Teaching Perl - Week 1 - ( Part2 )

• Week 0
• Week 1 (part 1)

Padre - Perl IDE

Now let's install Padre the Perl IDE to give the students a nice development environment. There are instructions on the website, however, cpanp -i Padre should get the trick done since it is on CPAN In the future Strawberry will ship with Padre but that future isn't quite here.

First Program

Ok so we want to make sure that we have Perl installed correctly and since you're taking my advice I'm assuming that you've given your students access to 5.10.1 and may have 5.8 as well... So I'm gonna do this one twice. Have them create a text file hello_world.pl and add the following lines

#!/usr/bin/env perl

print "Hello, World\n";

Since I'm sure this is not your students first programming class this will be familliar to them. Explain the shebang (#!) line and note that it has no effect on windows. Now let's modernize it, using the say feature from perl 5.10.

#!/usr/bin/env perl
use feature 'say';

say "Hello, World";

note the removal of the \n and that use feature is a pragma that allows you to enable features that are newer in perl that weren't available in the original perl 5. Perl is a bit backwards about this, IMO. We should be using the newest version and features unless we specify otherwise, IMO, but that's not how it works, ATM. If 5.10 isn't available to you and your students just use print in future examples. I will be excluding the shebang line from future examples too.

Now let's expand hello world a bit. Have them Make it print

Hello, programming!
Here we go!

First thing is to make use of concatenation

use feature 'say';

say "Hello, programming"
    . "Here we go";  

This example is inspired by Programming: Principles and Practice Using C++ ( This is an excellent book and should be the textbook for BOTH C++ classes at Baker. I recommend all novice to intermediate programmers have a copy whether you like C++, or not, this book is excellent ). Please note that the . operator is in the front. This draws a programmers attention to it and notes that it's a continuation. See Perl Best Practices for more details on this.

Your output will be.

Hello, programming Here we go

That's not what we want! obviously say appends a newline to the end but doesn't help with long strings.

use feature 'say';

say "Hello, programming\n"                                                                            
    . "Here we go";  

Much Better.

Simple Game

Now let's up the ante a bit. Again not there first programming class, the following example is rewritten in Perl from Head First Programming: A Learner's Guide to Programming Using the Python Language which arguably should be the textbook for Intro to Programming. This is the first example that book gives in chapter 1 (but it gives it in python).
note: you can use < STDIN > but blogger screws it up because of the brackets. This code works exactly the same.

So now you can discuss: scalars, if then else statements,and readline. There are also two additional pragma's strict and warnings that you should tell your students to always use unless they have a 'good' reason to disable them (these have been there since the beginning).

So usually on the first night of class you're lucky to get past hello world. I think this is all doable. In 1 small program I just took you all the way to Chapter 6 in Perl by Example (3rd Edition) the chapter on control structures. Remember, this is not your students first class... you don't need to hold their hand through all this. Race through it so they can improve on it as the term goes on. Instead of spending 4 weeks (assuming a chapter a week) on if then statements you can now spend 10

Homework

Start a blog using whatever site you prefer (preexisting blogs acceptable) and add it to Iron Man. Do a first post that talks a little about you (blog can be anonymous). Include a copy of the simple game and what you think would be better about it. Also mention anything you'd like to do with, or know about, Perl.

Teaching Perl - Part 0 - Preface

This is my 2 cents on how perl should be getting taught at my school. My school's curriculum sucks in general across the board. But assuming I can't change what classes are taught, when and what prerequisites this is how I would teach perl given the current computer science curriculum.

Since people reading this are probably not familiar with the Fail that is Baker College (I would not choose Baker if I had to start again but credits don't transfer easily, so it was easier to continue on with it). Baker has 10 week courses, and with tech courses they are seemingly exclusively scheduled 6-10pm once per week. So this factors into how I'll lay this out.

Specifically for the perl class the curriculum provides the schools crux server which is running CentOS linux or something... (I'm not sure which distro it is atm). It does not have the prerequisite of Linux 101 though, and it's not in there curriculum. I don't believe it has any prerequisites other than intro to programming. It is a 300 level course, however. This means that most/all students in the course have probably taken a few C++, Visual Basic, and Java classes (there are about 6 of these classes at the 200 level and I imagine most have done at least 2 of the 6).

The book required at Baker is currently Perl by Example (4th Edition). I'd suggest telling students it's recommended but not required (If you won't get in trouble) in any event you and students shouldn't need to use this book at all, because a great book Beginning Perl is free online. Also the non book resources for perl are practically limitless and you should be encouraging the use of these. Some of them include

• learn.perl.org
• perldoc
• kobesearch.cpan.org or
• search.cpan.org
• Iron Man or
• SayPerl (AKA Iron Man with all posts translated)
• Perl Channel on Freenode if they need to ask for help

You should have a copy of Perl Best Practices. I've been told that you should read this with a grain of salt, that it's only like 50% accurate these days... but I think it's still a good place to start, and you can pick and choose what to use from it. You may also want a copy of Intermediate Perl For more advanced discussion on references and Object Oriented perl.

You may also want a good resource as a Linux CLI reference. This series of tutorials was recommended to me.

I will continue to post on the subject matter that I would cover each week, in this 10 part series (programmers count from zero ;) ). I may also discuss Perl by Example (3rd Edition) because that was the required book when I took the class, even though 4ed was out.

Update: Week 1 (part1)

Jeff Atwood fails at password security

This was originally written for a class assignment and as that has not been modified (much) for the web.

Jeff Atwood's password was compromised, the following includes a summary of how it happened, and how better security policies could have avoided it. This was written for Advanced Report Writing at Baker College.

Summary of Article

On May 3, 2009, Jeff Atwood reports that his Stack Overflow password was compromised an that he received an email explaining the details. The following is an excerpt of that email, that was posted in his blog post.

How? Well, there were two pieces of the puzzle, the password and the openid provider. I had a possible password; today your blog post revealed the openid provider. I logged in, freaked out that it actually worked, then logged out. The only reason I had the password is because your password is totally inadequate for someone running a site like StackOverflow. I don't want to go into any more detail than that, but man - dictionary password! -A friend of the site (Atwood, 2009)

Jeff confirmed that the authentication logs for Stack Overflow did include a valid login from an unrecognized IP address. Although Jeff defends that his password was not a dictionary password. He also states that this particular OpenID account is for low security transactions online, and not particularly valuable. He digresses that because this account is a Stack Overflow moderation account, with special privileges, that he should have used a more secure login.

Jeff goes on to explain, the various ways which the account could have been compromised. The first method he describes is the "educated guess". An educated guess basically uses what you know about someone to guess there password. The second is "Brute force dictionary attack". Jeff describes this as an attack vulnerable to non-rate limited logins where the password is a word out of the dictionary. The third method described is "interception". This method is basically where the password was captured at some point between the user and its destination, this could be kelogger, packet sniffing, and/or simple lack of encryption. The final method was "Impersonation" where a site pretends to be a different site, and prompts you for credentials, this is also known as phishing.

Jeff presents that none of these methods were used to compromise his account.

I guess I can tell you, so you don't fall into this trap again. There's a site I help out with that doesn't salt their passwords. They're MD5 encrypted, but if you've got a dictionary password, it's very easy to use a reverse-MD5 site to get the original. I was able to figure out you were a user on the site some time back, and realized I could do this, if only I knew your openid provider... (Atwood, 2009)

Jeff then re-iterates that he is to blame, and this is a problem with programmers at large. He then suggests that programmers should get out of the business of storing credentials, if they don't want to take responsibility for it.


Evaluation of the Article


Jeff Atwood, is a fairly famous full time blogger entrepreneur, software developer and blogger, and often seen as an authority in the community. He is self admittedly not an expert and these articles truly show this. Jeff's articles will undoubtedly lead many programmers to be confused and ignorant about the types of attacks possible and the type of attack that actually took place. One good thing does come from these articles however. It increases developer awareness (and hopefully user) awareness of just how easy it is to compromise a password and how inadequate there own authentication systems may be.


Jeff seems to not understand the basics of all the attacks he's described so I will elaborate on what they really are.


1. Educated Guess: Jeff mostly has this right, however, in the article he calls this in with social engineering. It is in no way shape or form social engineering. Social Engineering generally requires convincing someone to give you information. An educated guess requires that you use information you already have to break the password. In a sense this was used to gain the login name, although it was not a guess, it was known. I once used an educated guess to break into the account of someone based on there age, gender, race, and password hint, none of which I had to gain any additional information on. note: my cracking of this account was 100% legal as it was authorized by the computer owner.

2. Brute Force: This is combined with 'dictionary attack' and although the two are often combined they are separate attacks. A brute force attack is simply generating account credentials (username password typically) with an automated computer program and sending them to the system you are attacking until it lets you in, until you are permanently blocked, or until you give up. A brute force attack is 100% successful unless somehow stopped as it will eventually try all combinations. The exception to this is when the password could be changed to a password already tried during the attack. This only works on a live system however, if the attacker manages to gain a copy of the password db they can attack at their leisure and may instead get a stale password. It can mostly be prevented by locking users out after a certain number of failed attempts.

3. Dictionary Attack: A Dictionary attack, although it does reference words from an actual dictionary, such as Webster's, it is not limited to just those words or even words. Dictionary attacks consist of lists of words which may come from any language, including fictional ones like Star Trek's Klingon, slang, names and pop culture references. Because of modern security standards they will often append, and prepend numbers to the words, and even change case around. Dictionary attacks may also include coded words such as 1337 also know as leet or l337 or l33t, etc. 1337 is a substitution cipher popularized online which substitutes letters for numbers that slightly resemble letters. A dictionary attack is usually run before a brute force as it is much faster, and has a high probability of success compared to time used. It can be mostly prevented by forcing users passwords to be compared against known dictionaries (such as cracklib) and making sure their password isn't in them, and forcing them to pick something else if it is.

4. Interception: Interception is another name for "the Man in the Middle" attack, which is
what it more commonly goes by. Jeff seems to be under the assumption that "Man in the Middle" requires the attacker to get the credentials verbatim. "Man in the Middle" basically means getting the data after the user enters it and before it reaches it's destination, this include keyloggers, screen scrapers, and packet sniffers. it may include other methods I'm forgetting. "Man in the Middle" is easily prevented by user strong 'stream encryption' in which all data sent between the client and the host is encrypted, SSL is commonly used for this on websites, note the 'lock' icon, in your browser. This is different from hash encryption which is how the password is (should be) stored as it encrypts all data being transferred including the username and password hash.

5. Impersonation: Or Phishing is a form of social engineering in which you pretend to be something you aren't and attempt to get people to give you sensitive data such as account credentials. It is most commonly done by creating a website which closely resembles the site for which you are trying to get credentials for, and then sending out emails to try to get people to log in.

6. Social Engineering: Social Engineering is simply misrepresenting yourself to get information. It can go as far as full blown fraud, or as simply as talking a person into giving me what they may not even believe is sensitive data. One could for example talk to someone, get there name, mention that they knew a woman who married a man with that last name and ask for a mother maiden name, pretending like they knew her. A mothers maiden name is a highly common question to prove identity in account verification and password resets online. People have also dressed up and walked into nuclear power plants with clipboards making themselves look like they belonged there, and were never stopped. An IT guy asking for your password may also be social engineering, as you think you should trust him. Social Engineering may be used to get account credentials or to formulate an educated guess.

7. Rainbow Tables: Rainbow Tables are databases of all possible straight password hashes up to a certain number of characters, and there corresponding passwords, these hashes may or may not be included with a dictionary attack, they typically include the full contents of a brute force. The largest Rainbow tables includes all possible combinations up to 8 characters for md5 hashes. These make reversing a hash from a password instant and easy. It still requires the attacker get the hash in the first place, this is usually done by "man in the middle", SQL Injection, or compromising the database server. This can generally be avoided by salt-ing the hash making it more difficult for the attacker to get the original password.

Jeff's Password was lost due to a combination of attacks. Firstly was public information, his 'user' credentials (OpenID) were publicly available (this isn't actually an attack), the second was "Man in the Middle", as obviously no one published the hash, so it had to be gotten somehow enroute (unless the db was cracked). The third was "Rainbow Tables" which allowed the attacker to reverse the hash into a real password. I don't believe that Atwood truly understands the attack vector's, and I don't think that people should read these articles for learning purposes. It is good though that he accepts some responsibility for lack of proper security practices on a sensitive account.

In my opinion this is what's wrong with programmers, they think they know better and instead of learning how to do it correctly and all the things that could go wrong, they just go ahead and do.

Atwood, J. (2009). I Just Logged In As You. Retrieved
May 6 2009, from Coding Horror
Web site: www.codinghorror.com/blog/archives/001262.html


Atwood, J. (2009). I Just Logged In As You: How it happened. Retrieved
May 6 2009, from Coding Horror
Web site: www.codinghorror.com/blog/archives/001263.html

EDIT: Sincerest apologies for originally spelling Atwood as Attwood and spreading misinformation about about his profession. Thanks to Stu for pointing this out. For some reason I thought those were both true, and did not check them, since I've been reading Coding Horror for at least a year.

@Grade I'll post it next week when I get it

@Spelling errors, I had reinstalled my system the morning of writing and apparently had forgotten to configure it. They should be corrected now.

@Assignment the assignment was not an essay but the evaluation of an article, and its content. It didn't require me to cite any sources for why I agree or disagree with the article.

Heritage Paper - Cultural Diversity

This blog entry is a test of Google Docs blog publish feature. I thought some might be interested in this paper I wrote for my Cultural Diversity class that I'm currently attending at Baker College of Auburn Hills, MI.

    My name is Caleb William Cushing, born Caleb Lee Rogers. I was born on October 21, 1984 in Lansing, Michigan, USA. I'm German / Norwegian by birth and German / English by law. I consider myself a full blooded American, and pay little heed to my lineage. Due in part to the fact of my culture, and in part to the fact that I am adopted and am not truly able to associate with either my biological family or my adopted one, as far as lineage goes.

    I consider myself a part of the 'Hacker Culture'.  A Hacker is commonly defined as “A malicious meddler who tries to discover sensitive information by poking around. Hence password hacker, network hacker. The correct term for this sense is cracker.”¹ . Our definition, however, is a bit different, an acceptable version is “A person who delights in having an intimate understanding of the internal workings of a system, computers and computer networks in particular.”². I myself have never broken into a system illegally, nor have I have ever maliciously attacked another system. We hackers are a sort of counter culture. We tend to exist on the fringe of what society expects, and we explicitly seek not to conform to society, but to make up our own minds. This means that we conform to society only when societies view are the same as ours.

    The hacker culture is generally a meritocracy, meaning the person with the most skill, talent, or experience leads, although often there are other concerns as well, but this is quite common. If a person ceases to satisfy with leadership, Hackers tend to just move on. I myself have gone from the very bottom ranks of knowing almost nothing, to my own little peak in the mountain range of leaders and followings we have. Even though I myself am becoming a respected member of my community, I still look up to those who have much more knowledge than me. This is not to say I agree with them unconditionally. The merit of ones claims, like in science, is only good so long as no one can disprove it. It is the duty of all to attempt to debunk a claim. Some claims are not debunk-able  as they are based entirely on opinion and there is no scientifically correct answer for all cases. This is why there are so many 'similar mountains' in the community, no correct answer was realized and so both parties went their own way. This is the reason why I now have my own mountain.

    "Hackers dress for comfort, function, and minimal maintenance hassles rather than for appearance (some, perhaps unfortunately, take this to extremes and neglect personal hygiene). They have a very low tolerance of suits and other ‘business’ attire; in fact, it is not uncommon for hackers to quit a job rather than conform to a dress code."3 I find that I generally fit this stereotype, I can be found where my pajamas and a t-shirt or jeans and a t-shirt more often than anything else. I only dress up when it's required, although counter to many of my hacker comrades I do not completely abhor dressing up, I simply prefer not to.

    "Many (perhaps even most) hackers don't follow or do sports at all and are determinedly anti-physical. Among those who do, interest in spectator sports is low to non-existent; sports are something one does, not something one watches on TV."⁴ I whole-heartily agree with this sentiment, and although I've tried sports in the past I've never stuck with them. Many members of my family enjoy watching varying sporting events such as football, I've never understood this. The major exception in sports with hackers is martial arts, I've partaken in them and enjoyed them when I did, I hope to start practicing again soon.

    "Nearly all hackers past their teens are either college-degreed or self-educated to an equivalent level. The self-taught hacker is often considered (at least by other hackers) to be better-motivated, and may be more respected, than his school-shaped counterpart."5  I personally work towards a college degree only because it is required by many employers. I tend to avoid working on my school work as much as possible to focus on more important things such as practical education through doing. Academia has become a largely commercialized institution that seeks not to teach but to make a profit, and in my opinion it charges more for its product than it is worth.

    Hackers tend to detest "All the works of Microsoft. Smurfs, Ewoks, and other forms of offensive cuteness. Bureaucracies. Stupid people. Easy listening music. Television (with occasional exceptions for cartoons, movies, and good SF like Star Trek classic or Babylon 5). Business suits. Dishonesty. Incompetence. Boredom. COBOL. BASIC. Character-based menu interfaces."^₆ Although some of these dislikes are harmless, such as Ewoks, others are not. I have found that many times my culture clashes with that of the rest of the world, because of my contempt for things like bureaucracy,  incompetence, and dishonesty. The rest of society seems to find these ineffective behaviors acceptable to the point of expected. I do not like the idea that I am expected to lie, so that other people may feel good about there own incompetence rather than improving themselves.

    "For those all-night hacks, pizza and microwaved burritos are big. Interestingly, though the mainstream culture has tended to think of hackers as incorrigible junk-food junkies, many have at least mildly health-foodist attitudes and are fairly discriminating about what they eat. This may be generational; anecdotal evidence suggests that the stereotype was more on the mark before the early 1980s."⁷ We hackers actually tend to be slight gourmets, preferring the finer, and more exotic foods in life. I myself enjoy going out for sushi on a regular basis. It is not uncommon for hackers to enjoy strongly ethnic foods of other cultures. We are very discriminating and many of us can probably tell the difference between good ethnic food, and cheap knockoffs almost as well as people who are native to that ethnicity. I have a strict policy of "don't knock it 'till you try it", this applies to many things including food.

    "Hackerdom is still predominantly male. However, the percentage of women is clearly higher than the low-single-digit range typical for technical professions, and female hackers are generally respected and dealt with as equals."8 I generally concur with this, we tend to be quite blind to gender, although this may have something to do with the fact that rarely we know the gender of who we are working with. On the note of 'equals' I should clarify in saying that a male would be treated the same as a female in the same scenario. Remember, we are a meritocracy, and a moron is still that.

    "In the U.S., Hackerdom is predominantly Caucasian with strong minorities of Jews (East Coast) and Orientals (West Coast)."9 "The ethnic distribution of hackers is understood by them to be a function of which ethnic groups tend to seek and value education. Racial and ethnic prejudice is notably uncommon and tends to be met with freezing contempt."¹⁰ I personally recall that my High School seemed to have a fairly high number of racists in it, and I suspect that St. Johns, MI is quite racist, which is why there is a very low number of non-whites in the community. I find this behavior beyond contempt. I admit to having some personal contempt for the Indians (India) this is caused not so much by any true racism and more of a contempt for Help Desks being outsourced to their country. There incompetence and inability to be an effective tool at what they've been tasked is the source of my disdain. I also disdain the US Companies that have made this unpatriotic, greedy, and unquality decision.

    Religiously Hackers tend to be "Agnostic. Atheist. Non-observant Jewish. Neo-pagan. Very commonly, three or more of these are combined in the same person. Conventional faith-holding Christianity is rare though not unknown."1 I was raised to be a Protestant Christian, and sometimes it comes through as it was very much ingrained as a child. I am actually an agnostic, wit slight leanings towards Buddhism and the occult, neither of which are uncommon in the hacker community.

    I was not raised a Hacker, at least not in my opinion, although there were things that were slightly Hackish in my upbringing. My adoptive mother makes all her food from scratch, and for a "home cooked" meal it is by far the best I have ever had, restaurants such as Bob Evans can't hold a candle to what she makes. My adoptive father could be described as a wood turning hacker. He turns wood on a lathe to make things such as bowls and vases, his work is unique, and among some of the best, he has even created his own tools and methods for doing so, this is definitely of the hacker nature. They are both conservative Christians, and a bit less open to new things than most hackers, they have a profound inability to learn new things, or try new things, I've found that in recent years I have been able to somewhat broaden there horizons, but this is quite limited.

    Both of my adopted parents were born in 1936 around Lansing, Michigan, Grand Ledge and Dewitt, respectively. They grew up at the end of the depression, and in fact my mothers earliest memory is that of getting electricity. She summarized her childhood as, "If you didn't need it, you didn't buy it". This was a 50/50 way in my childhood years, as I was a bit spoiled because she was unable to bear children herself. At the same time I didn't really get my first computer until I was 16, even though I'd been clamoring for something for years. I believe this was a two-fold cheapness they carried from the depression and a fear of new technology given there age. I had trouble acquiring things like cd players as well in the 90s. I've brought some of this with me into my adult years, although I prefer to be called frugal, as I don't buy what I don't need, but if I do need something I'm not cheap, you get what you pay for in my opinion. This was demonstrated by a cheap Apex dvd player they bought for me on my b-day, it died a year later, 2 weeks before it's warranty was up, circuit city replaced it with a newer Sony (I picked it) plus 3 year warranty and money back. These days I do my research on what I'm buying before I buy it, but I never pick the cheapest and rarely the most expensive, as neither end of the spectrum is a wise purchase.

    I find that my current mindset is one much more that of genetics than upbringing. Two of my three half sisters were straight A students in school and although I wouldn't call them Hackers they obviously have a high IQ, although they seem to be quite good at not putting there brains to use. I'm sure that they share a mutual opinion of me though.

    I share many of the same attributes as my biological parents, including my intelligence and stubbornness. Both of which I believe are considered 'German' traits. I lack many of there negative traits, except for the fact that I'm not the most pleasant person and I may get some of that from them. I feel as if I have actually picked the best attributes from both my upbringing and my genes and combined them.

    My grandparents on my adopted side were born around the turn of the century between 1897 and 1908. They'd gone from horse and buggy to men on the moon, color tv, and personal computers; I'm not entirely sure they actually had experience with the latter.  All of them had passed before I was born. They were all natives to this country all though my Mothers Grandmother came from germany to flee the war, one that predated world war 1.

    The celebration of Christmas, Thanksgiving and Easter has been in our family 3, or more, generations although I do not truly celebrate them as holidays, I merely attend  to be with family. The commercialization of these holidays is perverse, and the religious meaning holds no weight for me.

    My biological family seems to celebrate these holidays as well. However, my biological family is not close, to me or each other, the family on both sides is highly segmented into clicks even among immediate family. My biological grandparents are still alive but truthfully I don't know how to reach one of them at all, another I might have an email for, yet another I'm not on good terms with, and the last I do talk to occasionally but they are very sick.
    In general I now associate less with my family, and heritage than I do with the Hacker Culture.

---

1. Jargon File http://catb.org/jargon/html/H/hacker.html
2. Jargon File http://catb.org/jargon/html/H/hacker.html
3. Jargon File http://catb.org/jargon/html/dress.html
4. Jargon File http://catb.org/jargon/html/physical.html
5. Jargon File http://catb.org/jargon/html/education.html
6. Jargon File http://catb.org/jargon/html/hates.html
7. Jargon File http://catb.org/jargon/html/food.html
8. Jargon File http://catb.org/jargon/html/demographics.html
9. Jargon File http://catb.org/jargon/html/demographics.html
10. Jargon File http://catb.org/jargon/html/demographics.html

Participation Points

At Baker College they don't allow teachers to grade based on attendance. I'm sure this policy is common with most schools. So what do the teacher's do? they grade based on participation. This is crap as to be able to participate you must attend the class. What the teacher's are actually doing is re-labeling attendance points as participation. Because it doesn't matter whether you take part in a class conversation. All you have to do is show up.

I'm sorry but I feel this is wrong. I've had to miss one class twice due to bad weather. I refuse to drive what is normally a 45 Minute drive in white out conditions with a layer of snow on the road. My instructor is going to let me make up more than 1 quiz (the school only allows 1 normally) and I emailed my homework, but I'm still screwed out of attendance points, I mean 'participation' points.

Just so everyone knows, I'm going to a university in the fall.