A Foolish Manifesto

fREWdiculous!

Some Kickstarters I Have My Eye On

Some fun kickstarters I’ve got my eye on:

Blasphemous Cocktails

Cocktails inspired by HP Lovecraft stories and others. It is already funded and I am definitely getting it.

The Wine Curmudgeons Guide to Cheap Wine

The title says it all. Assuming this gets funded I plan on getting it. I love when people don’t have a minimum $20 a bottle to like a bottle of wine.

The Whole Story: Winter 2013

I already “got” this one. Quality comics.

Watch Movement Jewelry and Cuff Links

I am thinking of getting the tie clip, but I almost never wear ties so it seems silly… For what it is worth a while back I looked at getting cufflinks like these and they were super expensive. These is much more reasonable. Probably will not get this, but if you are in the market for any of this stuff now is your chance!

Artizens

2D Shadow of the Collosus. Very customizable. Hoping to get a few friends in on it to get the four pack. If you are interested comment and we can get it!

Metacell

I really am interested in this one and it is really ambitious (5 games in total are planned apparently) but it does not look like it will fund :(

HabitRPG

Neat idea that is apparently pretty popular. Turn making habits into an RPG?

  • 0 Comments
  • Filed under: Life
  • The Pomodoro Technique

    A couple of weeks ago I was frustrated at my own lack of productivity. I decided to purchase Pomodoro Technique Illustrated: The Easy Way to Do More in Less Time. I had actually already attempted the Pomodoro Technique based on what I read on the internet, but it never seemed to work for me. This short, easy read has made a noticeable difference in my productivity. But the book is not the point of this post, The Method is.

    The Pomodoro Technique

    The gist of The Pomodoro Technique is that you work for 25 minutes on a given task and then take a 5 minute break. After four 25 minute sessions (called pomodoros, or correctly inflected, pomodori) you take a longer break, which happens to coincide with lunch and tea time for me anyway. Sadly though, the short version above is missing a lot of important details.

    How?

    When you work on something you work on that thing exclusively. The way the book puts it, if you set aside 25 minutes for an issue, and if you finish early, you “overlearn.” That sounds pretty stupid when you are doing anything other than studying, but when programming I just use that extra time to clean up my design and consider possible holes in what I initially did. You are certainly allowed to do more than one thing in a Pomodoro, but you are supposed to plan ahead and decide what things you will do within a pomodoro. I have found that I can never do more than two things in a single pomodoro. Apparently tasks that take less than 12 minutes are very rare :)

    The five minute break is supposed to be a total release of mental capacities. Do not check your email in that five minutes; instead zone out and try to think about nothing. This is really easy when I work from home, I just go downstairs and sit in my lazyboy for 4 minutes, then when my timer goes off I get another cup of coffee, go upstairs, and start another Pomodoro. It sounds strange, but the cool thing is that it works. When you start a task you have a plan on how to do it (generally.) The Pomodoro Technique helps you to get into the flow, so you tend to not realize design mistakes you are making. When you take your five minute breaks your subconscious comes up with better ideas on ways to do things.

    The Pomodoro Technique is mutable. The sizes of the breaks and pomodori are variable. The data you track (more on that later) is variable. You can do whatever works best for you. But if you change too much too often you are not getting a rhythm and are not measuring comparable things and are really just coming up with something else entirely.

    Why?

    The Pomodoro Technique solves the problem of too much multitasking. Because you can only work on one thing at a time you will get more work done. The other benefit, as mentioned before, is that it helps you get into a flow state. It is incredible to me that even if a task is boring, as long as it is timeboxed I can zoom in and get it done, where in the past I would have worked for 5 to 10 minutes, checked my email, worked for 5 to 10 minutes, checked my feed reader, etc.

    Another thing I love about this is that it is timeboxed effort not timeboxed results. The Get It Done community is all well and good, but I would not want any of them making the software running on an airplane. With timeboxed effort you either produce quality results, or realize that what you are doing is taking longer than it should so you save what you have done and deal with it another day. I have found that it also gives me time to work on paying down some of the technical debt in our software. Because everything is timeboxed I do not run the risk of accidentally spending 4 hours on something that does not matter, and because I am actually getting more done I have the luxury to work on such things.

    The way the technique is presented in the book is very measurement based. This means I can say that I “work more” in the same amount of time when I work from home. (1:1 at worst, 2:1 at best.)

    I also track special pieces of data, like when I get timeouts VPN’ing in to work, which is a worse interruption than someone coming into my office and talking to me. This guides my motivation that I need to make our software easier to run on Linux so I will not need to VPN in to work to use a Windows VM :)

    Tips

    One of the things that was hard for me at first was ignoring new private messages, instant messages, and irc hightlights. This was actually easier than I thought to fix; I just close the console that contains irssi and mutt. It lets me zoom in and focus on work, and then I will re-open it at large breaks and sometimes at small breaks (tmux or screen make this easy.) The same goes for work. When I take a large break I close the console related to my work, so that I will not be tempted to look at whatever is in that console.

    I found that when I first started doing this I was always exhausted. I was not used to working so consistently all day. After a little over a week I adjusted to that.

    Problems

    The Pomodoro Technique is not the way to get everything done in your life. Household chores for example are stupid to timebox. When you start doing dishes you should clean till you are done. The line is fuzzy though. For instance I started my taxes and have already (somehow) spent two pomodori on it, but I have started and that makes it incredibly easier to continue.

    I am trying to do the Pomodoro Technique after work with my OSS work, but that tends to be when my wife is at home, and it would be bad if I told her: “wait 12 minutes and then I will respond to your question, I have to finish this blog post first.” I still try to do it when she is not around though and it helps.

    I also seem to forget to start my timer. I will work for a while and then check my watch and see that I forgot to start the timer. I am reticent to get a kitchen timer (the ticking makes it clear that it has started), but I may do it nonetheless.

    I find that tasks that are much easier than I expected (takes 2 minutes instead of 20 mintues) are hard to stretch out into a full pomodoro. I have an informal rule that if something takes less than half a pomodoro I am allowed to modify my plan for the current pomodoro within the pomodoro, which is usually verboten.

    The Pomodoro Technique makes scheduling with other humans harder. The coworker I work closest with is fine with getting back to me in 15 minutes, but do I want to wait 15 minutes to go to lunch (we all eat together) ? Often people will come by my office in the morning to discuss something that happened since I last saw them; it is at least a little awkward to say, “Hey I am working, could this wait?”

    The Book

    I strongly recommend getting the book. It is a very easy, short read with lots of pictures and examples. It is a little strangely written, presumably because the author is not a native English speaker (maybe he is, but it does not seem that way!) The only annoying bit is how much Pragmatic Programmer charges for a digital copy which is not included with a dead tree edition. If only Valve could influence book publishers too (receive all platforms at the same time!)

    The Bottom Line

    I cannot speak for everyone, but with this technique I am more productive. Frustratingly, I cannot easily compare before and after, because the two weeks before I started this were holiday ridden, and the two weeks before that were not well broken up in our issue tracker. What I can say is that at the current rate the scheduled issues will all be complete before Feb is over, which is unheard of in my project.

  • 2 Comments
  • Filed under: Life, Super Powers
  • Announcing Apache::BalancerManager

    At work I use Apache as it’s the best thing out there for perl on windows. One of the features of Apache when you are using it as a load balancer is it’s UI for controlling the Balancer Manager. One of my coworkers remarked that it would be nice to have an API for that so that when we restart workers we could tell the balancer manager first so that the worker would not get dispatched to until it finished restarting. Well OK!

    Apache::BalancerManager

    Apache::BalancerManager gives you an easy to use, object-oriented interface for interacting with Apache’s Balancer Manager. Here’s a real example from our server code:

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    use Apache::BalancerManager;
    my $m = Apache::BalancerManager->new(
       url => 'http://127.0.0.1/balancer-manager',
    );

    sub restart_service {
       my $service = sprintf 'LynxWeb%02i', $_[0];
       my $member = $m->get_member_by_location(
          sprintf 'http://127.0.0.1:50%02i', $_[0]
       );

       $member->disable;
       $member->update;
       system(qw(net stop $service));

       system(qw(net start $service));
       $member->enable;
       $member->update;
    }

    The module automatically finds all the available members and creates objects to wrap each of them. There are a number of methods for each, for example one might modify load_factor if a server is under too much load. Ultimately though, I’m pretty sure the use case above is the best one, as the balancer manager is limited in what it can do. (Members can’t be added at runtime, for example.)

    Anyway, this makes me a little bit less afraid to roll out updates to our live site, so I figured others might appreciate it too.

    Caveat: I’ve only tested it with Apache 2.2. It may be broken on 2.4. Patches are welcome!

    Enjoy!

  • 0 Comments
  • Filed under: Uncategorized
  • Abstraction Levels

    One of the decisions we developers must make when writing our modules is at what level to abstract our code. I, for instance, write a lot of DBIx::Class components, which is, for the purposes of this discussion, about the same as a role (and I will just use the term role for the rest of the article.) For a long time that was my standard modus operandi, but I’ve started to think that that is a bad default and that I need to consider more carefully what to use.

    Abstraction Levels

    The abstraction levels that I deal with on a regular basis are:

    1. Roles
    2. Objects
    3. Subroutines

    I cut my CPAN teeth on roles because they are the generally accepted form of code reuse in DBIx::Class. For instance if you want your Result Class to inflate columns of the data type datetime you use the DBIx::Class::InflateColumn::DateTime role. But what bothers me about roles is that you must define a class and instantiate an object to use them “correctly.” You could Perl it up and use their subroutines directly, but that forces me to ask myself: “why not make an exporter that actually gives you the subroutine in question?” Indeed, why not do that as a matter of course?

    I actually have a lot of helpers that I think would be good to migrate away from roles. For instance, what if you do not want to forever use the ::SetOperations role which lets you use unions in a DBIx::Class::ResultSet, but instead just want to union two resultsets that you don’t control? If I were to factor the ::SetOperations methods into simple subroutines it would be very simple to create roles that make methods out of the subs.

    And then of course there is the object path. Generally I think it is fairly easy to decide when to use an object; if it’s a standalone module an object is probably fine. Additionally, if something is complex enough to be more than a single method, an object makes perfect sense, as that way users can make subclasses and override behavior.

    Another related issue that I have trouble with is what should be instance level in an object or role and what should not be. Sometimes I think I made too much instance level in DBIx::Class::DeploymentHandler. I’ve fixed that any time I’ve found it (the version to install used to only be able to be set at instantiation time, instead of when the install method was called, for example) but I worry about the fact that I even got that wrong in the first place. A lot of thought went into that module.

    I think I need to start asking myself “how permanent does this need to be?” So if something is complicated enough, it needs to call other methods so they can be overridden etc; that can’t be a subroutine. But the vast majority of my helpers could easily be simple subroutines, as override points would be overkill. The same goes for instance data. Setting instance data so that it can default method arguments is probably sensible, but forcing the user to re-instantiate to change a value (as my accessors are nearly always read only) is again probably too much.

    What do you think? Do you have rules of thumb you use when designing your API’s?

  • 1 Comment
  • Filed under: Uncategorized
  • Go See My DBIx::Class Advent Article!

    woohoo!

    Again, I’ll probably reblog this in January.

  • 0 Comments
  • Filed under: Uncategorized
  • Go See My Advent Article!

    Merry Christmas!

    (I’ll reblog it next month probably.)

  • 2 Comments
  • Filed under: Uncategorized
  • ssh tips

    As a developer, I use ssh all the time. When connecting to the various servers and even other computers in my house, ssh is my go to. Most writable git servers use ssh. A newish Perl module by mst (Object::Remote) uses ssh for communication. There are a number of tricks you can use to make using ssh as hassle free as possible. I’ll share these tips here.

    ~/.ssh/config

    First and foremost is getting intimate with ~/.ssh/config. When I first started using ssh I tended to just always do ssh $user@$hostname to connnect. I’ve shared before how to do this, but it is worth repeating. So for example, I develop on a server at work called FrewLynx and my user (yay windows…) is Administrator. Hence this is the config I use to type a little bit less when connecting:

    1
    2
    3
    host fl
         user Administrator
         hostname FrewLynx

    Which means I can just use “ssh fl” to connect. Handy! You can also include a port number (“port 22″ for the default.) This is helpful when you want to make the computers in your house accessible via port forwarding over your router. So ssh desktop might have port 2022 and ssh laptop might use port 2122.

    Passwordless Login

    Ok, so you’re already typing less, that’s good, saving a little time and keystrokes. Next up is not having to type your password when logging into a server. The way to do this is to set up a key that will authenticate you for the server. It’s fairly easy to set up. There are two ways to avoid typing a password. The first and best is to use ssh-agent, which caches your password for the duration of your “session.” The next is to not put a password on the key at all. The second is not recommended, but will work if your system is not set up for ssh-agent. Typically ssh-agent will get started when your X session starts. I’ve never set it up myself as ubuntu takes care of that for me.

    Create Key

    So to generate your key you first run the following command:

    1
    ssh-keygen -t ecdsa -f ~/.ssh/keys/$servername

    The -t tells it to use the new ECDSA style key. Some servers still don’t support ECDSA, so to check if it’s supported before you waste time making a bogus key, try this command

    1
    ssh -vvvv -o "PasswordAuthentication no" xyzzy@server 2>&1 | egrep 'debug2:.*ecdsa'

    It should include output if ecdsa is supported. If it’s not supported use rsa. If you use a password, you can use ssh-agent to cache it, so again, a password is recommended. You don’t have to actually create a different key per server, but it allows you to compartmentalize keys so that if they get compromised it’s not as big of a deal.

    Put Public Key on Remote Server

    So now that you’ve made a key, you need to tie it to your server. First, to put it on the remote server use

    1
    ssh-copy-id -i ~/.ssh/keys/$servername.pub servername

    This will put the public key in the correct place on the remote server to authenticate you.

    Configure Connection

    Next add it to your config so that the local side knows to send it. So using the config from above and adding the key we’d get this:

    1
    2
    3
    4
    host fl
         user Administrator
         hostname FrewLynx
         identityfile ~/.ssh/keys/frewlynx

    Cache Password

    Now there is one more step to avoid typing the password. Use the following command to cache the password for a given key

    1
    ssh-add ~/.ssh/keys/servername

    Once you’ve done that, you won’t need to type the password for the rest of the session. To test that it worked do: “ssh servername ls” It should list the files in the home directory with no password prompt.

    Stay Connected

    The final tip is a way to keep your ssh sessions connected so that reconnecting later will be faster. This is actually surprisingly easy. Basically just put this at the top of your ~/.ssh/config

    1
    2
    3
    ControlMaster auto
    ControlPath /tmp/ssh_mux_%h_%p_%r
    ControlPersist 24h

    Once you’ve done that you can test that it worked by again doing “ssh server ls”. Do it twice and you should notice a significant speedup on the second one. What’s really cool (to me) is that this even works for git server connections, so pushing and fetching tend to be noticeably faster.

    Misc

    Another couple things worth trying are using the blowfish cipher and enabling compression. Using the blowfish-cbc cipher is supposedly faster, and compression may help when connecting over a slow link. To enable these you’d update the config to the following:

    1
    2
    3
    4
    5
    6
    host fl
         user Administrator
         hostname FrewLynx
         identityfile ~/.ssh/keys/frewlynx.rsa
         Ciphers blowfish-cbc
         Compression yes

    I’m not totally sure how much these help and only found out about them while researching this article.

  • 2 Comments
  • Filed under: Uncategorized
  • Announcing DBIx::Class::MaterializedPath

    Have you ever wanted to store trees in your database? How about store them and avoid melting your database server at retrieval time? Did you want to use materialized path and were sad when there were no quality modules to do it with DBIx:Class?

    DBIx::Class::MaterializedPath

    I recently had a need for storing tree-ish data in a table and I got it working with extended relationships and a helper or two. On the airplane on the way to and from YAPC I got the code factored into it’s own module and then a few weeks later I got docs done.

    Less talk more rock! Here’s an real life example of how to use this!

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    package DU::Schema::Result::Ingredient;

    use DU::Schema::Candy;

    primary_column id => {
       data_type => 'int',
       is_auto_increment => 1,
    };

    column kind_of_id => {
       data_type => 'int',
       is_auto_increment => 1,
       is_nullable => 1,
    };

    column materialized_path => {
       data_type => 'varchar',
       is_nullable => 1,
       size => 255,
       accessor => '_materialized_path',
    };

    unique_column name => {
       data_type => 'nvarchar',
       size => 50,
    };

    column description => {
       data_type => 'ntext',
       is_nullable => 1,
    };

    __PACKAGE__->load_components('MaterializedPath');

    sub materialized_path_columns {
       return {
          kind_of => {
             parent_column => 'kind_of_id',
             parent_fk_column => 'id',
             materialized_path_column => 'materialized_path',
             parent_relationship => 'direct_kind_of',
             children_relationship => 'direct_kinds',
             full_path => 'kind_of',
             reverse_full_path => 'kinds',
             include_self_in_path => 1,
             include_self_in_reverse_path => 1,
          },
       }
    }

    belongs_to direct_kind_of => '::Ingredient', 'kind_of_id', {
       join_type => 'left',
       proxy => {
          direct_kind_of_name => 'name',
       },
    };
    has_many direct_kinds => '::Ingredient', 'kind_of_id';
    has_many inventory_items => '::InventoryItem', 'ingredient_id';
    has_many links_to_drink_ingredients => '::Drink_Ingredient', 'ingredient_id';

    1;

    This module works and I really like the api, but there are two caveats. It uses recursion and uses the new __SUB__ 5.16 feature to do it. I’ll take a patch to fix this as long as after the patch, when using 5.16 it still uses the core version and not whatever other module does it for < 5.16. The second is that the order of the tree is not guaranteed. There’s this hack people have used where you order by the length of the materialized path, but it’s totally a hack. “1.2.3″ sorts the same as “123.4″, which is wrong. So I’ll be ok with the sort thing as an option, but I’d much rather a real solution at some point.

  • 1 Comment
  • Filed under: perl
  • Hash your passwords!

    More than two years ago I blogged about how to correctly store passwords. Recently a number of high profile websites have had their password storage compromised. The storage method I blogged about two years ago is still hugely better than what LinkedIn (SHA1, no salt) and I think Gawker had. If you aren’t already securely storing passwords, this post should get you going on a conversion.

    First off, here’s a DBICDH/DBICM compatible conversion script

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    #!/usr/bin/env perl

    use strict;
    use warnings;

    use DBIx::Class::DeploymentHandler::DeployMethod::SQL::Translator::ScriptHelpers 'schema_from_schema_loader';
    use Crypt::Eksblowfish::Bcrypt;

    # hashing code taken from DBIx::Class::EncodedColumn::Crypt::Eksblowfish::Bcrypt

    # PROTIP: generally code reuse in migrations is *not* a good idea as changing
    #         the reused code could break future runs of the migrations, or worse,
    #         make the output subtley different, thus meaning regenerated servers
    #         could have frustratingly different results

    my $cost = 8;
    my $nul  = 0;

    $nul = $nul ? 'a' : '';
    $cost = sprintf("%02i", 0+$cost);

    my $settings_base = join('','$2',$nul,'$',$cost, '$');

    my $encoder = sub {
      my ($plain_text, $settings_str) = @_;
      unless ( $settings_str ) {
        my $salt = join('', map { chr(int(rand(256))) } 1 .. 16);
        $salt = Crypt::Eksblowfish::Bcrypt::en_base64( $salt );
        $settings_str = $settings_base.$salt;
      }
      return Crypt::Eksblowfish::Bcrypt::bcrypt($plain_text, $settings_str);
    };

    schema_from_schema_loader({
       naming => 'v4',
       constraint => qr/^users$/i,
    }, sub {
       my ($schema) = @_;

       $_->update({ password => $encoder->($account->password) })
          for $schema->resultset('Users')->all
    });

    Of course if your passwords are not hashed, I would be blown away if you are using DBICDH or DBICM. I understand that beginning to use a migration tool is a huge step. So here’s a one-time migration perl script you can use that does not involve DBICDH or DBICM:

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    #!/usr/bin/env perl

    use strict;
    use warnings;

    use DBIx::Class::DeploymentHandler::DeployMethod::SQL::Translator::ScriptHelpers 'schema_from_schema_loader';
    use Crypt::Eksblowfish::Bcrypt;
    use MyApp::Util;

    my $cost = 8;
    my $nul  = 0;

    $nul = $nul ? 'a' : '';
    $cost = sprintf("%02i", 0+$cost);

    my $settings_base = join('','$2',$nul,'$',$cost, '$');

    my $encoder = sub {
      my ($plain_text, $settings_str) = @_;
      unless ( $settings_str ) {
        my $salt = join('', map { chr(int(rand(256))) } 1 .. 16);
        $salt = Crypt::Eksblowfish::Bcrypt::en_base64( $salt );
        $settings_str =  $settings_base.$salt;
      }
      return Crypt::Eksblowfish::Bcrypt::bcrypt($plain_text, $settings_str);
    };

    my $schema = MyApp::Util::dbic_connect();

    $_->update({ password => $encoder->($account->password) })
       for $schema->resultset('Users')->all

    Are you not even using DBIC? You just use straight DBI? I still want you to not have an excuse:

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    #!/usr/bin/env perl

    use strict;
    use warnings;

    use DBIx::Class::DeploymentHandler::DeployMethod::SQL::Translator::ScriptHelpers 'schema_from_schema_loader';
    use Crypt::Eksblowfish::Bcrypt;
    use MyApp::Util;

    my $cost = 8;
    my $nul  = 0;

    $nul = $nul ? 'a' : '';
    $cost = sprintf("%02i", 0+$cost);

    my $settings_base = join('','$2',$nul,'$',$cost, '$');

    my $encoder = sub {
      my ($plain_text, $settings_str) = @_;
      unless ( $settings_str ) {
        my $salt = join('', map { chr(int(rand(256))) } 1 .. 16);
        $salt = Crypt::Eksblowfish::Bcrypt::en_base64( $salt );
        $settings_str =  $settings_base.$salt;
      }
      return Crypt::Eksblowfish::Bcrypt::bcrypt($plain_text, $settings_str);
    };

    my $dbh = MyApp::Util::dbi_connect();
    my @users = @{$dbh->selectall_arrayref('SELECT "id", "password" FROM "Users"')};

    $dbh->do(
       'UPDATE "Users" SET "password" = ? WHERE "id" = ?', {},
          $encoder->($_->[1]), $_->[0]
    ) for @users;

    Of course, it doesn’t matter if your data is converted but your application cannot support the new method. If you are just using Catalyst + DBIC use my original blog post on this subject. If, like us, you have a mixture of DBIC, CGI, and Catalyst, you’ll want to do a bit more work. In our CGI scripts we can’t load up our DBIC schema as it slows most of the website down way too much, so instead I hacked around it and just loaded up the user class:

    1
    2
    3
    4
    5
    6
    7
    8
    9
    require My::Schema::Result::User;
    my $u = My::Schema::Result::User->new({});

    $u->{_column_data}{password} = $hashed_password_from_database;

    if ($u->check_password($password)) {
       grant_access($user);
       exit; # don't you miss CGI?
    }

    Lastly, if you are not using DBIC at all, you’ll want to make a couple little utility functions like this for hashing passwords:

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    package MyApp::Util;

    use strict;
    use warnings;

    # ...

    # again, based on DBIx::Class::EncodedColumn::Crypt::Eksblowfish::Bcrypt
    my $cost = 8;
    my $nul  = 0;

    $nul = $nul ? 'a' : '';
    $cost = sprintf("%02i", 0+$cost);

    my $settings_base = join('','$2',$nul,'$',$cost, '$');

    sub check_password { hash_password($_[0], $_[1]) eq $_[1] }

    sub hash_password {
       my ($plain_text, $settings_str) = @_;
       require Crypt::Eksblowfish::Bcrypt;

       unless ( $settings_str ) {
          my $salt = join('', map { chr(int(rand(256))) } 1 .. 16);
          $salt = Crypt::Eksblowfish::Bcrypt::en_base64( $salt );
          $settings_str =  $settings_base.$salt;
       }
       return Crypt::Eksblowfish::Bcrypt::bcrypt($plain_text, $settings_str);
    }

    To use the above you do either of the following:

    1
    hash_password('>=6char$')
    1
    check_password('>=6char$', $hashed)

    No Excuses

    I’ve done all the hard work for you. Stop waffling. Stop irresponsibly storing your passwords in any other way. If you’re already hashing your passwords, but you aren’t salting them, chromatic has a post on how to take care of this. If you are storing your passwords insecurely it is your fault if your passwords get into the wrong hands and cracked. Fix it today.

  • 4 Comments
  • Filed under: perl
  • Zero DM RPG’s

    My weekly table top rpg is Changeling, which is one of the World of Darkness templates. This past week some stuff went on sale on DriveThruRPG so I picked up a few things that I’d wanted to look at for a while. For our game I’m the DM or GM or Storyteller or whatever you want to call that. It’s not because I’m overly creative or even wanted to, it’s because I wanted to play and no one else seemed willing to do it. Anyway, the following two games are appealing to me because they would decrease my amount of planning for the game. On the other hand I can’t imagine using either of these for long term campaigns.

    Geasa

    Geasa is a game nominally based on the concept of a geis which is a curse taboo thingy. To play the game each player gets a Person (PC) and a Fairy. The person has a handful of stats but is mostly just a regular Person. The Fairy has a handful of powers or w/e, that are all used to control the person the Fairy makes a deal with. Note that you cannot make a deal between your own Fairy and Person, it must be done with another player’s Person.

    Turns rotate around the table and when it’s your turn you are in control of your Person as well as describing scenery etc. Other players control their Person, Fae, or possibly Non-Player Persons (NPC’s). When you run an NPP except for extenuating circumstances you play that Person every time they come up for the rest of the game.

    When you create your Person and your Fairy you give each of them goals, which is what ultimately drives play.

    The actual dice-based rules are very minimal. If you like combat, crunchy character building, or leveling up, this is not the game for you.

    One thing that really strikes me about this game is the clever mechanics of Fairy powers. The cheapest power is a form of free form spell that allows you to, for instance, tell a Person: “Eat a worm every time you see a friend or else you will not be able to hear that friend speak until you steal a loaf of bread.” The Person can say no to this, but if they say no it basically forces the Fairy to do more devious things, including taking complete control of the person.

    Another interesting thing I’d like to experiment with this game is skinning it. So while the obvious default is Fairies, you could instead have Greek Gods, or Aliens from space, or what if it were high tech devices implanted into the Person’s head that communcates messages from a governement?

    Microscope

    The best description of Microscope is that it’s fractal gaming. Unlike any other RPG, you don’t have characters with stats at all. Microscope is a universe/history generator. It’s very well described with some very neat features. The birds eye view of the game is that you have three basic parts of the game: Periods, Events, and Scenes. All of these things are strictly nested. Periods are tens to hundreds of years. Events are significantly shorter and probably closer to days or months. Lastly you have Scenes, which are more or less realtime.

    When you create a Period or Event, you do so without any input from the other players. The only rule is that you cannot contradict an existing Period or Scene, so if you want, you can completely destroy an empire that the previous scenes go into depth on. Or if you want you can add an Event focusing on a barely mentioned race 1000 lightyears away that will maybe show up before the end of time. Or maybe not.

    One thing that sounds really cool about Microscope is the ban/require ruleset. When you start the game you create a Pallete of required and banned “things.” So for instance if the game is a fantasy setting that mimics middle earth, you could ban humans so the game is exclusively alternate races; or maybe you don’t want vanilla fantasy, so you require psychic powers, or maybe time travel (which could be REALLY confusing in Microscope because you don’t play the game in chronological order.) As the game is a fractal, you can do this at the lower levels as well, so for instance in a Scene asking what The Prophet did the last night of his life, but you banned The Prophet from appearing in the scene, you’ll end up with a somewhat different scene.

    I think Microscope sounds fascinating and I really want to play it; one thing I think would be fun to use it for is to generate the backdrop for a campaign. That could give the players and the DM all a good feel for the tone of the game and the overall history of the universe.

    Anyway, I may try to set up one or both of these games async (email) or long-distance (google hangout.) I’d love to do it in person but I just don’t know if I can scrounge up the humans for it. Let me know if you are interested!

  • 3 Comments
  • Filed under: Uncategorized