<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>The ForwardBias Blog</title>
	<atom:link href="http://blog.forwardbias.in/feed" rel="self" type="application/rss+xml" />
	<link>http://blog.forwardbias.in</link>
	<description>The Official Blog of ForwardBias Technologies</description>
	<lastBuildDate>Sat, 15 Dec 2012 05:31:44 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.5.1</generator>
		<item>
		<title>My XSRF exploit of build.phonegap.com</title>
		<link>http://blog.forwardbias.in/2012/12/my-xsrf-exploit-of-build-phonegap-com.html</link>
		<comments>http://blog.forwardbias.in/2012/12/my-xsrf-exploit-of-build-phonegap-com.html#comments</comments>
		<pubDate>Sat, 15 Dec 2012 05:05:14 +0000</pubDate>
		<dc:creator>girish</dc:creator>
				<category><![CDATA[girish]]></category>
		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://blog.forwardbias.in/?p=408</guid>
		<description><![CDATA[PhoneGap Build is a nice service from Adobe. You upload your PhoneGap application and it builds Android, iOS packages on the cloud. PhoneGap Build also provides an API for it&#8217;s service. I used the API to create pgbuild to automate the upload of the PhoneGap application source and download the built packages. The exploit I [...]]]></description>
				<content:encoded><![CDATA[<p><a href="https://build.phonegap.com/">PhoneGap Build</a> is a nice service from Adobe. You upload your PhoneGap application and it builds Android, iOS packages on the cloud. PhoneGap Build also provides an <a href="https://build.phonegap.com/docs/api">API</a> for it&#8217;s service. I used the API to create <a href="https://npmjs.org/package/pgbuild">pgbuild</a> to automate the upload of the PhoneGap application source and download the built packages.</p>
<p>The exploit I found has to do with the JSONP API (scroll to the end of the <a href="https://build.phonegap.com/docs/api">api</a> page). Using the exploit, one can read a logged in user&#8217;s registered apps, initiate a rebuild of the apps etc.</p>
<p>The exploit itself is fairly trivial, if you understand how browsers work. If you just want to know the exploit scroll to the very end. The goal of this post is to provide a high level overview of how browser security and xsrf-style exploits work. Let&#8217;s start with Same Origin Policy.</p>
<h4>Same Origin Policy</h4>
<p>Browsers are very anal (for good reasons) about what resources a web page can access. A web page served from foo.com can only access resources from foo.com. This principle is called <a href="http://tools.ietf.org/html/draft-abarth-principles-of-origin-00">Same-Origin Policy</a>. The policy is applied to JavaScript, HTML, file:// protocol and each has it&#8217;s exceptions. For HTML, the <i>img</i> tag, for example, can have url&#8217;s that point to an arbitrary website. The <i>script</i> tag and <i>style</i> tag can have the src attribute set to content from arbitrary websites.</p>
<h4>Cookies</h4>
<p>Whenever the browser makes a request, it sends across the cookies that have been set for that domain. This is true even for the cross-domain img and script tags. For example, let&#8217;s assume that you were logged into your bank. Without logging out, if you navigate to evil.com which has <i>img src=&#8221;http://bank.com&#8221;</i> somewhere inside it, your browser will make a request to bank.com with the cookies of bank.com set. The bank might provide personal information about you (since cookies have been provided) and dutifully serve the web page. It&#8217;s as if you had typed bank.com in the url bar of the browser (smart browsers will set the HTTP accept header when requesting an image and smart servers will check that header, but that is another story). Thankfully, the response from bank.com is most likely some HTML and the browser will fail to load it as an image. Your bank content is thus not introspectable by evil.com. The same goes for the script tag. Since HTML cannot be executed as a script, the browser just ignores the response.</p>
<h4>Same-Origin policy is restrictive</h4>
<p>One of the main reasons tags like img, script are excused from same-origin policy is for ease of development of the web. It&#8217;s nice to be able to link to external images and to reuse scripts from another domain that one owns. However, the same-origin policy is restrictive for sharing &#8220;data&#8221; between domains. Data is usually offered by web services as XML or JSON. Unfortunately, the popular way for web pages to fetch data &#8211; XHR (aka AJAX), also follows the same origin policy.</p>
<h4>JSONP &#8211; Sharing data across domains</h4>
<p><a href="http://bob.ippoli.to/archives/2005/12/05/remote-json-jsonp/">JSONP</a> (JSON with padding) takes advantage of the fact that script tags can point to different domains. A web page author issues a cross-domain API call that returns JSON data as part of the script tag. For example,</p>
<pre>
&lt;script src="service.com/api/get_posts_as_json"&gt; &lt;/script&gt;
</pre>
<p>The result of the above call is JSON which not valid JavaScript. The browser will ignore the above just like it ignored HTML in the previous bank example. We need to somehow make the output of above a valid JavaScript. With JSONP, one writes:</p>
<pre>
function processPosts(result) { ... }

&lt;script src="service.com/api/get_posts_as_json?callback=processPosts"&gt;&lt;/script&gt;
</pre>
<p>service.com sees the callback parameter and responds with <code>processPosts(json_result)</code> which is valid JavaScript. All we have to do is to provide an implementation of processPosts function somewhere in our web page.</p>
<h4>The exploit</h4>
<p>First thing to notice about the build.phonegap.com&#8217;s JSONP API is that it uses build.phonegap.com as it&#8217;s domain. This is interesting because the main website is also hosted on build.phonegap.com. This means that if a user is logged into the build.phonegap.com, a evil web page can issue JSONP API calls with the user&#8217;s credentials.</p>
<p>Usually, &#8220;APIs&#8221; are hosted in a domain separate from the website. For example, api.service.com for API access and www.service.com for the website. This means that api.service.com can safely have JSONP support since the cookies from www.service.com and api.service.com won&#8217;t mix.</p>
<p>If APIs and the websites are hosted in the same domain distinguished only by path, then one needs to be more careful. For example, http://build.phonegap.com/api provides API access and http://build.phonegap.com/apps provides the website. Cookies do have a &#8216;path&#8217; attribute which can be used to tell the browser that different paths in same domain don&#8217;t mix. However, http://build.phonegap.com/apps  set the cookies in the &#8216;/&#8217; path. This meant that cookies will be provided for http://build.phonegap.com/api too. </p>
<p>Do you see the exploit now? All I had to do was to use the JSONP api to access user information. In case you were wondering, exploits where evil websites steal credentials of a user or impersonate the unwitting user are called Cross-Site Request Forgery attacks (CSRF or XSRF).</p>
<h4>Sample exploit code</h4>
<p>Once you are logged onto build.phonegap.com, navigate to the links below:<br />
Example 1 &#8211; <a href="http://www.forwardbias.in/data/articles/pgbuild-exploit-listapps.html">List Your Apps</a><br />
Example 2 &#8211; <a href="http://www.forwardbias.in/data/articles/pgbuild-exploit-rebuild.html">Rebuild Your Apps</a> (WARNING: Don&#8217;t Click unless you know what you are doing)</p>
<h4>Possible fixes</h4>
<p>Since I don&#8217;t have access to build.phonegap.com code, I can only guess a few possible fixes</p>
<li> Strip out cookies when processing JSONP and rely on the HTTP auth header or the API token.
<li> Make the website set cookies with path as /apps.
<li> Remove JSONP support and add support for <a href="http://www.w3.org/TR/cors/">CORS</a>.
<li> Move api access to a separate domain.<br />
<h4>Current status</h4>
<p>I informed Adobe before this blog post and they quickly fixed the problem (I haven&#8217;t checked how).</p>
]]></content:encoded>
			<wfw:commentRss>http://blog.forwardbias.in/2012/12/my-xsrf-exploit-of-build-phonegap-com.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Blowfish for Qt</title>
		<link>http://blog.forwardbias.in/2012/05/blowfish-for-qt.html</link>
		<comments>http://blog.forwardbias.in/2012/05/blowfish-for-qt.html#comments</comments>
		<pubDate>Wed, 23 May 2012 06:13:30 +0000</pubDate>
		<dc:creator>roop</dc:creator>
				<category><![CDATA[encryption]]></category>
		<category><![CDATA[opensource]]></category>
		<category><![CDATA[Qt]]></category>
		<category><![CDATA[roop]]></category>

		<guid isPermaLink="false">http://blog.forwardbias.in/?p=401</guid>
		<description><![CDATA[Notekeeper uses Blowfish for encryption. Over the last few days, I separated out the encryption code, cleaned it up, and added some tests. And the result is QBlowfish &#8211; a Qt implementation of the Blowfish encryption algorithm. Blowfish requires the input size (in bytes) to be in multiples of 8. So QBlowfish optionally adds PKCS5 padding [...]]]></description>
				<content:encoded><![CDATA[<p><a href="http://www.notekeeperapp.com/">Notekeeper</a> uses <a href="http://www.schneier.com/blowfish.html">Blowfish</a> for encryption. Over the last few days, I separated out the encryption code, cleaned it up, and added some tests. And the result is <a href="https://github.com/roop/qblowfish">QBlowfish</a> &#8211; a Qt implementation of the Blowfish encryption algorithm.</p>
<p>Blowfish requires the input size (in bytes) to be in multiples of 8. So QBlowfish optionally adds <a href="http://tools.ietf.org/html/rfc5652#section-6.3">PKCS5 padding</a> to the input data to make its size a multiple of 8. (For example, if the input is only 60 bytes long, 4 bytes will be padded to bring the bytecount to a multiple of 8.) When padding is enabled during decryption, QBlowfish will also remove the padded bytes from the output.</p>
<p>QBlowfish is meant to be compiled with your code &#8211; you just drop in 3 files into your project. Then you can do stuff like:</p>
<blockquote>
<pre>QBlowfish blowfishObj("Some secret key");
blowfishObj.setPaddingEnabled(true);
QByteArray clearText("Some stuff to encrypt");
QByteArray encryptedBa = blowfishObj.encrypted(clearText);
QByteArray decryptedBa = blowfishObj.decrypted(encryptedBa);</pre>
</blockquote>
<p>You can get the code from github <a href="https://github.com/roop/qblowfish">here</a>.</p>
]]></content:encoded>
			<wfw:commentRss>http://blog.forwardbias.in/2012/05/blowfish-for-qt.html/feed</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Why did we make a Symbian app?</title>
		<link>http://blog.forwardbias.in/2012/04/why-did-we-make-a-symbian-app.html</link>
		<comments>http://blog.forwardbias.in/2012/04/why-did-we-make-a-symbian-app.html#comments</comments>
		<pubDate>Sat, 07 Apr 2012 08:54:03 +0000</pubDate>
		<dc:creator>roop</dc:creator>
				<category><![CDATA[notekeeper]]></category>
		<category><![CDATA[Qt]]></category>
		<category><![CDATA[roop]]></category>
		<category><![CDATA[symbian]]></category>

		<guid isPermaLink="false">http://blog.forwardbias.in/?p=382</guid>
		<description><![CDATA[With Notekeeper, we have our first paid app in the Nokia Store. So, why did we create an app for Symbian, despite it being one of the least popular smartphone platforms out there? Back in July 2011, I had just started using Evernote on my iPad, and I really liked the service. But I missed [...]]]></description>
				<content:encoded><![CDATA[<p>With <a href="http://www.notekeeperapp.com/">Notekeeper</a>, we have our first paid app in the Nokia Store. So, why did we create an app for Symbian, despite it being one of the least popular smartphone platforms out there?</p>
<p>Back in July 2011, I had just started using Evernote on my iPad, and I really liked the service. But I missed having access to those notes on my Nokia phone. The Evernote discussion forum had quite a few requests for a Symbian client, but Evernote had made it clear that they had <a href="http://discussion.evernote.com/topic/16353-evernote-app-for-symbian-and-i-buy-a-premium-account/page__view__findpost__p__82175">no plans to make one</a>.</p>
<p>Given that background, it&#8217;s no surprise that I started thinking about writing an Evernote client for Symbian myself. Here&#8217;s my thought process on deciding whether to go ahead and do it or not:</p>
<p><strong>Genuine need:</strong> Like me, I could see that many others wanted an app like this, and they were expressing their need in <a href="http://thameera.wordpress.com/2011/05/04/symbian-and-evernote/">blogs</a>, <a href="http://discussions.nokiausa.com/t5/Phone-Applications/We-need-Evernote-for-Symbian-3/td-p/1045949">forums</a> and <a href="http://conversations.nokia.com/2011/12/19/deep-dive-evernote/">comments</a>.</p>
<p><strong>Market size:</strong> There are significant number of phones running Symbian^3 today. Given that Notekeeper is Qt-based, I could have picked Symbian^3 or N9 as the first release platform. Symbian^3 won purely on market size.<sup><a href="http://blog.forwardbias.in/2012/04/why-did-we-make-a-symbian-app.html#footnote_0_382" id="identifier_0_382" class="footnote-link footnote-identifier-link" title="16.8 million Symbian^3 devices sold in Q3 2011 alone, given that the &ldquo;Smart devices&rdquo; mentioned here couldn&rsquo;t have included the N9, which started shipping only in the last week of that quarter. The number of N9s shipped has not been made public, but my guess is that it&rsquo;s far less than the number of Symbian^3 devices sold.">1</a></sup> The number of people who buy Symbian^3 phones is on a steep decline, but Notekeeper targets those who already have these phones, not those who&#8217;re going to buy them.</p>
<p><strong>Niche problem:</strong> The addressable market might not be as big. The prevalent perception is that the subset of Nokia phone owners who would want to pay for an app is much smaller. So, an app that solves one niche problem well is a good fit for iOS, but might not be a good idea on Symbian. Can accessing Evernote (or, to generalize, accessing a cloud-based note-taking service) in Symbian be considered a niche problem? Maybe. <a href="http://www.intomobile.com/2011/06/02/3-missing-apps-symbian-platform/">Maybe not</a>.</p>
<p><strong>Pricing:</strong> On a somewhat related note, even if the app solves a problem people have, and solves it well, there might be a reluctance to pay a premium price (like in <a href="http://www.papermill.me/firstweeks/">the case of PaperMill</a> for Android). Of course, there have also been instances where a quality app has sold well: <a href="http://conversations.nokia.com/2011/08/02/appstravaganza-interview-with-jan-ole-suhr-gravity/">Gravity</a>.<br />
Given these, I thought the risks were well worth taking and went ahead with creating Notekeeper.</p>
<p><strong>Future:</strong> Symbian isn&#8217;t quite dead yet, but it&#8217;s days are numbered.<sup><a href="http://blog.forwardbias.in/2012/04/why-did-we-make-a-symbian-app.html#footnote_1_382" id="identifier_1_382" class="footnote-link footnote-identifier-link" title="Updates and support for Symbian will continue &ldquo;atleast upto&rdquo; 2016.">2</a></sup> Qt5 won&#8217;t support Symbian, as was known long back,<sup><a href="http://blog.forwardbias.in/2012/04/why-did-we-make-a-symbian-app.html#footnote_2_382" id="identifier_2_382" class="footnote-link footnote-identifier-link" title="&ldquo;The initial thinking is that Qt 5 will focus on a small set of operating systems/platforms (i.e. platforms Wayland and X11 on Linux, Mac and Windows)&rdquo; &ndash; Qt Blog,&nbsp;May 2011">3</a></sup> but it has no business doing that &#8211; major Qt releases are for the long term (Qt4 was released in 2005, and will be in use for a few more years to come), and there&#8217;s no need for Symbian support when Nokia&#8217;s strategy is to move out of Symbian. That said, there&#8217;s a lot happening with the immediate future of Symbian in mind: Qt 4.8 already runs on Symbian, and a good amount of Symbian-specific work<sup><a href="http://blog.forwardbias.in/2012/04/why-did-we-make-a-symbian-app.html#footnote_3_382" id="identifier_3_382" class="footnote-link footnote-identifier-link" title="Changes in Qt 4.8.1">4</a></sup> has gone into Qt 4.8.1, <a href="http://blog.qt.nokia.com/2012/03/28/qt-4-8-1-libraries-for-windows-mac-and-linuxx11-released-as-stand-alone-download/">released last week</a>.</p>
<p>So, given that the future is not with Symbian, we won&#8217;t be writing Symbian apps a few years from now. But right now, it doesn&#8217;t look like it&#8217;s such a bad idea.</p>
<ol class="footnotes"><li id="footnote_0_382" class="footnote">16.8 million Symbian^3 devices sold in Q3 2011 alone, given that the &#8220;Smart devices&#8221; mentioned <a href="http://press.nokia.com/2011/10/20/nokia-q3-2011-net-sales-eur-9-0-billion-non-ifrs-eps-eur-0-03-reported-eps-eur-0-02/">here</a> couldn&#8217;t have included the N9, which <a href="http://press.nokia.com/2011/09/27/nokia-n9-begins-shipping/">started shipping</a> only in the last week of that quarter. The number of N9s shipped has <a href="http://www.slashgear.com/nokia-silent-on-n9-sales-as-meego-kept-out-of-spotlight-26210826/">not been made public</a>, but my guess is that it&#8217;s far less than the number of Symbian^3 devices sold.</li><li id="footnote_1_382" class="footnote">Updates and support for Symbian will continue <a href="http://conversations.nokia.com/2011/05/26/stephen-elop-in-china-time-for-a-challenger-mindset-video/">&#8220;atleast upto&#8221; 2016</a>.</li><li id="footnote_2_382" class="footnote">&#8220;The initial thinking is that Qt 5 will focus on a small set of operating systems/platforms (i.e. platforms Wayland and X11 on Linux, Mac and Windows)&#8221; &#8211; Qt Blog, <a href="http://labs.qt.nokia.com/2011/05/09/thoughts-about-qt-5/">May 2011</a></li><li id="footnote_3_382" class="footnote"><a href="http://qt.nokia.com/products/changes/changes-4.8.1/">Changes in Qt 4.8.1</a></li></ol>]]></content:encoded>
			<wfw:commentRss>http://blog.forwardbias.in/2012/04/why-did-we-make-a-symbian-app.html/feed</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>Coming soon: Evernote meets Symbian</title>
		<link>http://blog.forwardbias.in/2012/03/evernote-meets-symbian.html</link>
		<comments>http://blog.forwardbias.in/2012/03/evernote-meets-symbian.html#comments</comments>
		<pubDate>Fri, 23 Mar 2012 17:32:58 +0000</pubDate>
		<dc:creator>roop</dc:creator>
				<category><![CDATA[notekeeper]]></category>
		<category><![CDATA[Qt]]></category>
		<category><![CDATA[roop]]></category>
		<category><![CDATA[symbian]]></category>

		<guid isPermaLink="false">http://blog.forwardbias.in/?p=359</guid>
		<description><![CDATA[Evernote is a fantastic note-taking service, and one of its strengths is that it&#8217;s available on a lot of platforms. Nevertheless, Symbian has always lacked a proper Evernote client1. Till now. Notekeeper is a Qt app I have developed that acts as an Evernote client for Symbian Anna / Belle devices. Key features are: Notes [...]]]></description>
				<content:encoded><![CDATA[<p><a title="Evernote" href="http://www.evernote.com/">Evernote</a> is a fantastic note-taking service, and one of its strengths is that it&#8217;s available on a lot of platforms. Nevertheless, Symbian has always lacked a proper Evernote client<sup><a href="http://blog.forwardbias.in/2012/03/evernote-meets-symbian.html#footnote_0_359" id="identifier_0_359" class="footnote-link footnote-identifier-link" title="Not counting WRT widgets like this and this">1</a></sup>. Till now.</p>
<p>Notekeeper is a Qt app I have developed that acts as an Evernote client for Symbian Anna / Belle devices. Key features are:</p>
<ul>
<li>Notes can be created / edited even without an internet connection; changes will be pushed to Evernote during the next sync</li>
<li>Supports notebooks, tags</li>
<li>Lets you search for a note</li>
<li>Can access rich text notes (but these notes are not freely editable)</li>
<li>Can see images in notes (but cannot add / remove images, for now<sup><a href="http://blog.forwardbias.in/2012/03/evernote-meets-symbian.html#footnote_1_359" id="identifier_1_359" class="footnote-link footnote-identifier-link" title="Adding / removing images is planned for the next release">2</a></sup>)</li>
<li>Supports favourite notes and offline notebooks</li>
</ul>
<div id="attachment_362" class="wp-caption alignnone" style="width: 500px"><img class="size-full wp-image-362" title="notekeeper_preview" src="http://blog.forwardbias.in/wp-content/uploads/2012/03/notekeeper_preview.png" alt="Notekeeper preview" width="490" height="438" /><p class="wp-caption-text">Notekeeper: Start screen, Plain text note and Rich text note</p></div>
<p>I&#8217;m currently testing and bugfixing the app. I hope to get it published in the Nokia Store in about a week or so as a paid app. I&#8217;m also considering making a trial version for people to try before buying.</p>
<p>The app uses a Qt/C++ backend to talk to the Evernote Cloud API, and wraps it all up with a UI designed with QML and Qt Quick Components. Many thanks to Evernote for offering a complete, well-designed and free API to access their service, which makes it possible to create an app like this.</p>
<p><em>Update Apr 7, 2012:</em> Notekeeper <a href="http://blog.notekeeperapp.com/post/20279121526/launched-notekeeper">has launched</a>. Trial version is undergoing QA.</p>
<ol class="footnotes"><li id="footnote_0_359" class="footnote">Not counting <a href="http://www.developer.nokia.com/Develop/Web/">WRT</a> widgets like <a href="http://discussion.evernote.com/topic/8230-update-for-evernote-for-nokia-n97-beta-available-70302/">this</a> and <a href="http://spanishgringo.blogspot.in/2009/09/symbiannote-evernote-for-symbian-my.html">this</a></li><li id="footnote_1_359" class="footnote">Adding / removing images is planned for the next release</li></ol>]]></content:encoded>
			<wfw:commentRss>http://blog.forwardbias.in/2012/03/evernote-meets-symbian.html/feed</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>Qt Quick Best Practices</title>
		<link>http://blog.forwardbias.in/2011/12/qt-quick-best-practices.html</link>
		<comments>http://blog.forwardbias.in/2011/12/qt-quick-best-practices.html#comments</comments>
		<pubDate>Mon, 19 Dec 2011 04:10:47 +0000</pubDate>
		<dc:creator>girish</dc:creator>
				<category><![CDATA[girish]]></category>
		<category><![CDATA[KDE]]></category>
		<category><![CDATA[Qt]]></category>

		<guid isPermaLink="false">http://blog.forwardbias.in/?p=356</guid>
		<description><![CDATA[I noticed that the video and slides for my Qt Dev Days 2011 talk in Munich are now online. Here&#8217;s the video and here are the slides. I couldn&#8217;t attend the event in San Francisco because I had to attend to some personal matters. Johannes and Donald covered for me there on very short notice [...]]]></description>
				<content:encoded><![CDATA[<p>I noticed that the video and slides for my Qt Dev Days 2011 talk in Munich are now online. Here&#8217;s the <a href="http://developer.qt.nokia.com/videos/watch/qt-quick-best-practices-and-design-patterns">video</a> and here are the <a href="http://get.qt.nokia.com/videos/DevDays2011/TechnicalSessions/DevDays2011_-_Qt_Quick_Best_Practices_And_Design_Patterns.pdf">slides</a>.</p>
<p>I couldn&#8217;t attend the event in San Francisco because I had to attend to some personal matters. Johannes and Donald covered for me there on very short notice (thanks guys!). For that matter, I have been mostly &#8216;offline&#8217; for the last 2 months or so and will continue to be offline for atleast end of this month. So, if you sent me mail, I will get back at some point <img src='http://blog.forwardbias.in/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' /> </p>
]]></content:encoded>
			<wfw:commentRss>http://blog.forwardbias.in/2011/12/qt-quick-best-practices.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Sharing wifi connection over ethernet</title>
		<link>http://blog.forwardbias.in/2011/11/sharing-wifi-connection-over-ethernet.html</link>
		<comments>http://blog.forwardbias.in/2011/11/sharing-wifi-connection-over-ethernet.html#comments</comments>
		<pubDate>Wed, 16 Nov 2011 16:52:20 +0000</pubDate>
		<dc:creator>girish</dc:creator>
				<category><![CDATA[arch]]></category>
		<category><![CDATA[girish]]></category>

		<guid isPermaLink="false">http://blog.forwardbias.in/?p=345</guid>
		<description><![CDATA[I have a wireless router at home which is physically far from the place I actually work. I required an internet connection to update my Arch machine. I could use wpa_supplicant to connect to internet using wifi but I thought I would explore the option of connecting my laptop back to back with another that [...]]]></description>
				<content:encoded><![CDATA[<p>I have a wireless router at home which is physically far from the place I actually work. I required an internet connection to update my Arch machine. I could use <a href="https://wiki.archlinux.org/index.php/WPA_supplicant">wpa_supplicant</a> to connect to internet using wifi but I thought I would explore the option of connecting my laptop back to back with another that already had a wifi connection.</p>
<p>Let&#8217;s call the computer with wifi connected to the router as I (as in connected to Internet). Let&#8217;s call the other computer C.</p>
<p>1. Connect I and C using normal ethernet cable. You don&#8217;t really need a cross-over cable since most ethernet cards these days are smart enough to do <a href="http://en.wikipedia.org/wiki/Ethernet_crossover_cable#Automatic_crossover">automatic cross-over</a>.</p>
<p>2. Select a IP range for the ethernet connection between I and C. I chose 192.168.10.x.</p>
<p>3. On computer I, set the ip : <code>sudo ip addr add 192.168.10.1/24 dev eth0</code></p>
<p>4. On computer I, Enable ip forwarding and setup iptables to masquerate (nat) the wifi connection.<br />
<code><br />
sysctl -w net.ipv4.ip_forward=1<br />
iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE<br />
</code></p>
<p>5. On Computer I, install and configure dnsmasq. dnsmasq is a dhcp and dns server. The only configuration I needed after installing dnsmasq was adding a line &#8220;dhcp-range=192.168.10.100,192.168.10.150,12h&#8221; in /etc/dnsmasq.conf. That line specifes the ip range for dhcp leased addresses and the validity time. dns support is enabled by default, so nothing to configure there.</p>
<p>6. Run dnsmasq. Just &#8220;sudo dnsmasq&#8221;. I actually used &#8220;dnsmasq &#8211;no-daemon&#8221; which lets me the see the debug output on the console.</p>
<p>That&#8217;s it. Computer C should not get an IP address and be able to access the internet. You can use &#8216;dhclient eth0&#8242; or &#8216;dhcpcd eth0&#8242; to get an IP address through DHCP.</p>
]]></content:encoded>
			<wfw:commentRss>http://blog.forwardbias.in/2011/11/sharing-wifi-connection-over-ethernet.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Qt DevDays 2011</title>
		<link>http://blog.forwardbias.in/2011/10/qt-devdays-2011.html</link>
		<comments>http://blog.forwardbias.in/2011/10/qt-devdays-2011.html#comments</comments>
		<pubDate>Fri, 21 Oct 2011 14:34:11 +0000</pubDate>
		<dc:creator>girish</dc:creator>
				<category><![CDATA[girish]]></category>
		<category><![CDATA[KDE]]></category>
		<category><![CDATA[Qt]]></category>

		<guid isPermaLink="false">http://blog.forwardbias.in/?p=340</guid>
		<description><![CDATA[I am just about to catch my flight to Munich to attend Qt Developer Days 2011 where I will be giving a talk on Qt Quick Best Practices. I have been working with QML exclusively for over a year now and this talk is in essence a summary of all the things I have learnt [...]]]></description>
				<content:encoded><![CDATA[<p>I am just about to catch my flight to Munich to attend <a href="http://qt.nokia.com/qtdevdays2011/">Qt Developer Days</a> 2011 where I will be giving a talk on <a href="http://qt.nokia.com/qtdevdays2011/qt-technical-sessions#qtbestpractices">Qt Quick Best Practices</a>. I have been working with QML exclusively for over a year now and this talk is in essence a summary of all the things I have learnt about it. This will also be my 6th developer days as attendee and third time as a speaker.</p>
<p>Am really looking forward to interesting conversations about Qt5, Qt Quick and the <a href="http://labs.qt.nokia.com/2011/10/21/the-qt-project-is-live/">Qt project</a> <img src='http://blog.forwardbias.in/wp-includes/images/smilies/icon_smile.gif' alt=':-)' class='wp-smiley' /> </p>
]]></content:encoded>
			<wfw:commentRss>http://blog.forwardbias.in/2011/10/qt-devdays-2011.html/feed</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>When sqlite queries fail for no reason</title>
		<link>http://blog.forwardbias.in/2011/08/when-sqlite-queries-fail-for-no-reason.html</link>
		<comments>http://blog.forwardbias.in/2011/08/when-sqlite-queries-fail-for-no-reason.html#comments</comments>
		<pubDate>Sat, 20 Aug 2011 04:47:33 +0000</pubDate>
		<dc:creator>girish</dc:creator>
				<category><![CDATA[girish]]></category>
		<category><![CDATA[KDE]]></category>
		<category><![CDATA[Qt]]></category>

		<guid isPermaLink="false">http://blog.forwardbias.in/?p=329</guid>
		<description><![CDATA[If you have worked with QtSql, you might have hit the dreaded &#8220;Parameter count mismatch&#8221; for your perfectly valid SQL query. The problem is excruciatingly hard to debug because the query itself works perfectly fine with the sqlite3 tool. Here&#8217;s the solution: Compile Qt with -system-sqlite. The problem: Qt uses it&#8217;s own sqlite3 headers under [...]]]></description>
				<content:encoded><![CDATA[<p>If you have worked with QtSql, you might have hit the dreaded &#8220;Parameter count mismatch&#8221; for your perfectly valid SQL query. The problem is excruciatingly hard to debug because the query itself works perfectly fine with the sqlite3 tool.</p>
<p>Here&#8217;s the solution: Compile Qt with -system-sqlite.</p>
<p>The problem: Qt uses it&#8217;s own sqlite3 headers under src/3rdparty by default which are completely out of date. Qt 4.7 has sqlite3 header from 2009-10-14 version 3.6.18. Almost 2 years old and current sqlite version is 3.7.7! That&#8217;s like using Qt 4.5.3 in 2011 <img src='http://blog.forwardbias.in/wp-includes/images/smilies/icon_smile.gif' alt=':-)' class='wp-smiley' />   FTS3/4 table queries fail consistently when using Qt&#8217;s own headers.</p>
<p>I have opened <a href="https://bugreports.qt.nokia.com/browse/QTBUG-21040">QTBUG-21040</a>.</p>
]]></content:encoded>
			<wfw:commentRss>http://blog.forwardbias.in/2011/08/when-sqlite-queries-fail-for-no-reason.html/feed</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
		<item>
		<title>On WebKit and WebKit2</title>
		<link>http://blog.forwardbias.in/2011/08/on-webkit-and-webkit2.html</link>
		<comments>http://blog.forwardbias.in/2011/08/on-webkit-and-webkit2.html#comments</comments>
		<pubDate>Tue, 09 Aug 2011 07:18:49 +0000</pubDate>
		<dc:creator>girish</dc:creator>
				<category><![CDATA[girish]]></category>
		<category><![CDATA[KDE]]></category>
		<category><![CDATA[Qt]]></category>

		<guid isPermaLink="false">http://blog.forwardbias.in/?p=318</guid>
		<description><![CDATA[Ever heard of WebKit2 and wondering what it means from a Qt perspective? Here&#8217;s an attempt to explain QtWebKit and QtWebKit2 in simple terms. I make no attempt to be completely technically correct, it&#8217;s meant to be able to explain terminology to the WebKit uninitiated. In WebKit lingo, &#8220;WebCore&#8221; is the thing that takes of [...]]]></description>
				<content:encoded><![CDATA[<p>Ever heard of WebKit2 and wondering what it means from a Qt perspective? Here&#8217;s an attempt to explain QtWebKit and QtWebKit2 in simple terms. I make no attempt to be completely technically correct, it&#8217;s meant to be able to explain terminology to the WebKit uninitiated.</p>
<p>In WebKit lingo, &#8220;WebCore&#8221; is the thing that takes of parsing/layouting/rendering of various css/svg/html documents, providing DOM bindings etc. &#8220;JavaScriptCore&#8221; implements JavaScript support and is also referred to as SFX (Squirrel fish Extreme). JavaScriptCore can be used as a stand alone JavaScript engine and has no dependencies on WebCore. WebCore uses JavaScriptCore to support JavaScript in web pages. WebCore also contains support for NPAPI plugins (like flash). &#8220;WebKit&#8221; uses the WebCore to build a platform/toolkit specific API. For example, the Qt &#8220;WebKit&#8221; port provides <a href="http://doc.qt.nokia.com/4.7-snapshot/qwebelement.html">QWebElement</a> which exposes the WebCore&#8217;s DOM. By definition, WebKit is platform/toolkit/port specific. The Qt port is simply called QtWebKit.</p>
<p>The QtWebKit port is released periodically independent of Qt releases. These ports have the number QtWebKit 2.0, QtWebKit 2.1, QtWebKit 2.2 etc. QtWebKit 2.0 is identical to what was shipped with Qt 4.7.0. QtWebKit 2.1, intended to be mobile friendly, is not part of any shipping Qt release. QtWebKit 2.2, which will be shipped as part of the upcoming Qt 4.8.0, is yet to be released.</p>
<p>Now for WebKit2. The first and most important thing you should know about WebKit2 (even before you know what WebKit2 is) is that WebKit2 is NEITHER AN UPGRADE NOR A NEWER RELEASE of WebKit. It is a parallel port that can happily co-exist with &#8220;WebKit&#8221;. Let me reiterate: Stop trying to think of WebKit2 as WebKit version 2 <img src='http://blog.forwardbias.in/wp-includes/images/smilies/icon_smile.gif' alt=':-)' class='wp-smiley' />  Think of it as a completely different API from existing WebKit.</p>
<p>WebKit is the traditional in-process renderer. If you create 100 web pages, they all reside in one process. If one page causes a crash, it brings everything down. WebKit2 provides a system and an API to make it possible to render a page in a separate process. The process management is taken care of by WebKit2. The actual rendering of the page happens using WebCore. WebKit2, therefore, spawns out processes, renders pages in these processes and makes the end result available to the application. It provides mechanisms deliver events from the application to the rendering process. The Qt port of WebKit2 is simply called QtWebKit2. QtWebKit2 is what is used in the N9 browser.</p>
<p>White-space has never been more important. QtWebKit 2.x is a completely different beast from QtWebKit2. QtWebKit 2.x is plain old QtWebKit releases. QtWebKit2 is Qt&#8217;s port of WebKit2. This unfortunate naming is a result of Apple announcing WebKit2 shortly after the Qt guys deciding to call their releases QtWebKit 2.x.</p>
<p>WebKit2 and Chromium are similar in their goal. Chromium does not use WebKit2 and probably never will. The Chromium code was intended for the chromium browser specifically. The WebKit2 code was designed upfront to be an API. This difference in motivation resulted in different implementations. See <a href="http://trac.webkit.org/wiki/WebKit2">this page</a> for more details.</p>
<p>Because of the multi-process nature of QtWebKit2, many APIs that existed in QtWebKit simply don&#8217;t exist anymore. WebKit2 design lends itself to an asynchronous API compared to WebKit where most API was synchronous. For example, DOM introspection of web pages using QWebElement is not possible since the web page&#8217;s DOM resides in another process.</p>
<p>QtWebKit2 has a hard dependency on Qt5 and is very much a moving target like Qt5. QtWebKit will probably not work well with Qt5, we have to wait and see.</p>
<p><strong>Current status: </strong> Nokia&#8217;s Qt WebKit team has decided to focus on QtWebKit2. They have decided to pass on maintainership of QtWebKit to <a href="https://lists.webkit.org/pipermail/webkit-dev/2011-July/017460.html">someone else</a>. At the time of writing, there is no publicly announced appointed maintainer to QtWebKit.</p>
<p>Update: Mentioned about QtWebKit 2.x releases based on Jocelyn&#8217;s comment.</p>
]]></content:encoded>
			<wfw:commentRss>http://blog.forwardbias.in/2011/08/on-webkit-and-webkit2.html/feed</wfw:commentRss>
		<slash:comments>15</slash:comments>
		</item>
		<item>
		<title>Qt/Caca Lighthouse Plugin</title>
		<link>http://blog.forwardbias.in/2011/07/qtcaca-lighthouse-plugin.html</link>
		<comments>http://blog.forwardbias.in/2011/07/qtcaca-lighthouse-plugin.html#comments</comments>
		<pubDate>Mon, 18 Jul 2011 11:05:42 +0000</pubDate>
		<dc:creator>girish</dc:creator>
				<category><![CDATA[girish]]></category>
		<category><![CDATA[KDE]]></category>
		<category><![CDATA[Qt]]></category>

		<guid isPermaLink="false">http://blog.forwardbias.in/?p=307</guid>
		<description><![CDATA[At the Qt Contributors Summit, Johannes&#8216; showed me his Qt/Caca Lighthouse plugin. Caca is a graphics library to output text instead of pixels. So this plugin lets you run Qt programs on the console His code needed some love, so I forked it and cleaned it up. Caca does not provide a event fd and [...]]]></description>
				<content:encoded><![CDATA[<p><img class="aligncenter size-full wp-image-309" title="lighthouse_ascii" src="http://blog.forwardbias.in/wp-content/uploads/2011/07/lighthouse_ascii.png" alt="lighthouse_ascii" width="384" height="675" /></p>
<p>At the Qt Contributors Summit, <a href="https://gitorious.org/~nebulon">Johannes</a>&#8216; showed me his Qt/Caca Lighthouse plugin. <a href="http://caca.zoy.org/wiki/libcaca">Caca</a> is a graphics library to output text instead of pixels. So this plugin lets you run Qt programs on the console <img src='http://blog.forwardbias.in/wp-includes/images/smilies/icon_smile.gif' alt=':-)' class='wp-smiley' /> </p>
<p>His code needed some love, so I forked it and cleaned it up. Caca does not provide a event fd and so we have to keep polling caca for events. Since this wasn&#8217;t ideal, I moved the event handling to a separate thread and blocked for events. Unfortunately, I found that the caca library is not thread-safe and rendering and processing events in separate threads makes caca crash at randomly. So, I ended up moving the rendering to the event processing thread and having to resurrect the 20ms event timer again <img src='http://blog.forwardbias.in/wp-includes/images/smilies/icon_sad.gif' alt=':-(' class='wp-smiley' />  The cool thing though is that now Qt renders to QImage in the main ui thread and hands it off to caca. Caca opens a X connection (or similar), converts the image into text, displays a window and handles events in another thread. With some refactoring and thanks to QMetaObject::invokeMethod, the threaded and non-threaded rendering are pretty much the same and can be switched using an environment variable (THREADED_CACA=1).</p>
<p><a href="http://www.youtube.com/watch?v=ZJyF99uqSbY">Animated tiles</a>:<br />
<iframe width="425" height="349" src="http://www.youtube.com/embed/ZJyF99uqSbY?hl=en&#038;fs=1" frameborder="0" allowfullscreen></iframe></p>
<p>If you want to hack further, code is on <a href="https://qt.gitorious.org/~girish/qt/caca-lighthouse">gitorious</a>. (Caca doesn&#8217;t seem to deliver gpm events with ncurses, so that would be a nice fix to have)</p>
<p><strong>Update</strong>: Welcome <a href="http://it.slashdot.org/story/11/07/19/177243/Qt-For-the-Console">slashdot</a> readers</p>
]]></content:encoded>
			<wfw:commentRss>http://blog.forwardbias.in/2011/07/qtcaca-lighthouse-plugin.html/feed</wfw:commentRss>
		<slash:comments>21</slash:comments>
		</item>
	</channel>
</rss>
