DEV Community: Mustafa Unal

C/CPP and the NISTIR 8397 Standard, Minimum Verification Tests for Cybersecurity

Mustafa Unal — Sat, 17 Sep 2022 02:14:19 +0000

I’m a fan of Herb Sutter. He is a wonderful teacher and information sharer. During CPPCon 2022 talk (which you must listen) he said something that I’ve never heard before. A presidential directive which discourage usage of C/C++. So I find it, Executive Order (EO) 14028, Improving the Nation’s Cybersecurity, 12 May 2021 signed by US president Joe Biden. In it National Institute of Standards and Technology (NIST) was directed to recommend minimum standards for software testing with in 60 days and NIST developed NISTIR 8397, Guidelines on Minimum Standards for Developer Verification of Software.
In this standard They recommend the following eleven todo list:

Threat modeling to look for design-level security issues
Automated testing for consistency and to minimize human effort
Static code scanning to look for top bugs
Heuristic tools to look for possible hardcoded secrets
Use of built-in checks and protections
“Black box” test cases
Code-based structural test cases
Historical test cases
Fuzzing
Web app scanners, if applicable
Address included code (libraries, packages, services)

NIST consulted National Security Agency (NSA) while developing it. So they get the best help they can get. It’s a pretty good list. In fact your code should have already been tested with them. But this is another story.
So what all of this has to do with C and C++ ? In Section 3.2 Supplemental: Memory-Safe Compilation C and C++ is directly referenced.

3.2 Supplemental: Memory-Safe Compilation
Some languages, such as C and C++, are not memory-safe. A minor memory access error can lead to vulnerabilities such as privilege escalation, denial of service, data corruption or exfiltration of data.
Many languages are memory-safe by default but have mechanisms to disable those safeties when needed, e.g., for critical performance requirements. Where practical, use memory-safe languages and limit disabling memory safety mechanisms.
For software written languages that are not memory-safe, consider using automated source code transformations or compiler techniques that enforce memory safety.

What this means is, you are actively encouraged not to use C/C++. Every firm that have a contract with government or regulated, will act accordingly. In the future one can expect the "Where practical" changed to "Must". And I think I’m not the only one that will predict in the future a change like this will happen.
Any good news? Herb Sutter show a new leaner C++ compiler with new syntax that has security features by default as an experiment. All hope is not lost, yet.

The standard is at https://doi.org/10.6028/NIST.IR.8397

Cover photo:(U.S. Air Force photo/Senior Airman Timothy Taylor)

Learn From The Masters: How To Kill Productivity with OSS, precursor to CIA

Mustafa Unal — Fri, 16 Sep 2022 16:08:49 +0000

Productivity is a what you expect from from every organization. In his latest interview Google CEO Sundar Pichai told reporters 'Productivity as a Whole Is Not Where It Needs to Be' so everybody loves productivity and pushes for it. But what is productivity have to do with CIA you might ask. It has a lot to do with spy agency.
During World War 2 when axis powers invaded a large part of Europe, one of their aims is to use captured areas industrial might for their war machine. Of course, workers do whatever they can do to sabotage their own factory. But they are walking on a thin red line. If they were caught, they would be shot. If they do too much, they would be helping invaders. OSS the precursor to CIA write a manual in 1944 which was declassified in 2008 to do just that slowly killing productivity without anyone noticing it.
Simple Sabotage Field Manual is an handbook of anti-pattern for productivity. It includes parts for coal, transportation, telegraph etc. For software developers the interesting part is the part on how to kill your organizations productivity in subtle way so that although you seem to work, you most definitely not. Here are the tips.

Insist on doing everything through "channels." Never permit short-cuts to be taken in order to expedite decisions.

“I won’t tell you if it’s possible or not. You have to open a Jira Ticket. And let me check.” Sounds familiar ? The people you are asking knows it, you know the person you are asking knows it. But refused to share it because it will be a cross department information leakage. And nobody likes a snitch.

Make "speeches." Talk as frequently as possible and at great length. Illustrate your "points" by long anecdotes and accounts of personal experiences.

You felt the disturbance in the force. You make eye contact with your buddy and he slowly nod his head. Everything is in slow motion now. And person sitting next to you begins. "The last time we have to make so much change in our codebase is we order ten pizzas for night …" and the rest of the day is gone.

When possible, refer all matters to committees, for "further study and consideration." Attempt to make the committee as large as possible — never less than five.

"We should create a committee for all thirteen departments that will be affected by the change to find out how much it will take in man hours to upgrade our codebase from React 16 to 17." by the time the report is ready React 18 is announced.

Bring up irrelevant issues as frequently as possible.

"But my friend thinks purple background is better."

Haggle over precise wordings of communications, minutes, resolutions.

“You said you stored your content and files in GitHub but in Git content is metadata it’s not clear what you meant so please MAKE IT CLEAR! Also the time you spent on issues is given with minute resolution make it in seconds. Is it too hard to write two more numbers ? And... What’s wrong with your TPS reports. You forgot to put the new cover sheet. Did you see the memo. I’ll make sure you get another copy of that memo.”

Refer back to matters decided upon at the last meeting and attempt to re-open the question of the advisability of that decision.

"I know we agree to use React, but I sent you a blog post about Angular, which shows Typescript by default is a better choice for enterprise software."

Advocate "caution." Be "reasonable" and urge your fellow-conferees to be "reasonable" and avoid haste which might result in embarrassments or difficulties later on.

"We should not rush things .NET Framework 4.8.1 is just released so no need to rush to switch to .NET 6."

"I know Python 3. I’m not sure if it will get the traction required and worth the transition. You know it's working fine with Python 2"

While some of this might be seemed off, I’m sure you hear some of them before and if you hear all of them in your current workplace … Congratulations, you have a saboteur among your peers.

So where can you read the original ? https://www.hsdl.org/?abstract&did=750070

I hope you use the information wisely and increase your productivity.

Add Speech Recognition to Your PC even to your TV

Mustafa Unal — Mon, 11 Apr 2022 23:03:52 +0000

Overview of My Submission

Most of our day to day usage of computers uses our computers as a sound device so I thought it will be nice if I somehow connect default audio output to voice recognition so that independent of what software you use all words will be recognized ? Teams , youtube, tiktok, twitter, Edge, VLC, … you name it ( unfortunately for Windows only ☹ ) . And how much can we push it like Subtitles for cable TV 😊

Submission Category:

Accessibility Advocates

Link to Code on GitHub

bleakview / deepgramwinsys

Deepgram sound to text converter for all sounds in emitted Windows

deepgramwinsys

Deepgram sound to text converter for all sounds in emitted Windows

What you can find in this repository?

How to get started Deepgram in windows forms
Sample for custom label control with borders in Windows form
How to get and capturesystem wide default audio output
How to record captured audio as mp3
How to save and get system settings

View on GitHub

Additional Resources / Info

In order to have system wide voice recognitionyou need basically need two components a voice recognizer service like deepgram and some way to eavesdrop generated sounds from PC. I chose C# as language as I will be directly connecting to System. In order to loopback (technical term for connecting to self sound system) in windows you use Wasapi driver. I chose NAudio library for windows system.
And here are some of the results.

It works on teams

It works on browser

While the system has settings, transparent … properties the most critical system is getting audio and recognize it.

private async void ConvertAndTranscript()
{
    //enter credentials for deepgram
    var credentials = new Credentials(textBoxApiKey.Text);
    //Create our export folder to record sound and CSV file
    var outputFolder = CreateRecordingFolder();
    //File settings
    var dateTimeNow = DateTime.Now;
    var fileName = $"{dateTimeNow.Year}_{dateTimeNow.Month}_{dateTimeNow.Day}#{dateTimeNow.Hour}_{dateTimeNow.Minute}_{dateTimeNow.Minute}_record";
    var soundFileName = $"{fileName}.mp3";
    var csvFileName = $"{fileName}.csv";
    var outputSoundFilePath = Path.Combine(outputFolder, soundFileName);
    var outputCSVFilePath = Path.Combine(outputFolder, csvFileName);
    //init deepgram
    var deepgramClient = new DeepgramClient(credentials);
    //init loopback interface
    _WasapiLoopbackCapture = new WasapiLoopbackCapture();
    //generate memory stream and deepgram client
    using (var memoryStream = new MemoryStream())
    using (var deepgramLive = deepgramClient.CreateLiveTranscriptionClient())
    {
        //the format that will we send to deepgram is 24 Khz 16 bit 2 channels  
        var waveFormat = new WaveFormat(24000, 16, 2);
        var deepgramWriter = new WaveFileWriter(memoryStream, waveFormat);
        //mp3 writer if we wanted to save audio
        LameMP3FileWriter? mp3Writer = checkBoxSaveMP3.Checked ?
            new LameMP3FileWriter(outputSoundFilePath, _WasapiLoopbackCapture.WaveFormat, LAMEPreset.STANDARD_FAST) : null;

        //file writer if we wanted to save as csv
        StreamWriter? csvWriter = checkBoxSaveAsCSV.Checked ? File.CreateText(outputCSVFilePath) : null;
        //deepgram options
        var options = new LiveTranscriptionOptions()
        {
            Punctuate = true,
            Diarize = true,
            Encoding = Deepgram.Common.AudioEncoding.Linear16,
            ProfanityFilter = checkBoxProfinityAllowed.Checked,
            Language = _SelectedLanguage.LanguageCode,
            Model = _SelectedModel.ModelCode,
        };
        //connect 
        await deepgramLive.StartConnectionAsync(options);
        //when we receive data from deepgram this is mostly taken from their samples
        deepgramLive.TranscriptReceived += (s, e) =>
        {
            try
            {
                if (e.Transcript.IsFinal &&
                   e.Transcript.Channel.Alternatives.First().Transcript.Length > 0)
                {
                    var transcript = e.Transcript;
                    var text = $"{transcript.Channel.Alternatives.First().Transcript}";
                    _CaptionForm?.captionLabel.BeginInvoke((Action)(() =>
                    {
                        csvWriter?.WriteLine($@"{DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss \"GMT\"zzz")},""{text}""");
                        _CaptionForm.captionLabel.Text = text;
                        _CaptionForm?.captionLabel.Refresh();
                    }));
                }
            }
            catch (Exception ex)
            {

            }
        };
        deepgramLive.ConnectionError += (s, e) =>
        {

        };
        //when windows tell us that there is sound data ready to be processed
        //better than polling
        _WasapiLoopbackCapture.DataAvailable += (s, a) =>
        {
            mp3Writer?.Write(a.Buffer, 0, a.BytesRecorded);
            var buffer = ToPCM16(a.Buffer, a.BytesRecorded, _WasapiLoopbackCapture.WaveFormat);
            deepgramWriter.Write(buffer, 0, buffer.Length);
            deepgramLive.SendData(memoryStream.ToArray());
            memoryStream.Position = 0;
        };
        //when recording stopped release and flush all file pointers 
        _WasapiLoopbackCapture.RecordingStopped += (s, a) =>
        {
            if (mp3Writer != null)
            {
                mp3Writer.Dispose();
                mp3Writer = null;
            }
            if (csvWriter != null)
            {
                csvWriter.Dispose();
                csvWriter = null;
            }
            _WasapiLoopbackCapture.Dispose();
        };
        _WasapiLoopbackCapture.StartRecording();
        while (_WasapiLoopbackCapture.CaptureState != NAudio.CoreAudioApi.CaptureState.Stopped)
        {
            if (_CancellationTokenSource?.IsCancellationRequested == true)
            {
                _CancellationTokenSource?.Dispose();
                _CancellationTokenSource = null;
                return;
            }
            Thread.Sleep(500);
        }
    }
}

The rest of the code is for getting code ready to exexute show hide forms etc.

So after all how can you you have subtitles on TV ? In order to achieve this you need to somehow enter TV signal to PC I use a usb capture card for this in order to process capture card input I use OBS once I get the audio signal it makes no difference to me since I process all output sound signals. Then I use computers HDMI output to send signal to TV. It makes no difference to TV and Cable box.

Ps: If you have some issues with lagging check your network connection also there seems to be a problem with memory stream which is not happy with hacky solution. Any PR is welcomed.

STAR ASCIIMATION WARS

Mustafa Unal — Tue, 11 Jan 2022 21:52:16 +0000

Overview of My Submission

Would you like yo watch Star Wars from MongoDB using nothing but mongo shell ? You are in good hands. The wonderful work done by Simon Jansen in https://asciimation.co.nz/ has been ported to MongoDB in full glory. You need nothing but a MongoDB and mongo shell.

Submission Category:

Choose Your Own Adventure

Link to Code

bleakview / mongosaw

Star Ascii Wars MongoDB Edition

mongosaw

Star Ascii Wars MongoDB Edition

View on GitHub

Additional Resources / Info

Trailer:

I use starasciiwars database but you can select your own.
For trailer you only need the github repo to watch the entire movie. Open https://asciimation.co.nz/ in chrome

Press F12 to open developer console and paste the following code into console to download movie as a txt file.

var temp = document.createElement('a');
temp.href = URL.createObjectURL(new Blob([film.join('\n')], { type: 'text/plain' }));
temp.download = 'starwars.txt';
temp.click();

Use the following command to convert txt to json file.

ascii2jsonmovie.py

Use the following command to import json file to DB

mongoimport --uri <your mongodb uri> --db starasciiwars --collection trailer --drop --jsonArray --type json --maintainInsertionOrder --username=<user name>  --file starwars.json

Use the following command for mongoshell to connect to MongoDB.

mongosh <your mongodb uri> --username=<user name>

Select starasciiwars database

use starasciiwars

Run the following command to watch the movie. you can use speedX variable to set the speed.

db.episodeIV.find().sort({_id:1}).forEach(function(frame){
cls();
speedX=1;
print(frame.line1);
print(frame.line2);
print(frame.line3);
print(frame.line4);
print(frame.line5);
print(frame.line6);
print(frame.line7);
print(frame.line8);
print(frame.line9);
print(frame.line10);
print(frame.line11);
print(frame.line12);
print(frame.line13);
sleep(frame.sleeptime*120*speedX);
});

Thanks to https://github.com/JLChnToZ for offline download

Github Action Tracker with light and dark mode

Mustafa Unal — Wed, 08 Dec 2021 22:46:28 +0000

My Workflow

.github/workflows/workflow.yml

Submission Category:

Interesting IoT

Yaml File or Link to Code

bleakview / actionshackathon21

for dev.to # actionshackathon21

actionshackathon21

for dev.to # actionshackathon21 You can have more information at https://dev.to/bleakview/github-action-tracker-with-light-and-dark-mode-57bn

View on GitHub

Additional Resources / Info

We watch our how the work progress through screens big small rectangle, square but do we have to squish our view of the world through a window.
We don't have to we can watch the progress with what ever way we want. (and it began to become boring after a while) So I designed a system which show the progress with both cell phone and an IOT device connecting with Bluetooth Low Power or BLE in short.

Requirements:

A CloudAMQP account (you need a AMQP server it can be AWS,AZURE ...)
A system ready for development for flutter ( I tested in Android IOS should also be fine but I did not test it.)

For Iot:
Light mode:

A needle ( I got mine from starbucks :-) )
A micro servo
ESP32 development board installed with micropython
jumpers usb connection cable and breadboard

Dark mode:

A led strip with SPI support like APA102
ESP32 development board installed with micropython
jumpers usb connection cable and breadboard

How it works

Github action sends message to CloudAMQP queue named "github". Since we use a queue Authentication ,storage and API interface is handled automatically. Then our mobile app gets this message it handles it and draw a image on screen. And direct the message to IOT device connected with BLE. And it also handles it. Why BLE ? if we use wifi then user has to enter credentials. Since most IOT devices do not have screen its hard to enter credentials. Also Apple do not require BLE devices with known profiles with MFI program.

How to use

This is the main screen in you can interact with it through the bottom buttons.

Search Button
when you click this button the device automatically enters into search mode it looks for BLE devices which advertise a specific name "GITHUB_ACTION_IOT" when it finds the device it enables connect button.

Connection Button
When this button is clicked phone makes connection to prespecified service with Guid "6E400001-B5A3-F393-E0A9-E50E24DCCA9E" and connection point "6E400002-B5A3-F393-E0A9-E50E24DCCA9E" message is sent to the connection point.

Reset Button
When this button is clicked the state is reset.

Sound Button
When clicked sound is enabled or disabled

PS: I know most people in dev.to do not have experience in electronics. If you have any questions on this project don't hesitate to ask questions. And If you see something wrong both in project or the text please inform me. I'm an introvert extreme edition so writing is new and frightening adventure to me.