fix them and update your dependencies. This usually can be accomplished in a modest amount of time. If it can’t then you need to lock in the obsolete code dependencies and take a serious look at re-engineering your application.
In the end, everything needs maintenance. The reason we all avoid gems that have gone many years with no updates is that we know that nobody is tending house. I was caught by surprise and it is hard to anticipate what the next disruption will be, but by defensively coding, the risk can be reduced.
Finally let me take a moment to list which of my gems needed to be updated due to this issue. If you have a current, safe version of rake installed, you need do nothing even if you are using these gems: composite_rng, connect_n_game, counted_cache, fibonacci_rng, format_engine, format_output, full_clone, full_dup, fully_freeze, in_array. insouciant, lexical_analyzer, make_gem, mini_erb, mini_readline, mini_term, mysh, parse_queue, pause_output, ruby_sscanf, safe_clone, safe_dup, test65, and vls. In addition, fOOrth, games_lessons, and rctp were updated but the changes are currently part of unreleased code.
So, while this a technically oriented blog, it is not possible to exist outside the rest of the world. In particular, the absolute chaos created by the Covid-19 pandemic. Things are not normal. Not at all. Travel is being discouraged, government services of all sorts are being closed. Shows at theaters; classes in schools; poverty in casinos; club meetings and lunches; all canceled for the foreseeable future.
It is not my intent to make another P.S.A. about what needs to be done. Anyone not living under a rock already knows. Nor do I intend to a launch a polemic on the evils of the mass mistreatment of animals that is the root cause of this catastrophe. Nope. Instead, I would like to share a memory of a freer, happier time. A distant time I like to call “Last Month”.
In Ontario, the third Monday of the month of February is designated as the Family Day holiday. On the Saturday of the preceding weekend, we get treated to the Durham DIY Showcase. What is that, you ask?
It’s a chance to look at work of local hobbyists of all sorts; an event with free admission no less. There was amateur (ham) radio, impressive model railroad setups and much more. One item that caught my eye was this amazing, wooden geared, clock:
I must admit I should have taken a lot more photographs at the event. On the bright side, at least I took this one. I suppose that while all the stuff was interesting, the clock was an amazing mix of art, engineering, and functionality.
Also present was the Durham Personal Computer User’s Club (DPCUC) of which I am a member. I really like the retro computers, Arduinos, and Raspberry (and other) PI machines. Again no pics, my bad.
Also present was a little display of gorgeous minerals. Here are the ones I purchased:
Now as I was looking over the stones and making my selections, there was a concerted effort to inform me of the mystical healing “powers” of these stones. I must admit that I sort of cut them off. I did not need anyone telling me about powers I already knew about. Like the power of things of beauty to inspire us and lift our spirits. Joy is good for the soul.
And this ends this little mini-report. This event should return next year on Family Day and hopefully this time I’ll take more pictures. Even better, maybe I will have a table of my own displaying constructions of interest. In the meantime, I think I’ve gotten my head around the mechanics of mixing text and pictures in WordPress.
Now, WASH YOUR HANDS! Did you think I wouldn’t notice? Warm water, soap, 20 seconds, now!
I’d be a liar if I didn’t admit that I have let this web site languish for a very long time. Furthermore, this is not my first attempt to raise it from the dead, even though this last quiet spell is the longest one to date.
It’s been such a long pause in fact that a lot of how WordPress works and is used have changed since the last time I wrote a blog entry. I have a lot to learn before I regain a decent level of proficiency in writing these entries. I suppose I should have the confidence to know that I will figure it all, or enough, out, eventually.
So what’s so different? What makes me think that this reboot will be any different than all the previous failures? A lot has changed: In the intervening years, I became ensnared in a “business” that devoured my time and resources and left me with little to show for it besides notebooks full of hollow slogans and ideas; I became the sole caregiver to two disabled seniors, the care of whom drained all my energy, time, and stamina; and I lost all of my immediate family and suffered, no am still suffering through a horribly painful mourning process. That pain, though crippling, is ever so slowly beginning to diminish.
Yet now, scant weeks ahead of the surging Covid-19 pandemic, I enjoyed a desperately needed vacation in Arizona with my friend Bret and his partner Adam, and their friends Joe and Roger. Two weeks without stress or care. Two weeks of vital healing. Perhaps there is light in the universe after all?
So a lot has changed. I find myself with no responsibilities beyond myself for the first time in 10 years. I have the time, and increasingly, the energy to DO something with my life again. I am slowly taking back my life and the feeling that I can affect its trajectory.
The reality remains: Talk is cheap; Content is King. So I currently have a slate of five new articles in the pipeline. I plan to post at least once a week, and more when topics are abundant. Above all, I plan to write and keep writing. This blog will bear testimony to this in the coming weeks.
I very much doubt that I have anybody left of the cadre who followed my blog. I will need to attract new followers all the while I find new and exciting blogs for me to follow. I’m back… and I have the combination! 😉
PS: I have not forgotten Rascal and Buddy, Adam’s wonderful cats! They made my stay even more special.