Glendix on the Web!

Glendix has been making the rounds on the web lately, with coverage from OSNews, Reddit, and even a Russian site, Linux.org.ru. It’s really motivating to see some buzz around the project, giving me the extra boost needed to push the completion of a usable release!

Some of the major obstacles that have to be crossed before making a beta-quality release are the completion of critical synthetic filesystems – especially /net and /draw. We also have to work out the kinks with per-process namespaces and union mounts. I don’t know if we’ll be able to get Rio running as a WM before an official release; if not, Plan9Port‘s Rio and WMII are good candidates.

The biggest criticism of Glendix seems to be the reasoning that Plan9 user-space tools are somehow superior to their GNU counterparts, and several people have asked us to substantiate our claims. At this point, however, I don’t think that it is really important, or even relevant. Even if Plan9 user-space tools aren’t somehow better – I think it is generally a refreshing idea to see Linux combined with a user-space other than GNU.

We’re at FOSS.IN this year, where a large number of kernel developers have gathered; and I hope to get some of their valuable input on the problems Glendix currently faces, and maybe even write some code to solve them :-)

Thanks for all the community support and critical comments, they are all very vital feedback for the project and are much appreciated!

FOSS.IN 08: Mozilla Labs, Beacon and Glendix

FOSS.IN 2008 begins tomorrow!

It’s going to be really interesting to see how the departure from the ‘07 formula works out.

I’ll be conducting a Workout on Beacon, the web-based GuideXML editor on Day 4 (Friday). If you’re interested in contributing to a next generation AJAX powered web application and are familiar with Javascript with a bit of PHP or Python, I highly recommend dropping in!

There will also be a talk on Innovation and Mozilla Labs on Day 5 (Saturday), where we’ll take Weave as a case-study to see how ideas are incubated at the Labs. I’ll be talking about how you can contribute to the various initatives at Mozilla Labs. Or maybe you’re just curious about the future of the web and how you can help shape it. In any case, you want to be there (*hint* there will be goodies *hint*)!

Two Glendix hackers, myself and Shantanu are also going to be at the event, and there’s a whole day dedicated to Linux kernel hacking. I’m planning a lightning talk on Glendix during the gathering,  and hopefully we can gather enough interest to get some work done on some of the project’s priorities!

See you at India’s largest FOSS event :-)

AES-256 using PHP-mcrypt

PHP is sometimes really dumb.

While working on a library for Weave’s OAuth implementation (so 3rd party developers don’t have to understand the nitty-gritty of OAuth and can instead use a simple library in their favorite programming language), I ran across the need to do AES-256 decryption in PHP.

The best (and fastest) method would be to use PHP’s mcrypt extension, but mcrypt lists support for ‘Rijndael’ and not ‘AES’. They’re both practically the same, except for the very small difference of the IV (initialization vector) being different sizes. In Rijndael, the IV is always the same size as that of the key, but in AES, the IV is always 16 bytes.

Weave uses AES-256, which means we have a 32 byte key, and a 16 byte IV. mcrypt implements Rijndael, so my first try:

// $key is 32 bytes long
$iv = 'sixteenbyteslong';
$td = mcrypt_module_open(MCRYPT_RIJNDAEL_256, '', MCRYPT_MODE_CBC, '');
mcrypt_generic_init($td, $key, $iv);

failed with:

Warning: mcrypt_generic_init(): Iv size incorrect; supplied length: 16, needed: 32 in aes.php on line 26

Here’s the workaround:

$td = mcrypt_module_open(MCRYPT_RIJNDAEL_128, '', MCRYPT_MODE_CBC, '');
mcrypt_generic_init($td, $key, $iv);

That’s right – you call mcrypt_module_open with Rijndael-128 instead of 256, but still pass a 32 byte key to mcrypt_generic_init and be on your merry way.

WTF, but I’m happy that it atleast works.

Weeks 8 & 9: Load balancing, OAuth

So, after a fun July 4 weekend at Atlanta (which comprised of visits to white water and stone mountain, not to mention quality time with family and some amazing mini-golf), it was back to work.

Week 8 was mostly consolidating the server-side, as post 0.2 releases of Weave increased the number of active users. We needed to make sure we can scale well (one of the main reasons why WebDAV was chosen as a data store), so Chris and I came up with a few quick-fixes.

Tip 1: If you have a large number of files or directories in a single directory, consider splitting them into buckets. We put usernames with the same first letter in a directory, sourceforge takes it a step further by creating one-letter directory names and then two-letter ones in them.

Tip 2: There’s only so much load one server can handle. Get another one and load-balance ;-)

Ok, I admit the second tip was not really a tip.

Building scalable web applications is definitely a hard problem; which is why we have some amazing technology like Amazon EC2 and Google App Engine. Hacking up a quick PHP script to do something is one thing, making sure a million users can use it simultaneously is another. Which is why working at the Mozilla Labs has exposed me to an entirely different way of looking at things – sure, it works now – but will it work when thousands of people bang on it? I’m loving it here :-)

One of the other important aspects of Weave that has been doing the rounds is that of data sharing. Sharing your bookmarks with a friend is cool, but sharing your browsing history or bookmarks with a third party web service can potentially lead to some awesome mashups and services.

To maintain the integrity of your (encrypted) data, we need data sharing with third parties to work in a secure way. OAuth is an open protocol to share personal data with services, and we think it’d be an excellent choice for Weave.

This week, I’m looking into the OAuth spec and coming up with a suitable implementation for Weave. This will also potentially tie-in to the web client (previewed earlier) – you could authorize your own web server (on which you setup the web client) to access your data and decrypt it server-side to make the client a lot more faster, while losing none of the security.

On a different note, if you haven’t read Jono’s post on software development and UIs yet, DO IT NOW. Definitely one of the best posts I’ve seen around the blogosphere in a while.

Well, back to discussing fun – we interns had a basketball match with the full-timers today. And there’s more to come: some of us have tickets to the opening of The Dark Knight tomorrow, followed by the Intern BBQ on Friday (co-incidentally, also my 21st birthday). As if that weren’t enough, I’m going to Los Angeles to catch Russell Peters on Saturday, and maybe spend Sunday at Disneyland.

And then, there’s the summit, no saying what we’re in for ;)

Weave 0.2!

It’s been a long night, but Weave 0.2 is finally out! Grab it while it’s hot :)

The last week was mostly spent sprinting towards this release. We’ve fixed over 75 bugs, the major features being: streamlined first-run experience; passwords, tabs and form history synchronization; switch to NSS-based component instead of openssl; better encryption (AES and RSA instead of DES3); and general performance improvements. For a more detailed overview of the changes, check out the release notes.

Ubuntu users: You can’t use the Firefox that the package manager installs, you need to get a stock build here and use that instead. (This is because Ubuntu doesn’t include some parts of Firefox that Weave depends on).

I’m really excited to be a part of this, because I’m very new to the feeling of being part of a team that writes software that a ton of people use. Within minutes of the release, we started getting feedback from users; which is really awesome, and I doubt I can get this kind of experience elsewhere.

I’m also a little nervous, because I got to work on some of the server-side code that Weave depends on, and I’ve actually never written code that is going to be tested by thousands of people. My only hope is that all goes well and that I didn’t break something. My best moment was when I wiped all the old accounts to start afresh (that means all 0.2 users have to register again, irrespective of whether they had an account before. Weave should automatically popup a registration wizard when you install it). All in all, it’s been a wonderful experience so far, and I definitely look forward to more releases working at the Labs!

On a side note, the Labs upgraded to a really snazzy looking website today, going hand-in-hand with the 0.2 release.

So, I’ll be heading to bed now, and check if the world hasn’t ended tomorrow morning. Enjoy the new Weave release!

Week 5: FF3 Release, Canoeing and more!

As I mentioned in my last post, Week 5 was one of the most exciting weeks since I arrived. The main reason was the release of Firefox 3, and I am certainly lucky to have been amidst all the action.

On release day, the entire Labs team settled in a huge table facing the big screen in Building K (our everyday workplace is in Building S). The atmosphere was great, everyone was charged up, and we got to see realtime statistics on FF3 downloads on the big screen. Not to mention, AirMozilla’s camera was moving around the building getting random shots of people pretending to work. It was really exciting to look at download counter, and there were huge rounds of applause at every million mark.

That evening, there was a party (Camp Firefox), complete with Barbeque, drinks and a full-size Foxkeh running around scaring children.

I spent the rest of the week mostly working on some server-side stuff and ironing out the bugs in the registration API. We also had a long meeting discussing what the status of Weave was, and what the major blockers for the 0.2 release were. This is also when I got my first review request! Justin Dolske had been working on writing the NSS based WeaveCrypto component, and I was waiting for his patch to land so I could continue work on the Weave web client. I hope we can make the release at the end of this week.

The weekend was a perfect match for the week.

On Friday night, some of us interns went for a midnight showing of Serenity at SF. Always nice to watch a good movie at midnight! Saturday afternoon, I traveled on the Caltrain to Palo Alto – to catch Mozilla’s screening of Kung Fu Panda. The highlight of the event was the Q&A session with the co-director of the movie, Mark Osborne. After some Gelato, we headed back to Mountain View.

Sunday morning, I had to get up real early because a bunch of interns and Mozilla employees were headed to the Russian River for some Canoeing. After a really long drive (with a stop at Panera’s where we picked up our packed lunch), we reached Burke’s Canoe Trips. I paired up with Eric, my apartment mate, and we headed out with the firm determination of soaking everyone else. I think we were pretty successful, with the slight drawback of everyone hating us now.

Anyway, the entire week was just fantabulous and I had a really great time. But now, it’s monday, and I better get back to work, especially because I have to give a 5 minute talk today on what I’ve been doing since I got here; and I’d like to make sure I last at least 2 minutes :)

Follow

Get every new post delivered to your Inbox.