Abhishek Parolkar's Technology Blog

sneOS 1.1 - The Rails Deployment OS

2008-01-27T18:32:00.000+05:30

One of my good friend & mentor, Abhijit, pointed me to this , which was so thought provoking that I went into serious thinking on my philosophy of open source software and my contributions to community. I have been little passive from last couple of months in terms of my contributions to my own passion because I wasnt getting much time to build on my ideas, and I wasnt releasing anything incomplete because I didnt want to . But after reading the article by Josef Assad , I decided to share my ideas and mistakes with people and also let people help me build a software which solves real hard engineering problem. Most importantly the solution that evolves from community's effort without letting economics govern it.

I am a Ruby Coder and a RoR Enthusiast. From couple of months everybody has been questioning performance and scalability of RubyOnRails and everybody has been trying to play hard with ruby interpreter , threads, memory mgmt of ruby etc. One day I questioned myself that, when everybody (including Yukihiro Matsumoto & David Heinemeier Hansson) are working on the core of ruby and RoR performance , What can I do to help RoR continue spreading its glory. Few months back when I baught a VPS , I spent nights to configure for it to be the perfect RoR environment. This gave me an idea to build an RoR Environment. Hence I started sneOS , Initially goal was totally different , It was to build a minimal OS distribution that can run ruby and I was also trying to build a shared ruby interpreter (ruby as /dev/ruby or call it ruby kernel module). This didnt happen much due to time constraints but I released the first version of sneOS (24 MB) which had bare minimum OS components and ruby interpreter. Over the period of entire year I have (along with friends of mine) always faced problems in setting up RoR deployment servers , first, you need OS (Deb/RH/CentOS) then you need heavy (bulky) libraries and ruby & gems , then you need compiler tool chain so that gems installations doesn't break in extconf.rb. then you get Rails , then you need to configure mongrel cluster , then you install tools to do performance engineering on your cluster... This just goes on... and all of us spend alot of time figuring out PATH issues, native library version incompatibility issues etc. Capistrano & things like Ruby Works do help but doesnt ease the effort. To use them we still need the base OS. Well, RoR has high dependency on system environment because Ruby extensions use native libraries (classic example is RMagick ) and any inconsistency in system environment breaks things in RoR. So why not separate RoR environment from System Environment?. Can life be simpler if we are given a toolset which asks , Which Gems? Which Version of Ruby and Rails? and builds a bare minimum OS distribution (with minimal footprint). This footprint can be dumped on to your VPS or real server and your server no more sucks GBs of space just for OS distribution on it. This is very useful for small applications with small resources and adds a great ease for extremely large clustered systems.
Here comes sneOS 1.1 with ambitions to meet above goals. I am thankful to the team at Heurion Consulting Pvt Ltd which is bringing sneOS up again. It is available for download here. This unstable version is a 70Mb linux distribution which runs entirely in the RAM reducing all disk access time for OS to do its house keeping. This is a small yet a great value contribution from Heurion Consulting. This is not yet in stage where it can be deployed onto servers , You will still need to patch things to get your rails app up (though it has rails 2.0). You can play around with it and reply back with your feedbacks, my current focus is to get minimum footprint OS for rails environment. I am aggressively looking for people who can support this initiative. So if you want to take charge just modify the ramdisk image and reduce its size to as low as possible which ofcourse shouldnt break anything.

How do you take criticism?

2007-10-18T11:30:00.000+05:30

Did it ever happen to you, that you built something very innovative as a solution to some problem and few people around you who neither understand the problem nor importance of solution and just start criticizing your work without knowing head or tail?

This wonderful quote tells truth:

It is not the critic who counts; not the man who points out how the strong man stumbles, or where the doer of deeds could have done them better. The credit belongs to the man who is actually in the arena, whose face is marred by dust and sweat and blood; who strives valiantly; who errs, who comes short again and again, because there is no effort without error and shortcoming; but who does actually strive to do the deeds; who knows great enthusiasms, the great devotions; who spends himself in a worthy cause; who at the best knows in the end the triumph of high achievement, and who at the worst, if he fails, at least fails while daring greatly, so that his place shall never be with those cold and timid souls who neither know victory nor defeat.

- Theodore Roosevelt

Developer's ignorance allows visitors to send free SMS all over india

2007-07-30T10:41:00.000+05:30

UPDATE: This problem was resolved the next day after I informed the MD of the service company

This morning, I was wondering what would be the worst consequence of a mistake made by a software architect, perhaps it is to give access to SMS/telephony server due to poor developer coding. I see lot of web2.0 apps around, trying to make best out of javascript to give new functionalities. In my view, many of the solution architects just try to fit conventional application model to web2.0 apps. The next generation web 2.0 apps need lot of thinking when it comes to "communication" and "security". I am surprised , few developers still make silly mistakes due to ignorance which may cost alot to the company. An hour back, I was too disappointed to discover a flaw in the application of india's famous directory service, JustDial. This company has been successfully providing directory service from very long time. Their website, www.justdial.com, allows visitors to search locations/people/products all across india. Visitors can search an item and then choose to recieve details via SMS on mobile. As I am a web 2.0 technologist, and have been working on "communication" and "security" aspects, I just gave a closer look to this service and figured out the weak aspects of communication. Exploiting the flaws (just for experiment) , I could write a shell script for sending bulk messages to my friends and surprised them. As I explored, homepage of this website submits the search keywords , city & searchtype to the server and ,in return, obtains a unique php session id (which has very small timeouts set on server) along with search results. But the worst part is, result also contains certain hidden fields which stores preformated sms text which can be sent back with users phone / email id. When user choose to send an email , his/her phone/email is asked, on submit sms text also travels back with phone number and email id. The key element of entire client/server communication is the hidden form element named 'sinfo'. Hence if you trap this communication in between and change sms text and format it accordingly you can send custom messages to anybody and not just that, if you are developer like me, just write a shell script and you can be sending timed bulk sms messages. Though, I am not going to discuss idea of writing shell script here (I respect justdial service), You can follow these steps to test above flaw and send message to anybody across india.

Steps
1.) Open http://search.justdial.com/ in your web browser (I use firefox).
2.) select a city and enter your search keywords and press enter (I selected Bangalore, searched "masala dosa")
3.) you will get category of products , select one (I clicked "Pan Masala")
4.) you will see list of contacts along with "Send to Mobile/Email" click this link.
5.) you will now see a dialog asking phone number / email id, but before you enter your details read next point..
6.) Copy below given script to browser's address bar and press enter (ofcourse, everything will come in 1 line) , you will be asked the mesg you want to send.

javascript:alert("Successfully encoded sms :"+(document.smsAlert.smsDet.value = "0800000000#!#!#080g007006#!#!#"+prompt('your message')+"#!#!#G#!#!#A#!#!#A#!#!# #!#!# #!#!#560032#!#!#Bangalore#!#!##!#!#+(91)-0#!#!##!#!##!#!#spam@sms.ip6.in#!#!#"));

7.) now just enter the recipient's mobile number and press "send now"

Thats it, You have sent a free sms. Well, I am sure developer of this service will really get hurt to know this flaw, I too feel bad for this, but the point I want to make is that we got to evolve some solid technology foundation that should help web developers design better systems in next generation web.

Signaling 37signals... please wake up

2007-04-20T18:09:00.000+05:30

I have been a fan of 37signals, their babies- Rails, basecamp, writeboard are just amazing apps. But I have a true story to share today, I am upset about a fact I discovered an hour ago. 37signals, unknowingly is playing with trust of many companies. writeboard.com is a tool used by many people to collaborate and communicate. if you are using it then I am sure , after reading this blog post, you will give it a thought before you rely on any third party tool like writeboard. So let me share my story of discovery...

I was browsing and doing a google search casually, for finding info about few people I met this week. I suddenly reached to a link pointing to 123.writeboard.com/(something) , This page asks for authentication! but Oooops google cache for the same page doesn't! unfortunately it presented me html of a whole communication of a team regarding a product development of a well known company. That says that google has cached those urls... It opened every thing the team did for the project... (poor team, they blindly believed that their ideas are safe!). I found that google has cached these set of urls very recently...

if you want to test this...
follow these steps:

1.) go to google or gigablast and search for site:123.writeboard.com or click here

2.) go to cached page of any result following url pattern similar to 123.writeboard.com/6412f6bf670e164bc/feed/c010fedd01c01896eb0fedd01adc8e

3.) You should see some content as html source... just create wakeup37.html and copy this content, save and open in your browser



Wake up 37signals!



'regards
Abhishek Parolkar
MD5 Signature: 2f:4a:7b:56:54:e7:4e:c9:1b:c1:b2:e8:ea:59:c7:d2
website: http://abhishek.parolkar.com
email: abhishek@parolkar.com
===================================================
"Life is not a journey to the grave with the intention to arrive safely in a pretty and well-preserved body, but rather to skid in broadside, thoroughly used up, totally worn out, and loudly proclaiming: Wow!! What a ride!"
===================================================

Dhishoom Dheeshoom with DLINK 502-T Router

2006-09-23T12:05:00.000+05:30

Aahhhh! It was matter of setting up a webserver at my company and deploying an intranet application. Whole week was gone , tweaking somebody's (Dru***pal! )code. And I was thinking I could have written my own Content Management System from scratch. Well! things went fine.. app works fine now and is deployed on a old age piece of hardware for testing.

And goal was to expose it to world of internet!

Uuuuuhhh! but murphy's law never fails! (I respect Murphy! :-)),
The most easiest task of forwarding http port from a DLINK 502-T Router, turned into sleepless night for me and reeshi(sys admin). The site was not accessible to world of internet because this little naughty:-) device was blocking the ports (we thought so). We upgraded its firmware and configured virtual server. Things didnt work.. we booted , rebooted ... and rebooted.. this little device, thinking it has problem handling packet traffic or ...hmm (so many threads of thinking).... And suddenly at 2 o clock in night (when murphy nakshatra was over). I got thought of looking in to our main internal gateway (cum webserver) and thats it. OOOOOOh dude! thats the firewall game, I said. We reconfigured the big brother's (internal gateway) firewall and magic happened...

I felt bad for the little tiny DLINK router... It had to bear all our hard experiments... I personally want to apologise, "Sorry little fellow device!".

Wow ! Windows Live Search

2006-09-22T11:14:00.000+05:30

Today for the first time i used Windows live search, and performed a ego search , to realise that my old old institute recognises me and my achievements ... nice to know.. Thank you sapthagiri!

Back to blogging

2006-08-07T13:00:00.000+05:30

hellooooooooouuu....
Oh god... so so so... long... I didnt touch my blog.. Well I am now back... With lots of excitement.

The new thing happening to me these days is ruby... so ....

I ammmmmmmmmm comming up..
so... you better get the party started

The Big Idea

2005-09-12T18:51:00.000+05:30

Hellooooooooooooooooou,
"The earth really looks like a tennis ball if you have an idea to change its spin"

"An Idea can change life" (a punch line of Ad).......... well thats really 'true'..... In last couple of days I read many articles about successfull business people and innovators.... they all have one thing in common... "The Big Idea".... Everyone of them had a concept which was totally different ... which they used in their lifetime to prove their potential... I picked up a nice book to explore this more... luckily its title is "The Big Idea" by Robert Jones ...

The book initially seemed to be as any other motivational book talking about Do's and Don'ts.... But gained lot of my attention... When I started thinking on What makes a Great Man?... Is greatness accountable? When is someone accepted as great?... The book had case studies and examples... Which made me think about people, who start from scratch and has turned into leaders and innovators... But the Big Question is Who is called a great man? and What does greatness mean to that great man?

After spending lots of time thinking, I decided to analyse different personalities and their character traits. I was interested in knowing about their Thinking Process. I believe , its just thinking that makes someone great. I got to know.. that..... They think broad... They think in long terms... They all, think different... They all believe in applying their own knowledge which is gained from experience... They have ability to learn and feel from others experience... They dont fear of failure thru wrong decisions... They are happy with failure that is brought by decisions they made and which are not controlled by anybody else . They respect other's thinking and originality . Taking high risk is their habbit. Most importantly.... "they are always hungry and unsatisfied from their creativity".

'Abhishek Parolkar
www.parolkar.com