Name

Leif Andersen

Email/IRC/WWW

Email – *******

IRC – Leif/LeifAndersen

WWW – http://leifandersen.net

Synopsis

Most of the time, end users can, and will, open blender files without fear, and with good cause. They trade them around without fear, and nothing bad happens. However, for some uses of blender, such as when it is being run on a headless server, this can be a bit of a problem. Thus, some sort of solution is needed to ensure the security of blend files, without being a burden on the artists, but allow people who want to have a secure copy of blender, be able to. The solution to this, is GPG file signing.

There are many problems with choosing other options for security. The absolute worst option would be to have a dialog asking the artist to confirm that they want to open the blend file or run the script. Not only would no artists read it, simply clicking through, but if blender is running on a headless server, waiting for user input before continuing could be detrimental to being able to use servers for running such blend files. The problem with blender’s current system, is that it’s not scalable. As blender grows, and the amount of plugins increase, the current team of people that look at the scrips will either have to grow, or the quality of their work would have to diminish to allow for a greater quantity of work, or there would be a great backlog of plugins. Furthermore, although unlikely, it is possible that the amount of plugins for blender could reach some sort of critical mass, and no longer be easily stored on a centralized page. Finally, even with a centralized plugin system, it is theoretically possible for someone to modify the plugin, and pose as if it was from the official plugin page, which would damage it’s credibility. Other solutions, such as sandboxing python, have been deemed impossible at this point in time.

GPG signing, unlike other models, would allow for an expandable, transparent, or possibly translucent if that is what artists would prefer, model for securing blender. Most artists will want to be able to exchange files freely, without worrying about where the file came from, who made it, and how, they simply want to use it. Other users, such as those making a public render farm, would likely want to protect their hardware, and only allow for scripts signed by the blender foundation or institute, to run on their servers. There is also a plethora of users who would rely in the middle, such as a user who only wants to trust a few sources, and the sources that they trust. GPG signing, would meet all of those needs, easily and with whatever level of transparency that both the blender community, and even the individual Blender user and artist, needs and wants. Finally, this model is completely compatible with Blender’s current security model. Packages that are scanned, and proven good by the current plugin maintenance team, could sign the plugin with a key associated with the Blender Foundation.

Benefits to Blender

The most obvious benefit to blender is added security, without making any form of compromises of speed, usability, or even crippling the language. Furthermore, if this were to go through, plugins could be added to blender similarly to how packages are installed with a package manager in many modern versions of Linux. Whether or not it ever does become a requirement that the blend files and scripts Blender opens needs to be signed (even if it’s self signed, analogous to how Android apps work, it would be possible for Blender artists to easily manage their plugins.

Imagine the following scenario. Some user Tom is a blenderhead. He is just a hobbies, using Blender for a few videos that he uploads to websites such as blip.tv. Tom also has learned a thing or two about python, and has written a python script, to make making his shorts a bit easier. However, Tom finds that he doesn’t have the hardware needed to render his videos in the quality he would like. As such, he uploads his files to a render farm. The render farm, Rendly, cares about the security of their computers. As such, Rendly will only run files that are verified by the Blender Foundation, or a small subset of other plugins that they’ve made, and trust. Tom really wants Rendly to render his files for him, but as he is not a person with authority to sign his files with the Blender Foundation public key, hey can’t. However, Tom realities that there is something he can do. He goes to the Blender Artists and Coder communities, and them to look over the plugin, and sign it for him. Tom gets John to sign his plugin for him. John is trusted by the Blender Foundation, and while his public key is not that of the blender foundation, it is one that the Blender Foundation does recognize. Because the Blender Foundation recognizes John’s key, so does Rendly. This means that Tom is now able to run his plugin on Rendly’s render farm. In comes Charly, he is a very malicious person, and hopes to damage Rendly’s render farm. Because of this, he downloads Tom’s script from his website, and changes the code to do bad things to the computer it’s running on. He then makes a blend file that uses that script, and sends it to Rendly’s servers. Rendly sees the GPG key that John signed it with, and realizes that the Blender Foundation will vouch for it. Rendly then looks at the checksum embedded into John’s signature, and notices that it does not match that of the file in question. Rendly notices that the file has been tampered with, and does not run it. Rendly than sends a notice to Charly, informing him of the problem, and asks him to get someone to resign the file. As the file is malicious, Charly could try and trick someone who is trusted by the Blender Foundation to sign it. However, the people the Blender Foundation trusts, manage to see the problem in the script, and refuse to sign it. Thus, in order for Charly to run his script on other people’s computer’s, he must distribute it via some type of medium such as the Blender Artists forum. Other Blender artists could download the file, and run it, as the vanilla version of Blender is capable of running self signed files, and possibly files with no signature. However, other artists notice a problem with the script, and remove it, leaving Charly with no credibility. Charly could sign up with a new pseudonym, but the same result would happen.

The reason why this is much better than trusting in email signing, or signing a zip file, is because it removes portability. While it is entirely possible for something like the Blender Foundation to sign a zip file, the moment it is unwrapped to be used, it is no longer guaranteed to be trusted. However, if it is embedded within the data itself, it would allow the artist to unwrap and work with the script, and be able to re-bundle it in his own project, and still maintain the certificate. Thus, given the above mentioned scenario, if Tom wanted to have Rendly render his project, and Rendly required some form of security, either Rendly would have to manually keep all of the files that the Blender Foundation made, and Tom would have to make his file accordingly, which is bad on a plethora of levels. First Rendly would have to keep each version of the script to maintain compatibility to what the artist was using, also Rendly may not have the absolute latest script that Tom has in his project. The other solution is that Tom would submit the script with his project. But if that were the case, he would be forced to make an effort to submit the file archived in the exact form (although theoretically not necessarily the exact same package), that the archive originally came with, which provides lots of unnecessary headaches. With the signatures embedded within the file, Tom could have imported the script, while keeping the signature, and Rendly could go through all of the scripts stored in the project, and ensure that they were signed by someone Rendly trusts, all seamlessly. Also, another user, say Steve, should be able to take Tom’s project, and expand upon it. Any particular elements made by Tom, could be, with Tom’s permission, signed with his signature. Thus, the portions of Tom’s work that had not been modified, can be trusted by anyone who trusts Tom, and possibly another layer deep. It is because of this embedded nature that makes this project much longer than simply a week long project to slap a GPG signature into Blender files.

Deliverables

The bulk portion of this project will be research and development. Even if the nonexistent, magical powers of bug free, rapidly built projects allows me to finish a perfectly working model by the time the summer is over, it is futile for Blender to implement a code signing requirement so quickly to the core of Blender, it would completely break backwards compatibility, not to mention all of the artists current projects would completely break. As such, the final product for this project will be a prototype for integrating GPG, or a similar system, into Blender. The actual integration will happen in several smaller steps, that will allow projects and other plugins plenty of time to work with GPG signing.

Research and development will also include the documentation needed to understand how the signing will work, along with some experiments to see just how transparent of a system the Blender Community wants, whether it be completely transparent, or have elements of translucency in it. (Aka, save, save and sign, sign but don’t save, etc. etc.). While the documentation will itself be simply a prototype, it should be a good framework, or launchpad, for creating the final documentation when it is fully integrated into blender.

Project Details

The full integration of a signing system will span more than a single summer contains. However, the development of a working prototype should be doable within the span of a month. The full implementation of the entire project will take part in several steps.

First, there needs to be quite a lot of Research into the matter. A false sense of security can be even worse than no security whatsoever. As such, if this is going to be done, it must be done right. I already have a vague understanding of the blender codebase, by doing some tinkering here and there, along with an basic knowledge of how GPG, key singing, and asymmetric public private key pairs work, however, I need a very firm grasp on how both work in order to make a secure system. The more abstract knowledge is very simple, however, it is possible that the details can be very hairy.

Next, preliminary steps need to be made in order to figure out how to combine the two packages. With a blend file being just a chunk of data struct into one file, it is very important to add it properly. In this step, basic preliminary feedback should be gained, to determine the best way to integrate it. This does not simply mean shoving a key into blend files and other files that blender produces. That could be done relatively easily. This does include, but is not limited to, including key signing for different portions of blend files, and possibly a simple API to allow for other programs to access these keys.

The next step, and the final one expected to happen over this summer, is the building of the first prototype. This will require to parts. The first part is to design blend files and scripts that are capable of containing signed content. The second part is to have a prototype reader for blender, that is capable of parsing through a key, to make sure it is authentic. At this stage it should not be translucent at all, but rather only an option for cutting edge beta testers.

Once Blender files are capable of containing keys and signatures, and Blender, even by some extension, is capable of reading them, the next logical step is to begin integrating it into blender. The preliminary user tests found in the second stage now must be augmented to include more robust testing, to ensure that whatever the solution is, it is neither cumbersome to the artists and other users, and doesn’t make them feel like they are being tracked when they don’t want to be. The question of whether files should be autosigned, or if it should be only an option, should be answered here. Once this stage is completed, Blender should work for unsigned files. If it required signed files at this stage, much should break.

This next stage could possibly be the easiest, or the hardest stage of the whole process. By this point, the signing system should be mature. Thus, only minor usability tweaks, and bug should be made at this stage. It should be thought of as a late Bcon-3, or maybe Bcon-4. The main reason for the existence of this phase, is because current script developers need a fairly hefty grace period before they sign (even self sign), their scripts.

Finally, assuming that everything goes well, signing should be required as a standard to run files. Obviously, if the blender community has reservations against this, changes to that statement will be made as necessary. Also, there does need to be some measure for backwards comparability, sand boxing won’t work, but this is to be discovered during the development of this project.

Again, only the first few parts of this project are to be completed as a GSoC project.

Project Schedule

As mentioned earlier, I am already vaguely familiar with the current blender codebase, and with the concepts of asymmetric keys, and GPG. This should drastically cut down on the amount of research and development needed for this project. Also, I am capable of beginning work on the project early on in May, before the official start date. Here is a possible schedule for the project. The dates are completely flexible, and will be changed as needed.

Once this project is complete, work on the final product will commence. The time line for this will depend greatly on the events that happen during the GSoC period.

I may spend a week during the first part of July on vacation. I will continue to work on the code during this week. However, due to limited internet connectivity, communication will have to be limited to daily email that week.

In short, I will have no work or school over the summer. Per request, I do not intend to take any summer classes, unless I’m explicit told that I can. Even then though, it would only be one differential equations mathematics class. The only work that I have done is freelance tutoring. However, as the majority of schools in this area will be out, I will not be spending any time on that.

Bio

First and foremost, I am a United States Citizen. It is possible that this would be a problem for developing GPG, due to US encryption laws. However, as I would be mainly implementing it, rather than actually improving on the current encryption, this is likely not a problem. However, it still merits research.

I am a 19 year old computer engineering and mathematics student studying at the University of Utah. I first started programming in 2001 when my parents bought a copy of Interplay’s Learn to Program Baisc, a CD designed to get adolescence interested in computer science by making simple video games. Still interested in video games, I then went on to try out Mark Overmar’s Game Maker (now controlled by Yoyo Games). There, I created several platformers, and space shooters. Also interested in multimedia and web production, I picked up a copy of Macromedia Flash MX 2004, and made several small games and animations with that. I even created a small website to show off some of my work, originally programmed in basic HTML with simple Javascript, and then I moved to Dreamweaver. In an attempt to break out of two space graphics, I found Blender. Initially overwhelmed by all of the buttons, knobs, sliders, menus, modes, and hotkeys, I eventually started creating several still pictures. I then moved on to basic animations and character animations, and a few very simple games. When I found the video sequencer, I used it to slap together several films.

I started getting very serious with programming when I went to university. There, the main classes that they have taught in was Java. As such, that is the language the majority of my code has been in. Currently, my most ambitious, although certainly not my most well written, completed project was a file compressor, which turned out to do very little compression whatsoever. I have a large chunk of my code available for checkout on my website. However, just because the majority of my code is in Java, that does not mean I don’t know, and use other languages. Mainly to stretch my legs with C, but also as something to do in my time, I’ve started working on a simple pong game.

I’ve started contributing to Blender by creating an OFF exporter and importer, which was in Blender 2.4x, but not 2.5x. I have made several small tweaks with the Blender codebase, along with doing some minor bug tracking. Also, I am currently looking into the folder blender/source/tools, to see, as reported on the file system page, if it is really being used at all.ⁱ Currently, Scons will compile without it, however, it does still have some obscure purposes, which could use some updating.

All in all, I know Java, C, Python, Matlab, and to a lesser extent C++, Objective-C, Basic, Lisp, HTML, and a bit of PHP and Javascript.

http://www.amazon.com/Learn-Program-Basic-Windows-Macintosh/dp/B000N3W2L4

http://gamemaker.nl/

http://leifandersen.blip.tv

http://sourceforge.net/projects/lcompress/

svn://leifandersen.net

http://sourceforge.net/projects/pongrpg/

https://projects.blender.org/tracker/index.php?func=detail&aid=21717&group_id=153&atid=467

https://projects.blender.org/tracker/?func=detail&aid=21811&group_id=153&atid=467

https://projects.blender.org/tracker/index.php?func=detail&aid=21725&group_id=9&atid=125

And here is the third Java lecture I’ve made.  Again, you can watch them at http://leifandersen.blip.tv

Oh, and for the record, youtube is still evil.  I got permission to cross post to youtube, and let’s just say that I still can’t upload videos longer than 10 minutes.

After much fighting, I finally was able to upload the episodes to blip.tv.  So, without further ado, here are the first two lectures, I will try to produce another one each week, but no promises.  (Also, if you noticed that the videos don’t show up, and you get a bunch of text in [], please leave a comment saying as such, the reason for this is due to lack of portability of how I made the videos play).

Unctuous Programming 1: Introduction

Read the rest of this entry »

Happy Merry Chrismohonsiquanica, or however it’s spelled, everyone.  I thought that it would be a good time to share some holiday cheer, as such, I have a series of videos, and whatnot that celebrate this time of year.  I do not own these cheers, and am only linking to them from other webpages.  Contact me if any of these links turn out to be dead.

First up, we have a video on the true meaning of Christmass, thanks to the guys over at Loading Ready Run.

Read the rest of this entry »

On today’s episode, I continue on my hatred of youtube.  I also go over facebooks 11 billion dollar worth, and want my check in the mail.

Get the show here:

http://www.archive.org/download/Rant5/Rant5-015_vbr.mp3

Links for today’s show:

http://www.techcrunch.com/2009/12/21/most-recent-facebook-common-stock-sale-values-company-at-11-billion/

Image by: T?inecké železárny

What we know, how we came to be, and what is the whole point of the universe really?  These are three big questions, that seem to get asked a lot.  By religious people, who use it to point out how obvious (it is to them) that a God, or gods, exist.  And the scientists who take the opportunity to point out (how obvious it is to them) that religion is wrong, because they believe that they have all the answers.  Sure, both sides, especially the scientists, admit that they don’t know everything, the religious people saying that ‘God knows everything’, and the scientists, being a bit more agnostic, either say it’s impossible to know everything, or that it is possible, but we are very far from it, however, neither side actually acts with an open mind, despite how much they say they do.  The ironic thing though, is that by saying that, both sides are stating that they know for absolute certainty something about the universe, something, that could possibly in the next hundred or so years, be proven false, do to humanity thinking in a c completely different paradigm that we can’t even fathom at this point in time.

The point of this article is not to discuss evolution, nor to discuss global warming, which I have already have written about.  But rather, to criticise both sides, for the amount of cliché they use, the amount of straw man, snowball effect, and other logical fallacies they use in order to prove with absolute certainty (in their minds) that something is false.  Do I blame them?  No, not a bit, in fact, from time to time, I find myself doing it, which leads me to believe that I’m doing it even more when I’m not meta-conscious.  But please, try to keep an open mind.  Religious people, maybe, just maybe, we did evolve from more simple forms of life.  Or even more fundamental, maybe, just maybe, the concept of God is something that we made, even if not meaning to, in order to give us comfort, something our biology has made an integral part of us.  Scientists, maybe, just maybe, God exists, he may or may not have wanted the Bible, or other forms of scripture, to exist, and maybe  he isn’t anything like what any major religion imagined him to be, but maybe he does exist.  Maybe our idea of the scientific method is wrong altogether.  Sure, it has served us well in the past, but we didn’t actually get the scientific method by the scientific method, at some point we did have to use induction.

An Antebellum era (pre-civil war) family Bible dating to 1859. By David Ball

When I go into a religious setting, I tend to find people who have proven scientifically (in their minds), that God exists.  I begin talking to them, and any time I point out a possible problem with their ‘fact’, they start proving it with other facts, and usually return very fast, using a circular argument, ie God made us because it’s too unlikely we could have evolved, I ask why after all is not anything forbidden, mandatory, or given enough time, anything improbable will happen, at which point they say no.  I point out how they could be wrong, and they continue to talk about how it is illogical, and against anything God would make.  I also have known people to say that they have open minds, just so long as they are good God-fearing people, isn’t that a contradiction.  What if someone were to come up with some magical way of proving he did or didn’t.  I am not a God hater, as some people have branded me as, but rather, for this subject, I am agnostic.  I see no possible way to prove or disprove God.  Even if we did find some gene, or brain activity that caused humanity to believe in God, could not some group of people state how that is sure-fire proof that God exists, as he made us in such a way that we would look up to him?  So, until I come up with some possible way to prove or disprove it, I do not care, and hope that you will continue to think of me as a descent human being, who is seeking absolute truth and knowledge, if indeed, it actually does exist.

On the flip side of the coin.  Scientists, you don’t know everything either.  Maybe we will prove that the scientific method is wrong, or missing something.  And maybe in another millenia we will prove that that new paradigm was wrong altogether too.  From my experience, everything has been relative.  Laws have been broken, Newton’s laws have been rendered invalid at a quantum level, Einstein’s Relativity and String Theory are, at this point in time, completely incompatible with each other.  Sure you may say that they’re incompatible now, but theoretical physicists will eventually find a way to make it work.  Sure, I’ll go with that.  In fact, I’ll even give you your answer.  Q.  The way to solve all of your physics problems is Q.  When asked what Q is, I’ll simply state that it is the answer that makes physics work.  Just append it onto every equation we’ve ever used, we’ll call it the fudge factor, or maybe the Picardian, it makes physics work.  Now the careful scientist will point out that this isn’t following Occam’s Razor.  Just adding a Q onto every equation doesn’t make it more simple.  And to that, I really do applaud you.  Still though, isn’t that how the five flavours of string theory managed to become converge though?  Just by throwing in an eleventh dimension.  Yes, I’m certain there is more math involved, and if any of you happen to know it, please tell me, I really do love math, science, and engineerig (after all, I am majoring in computer engineering at the University of Utah, and possibly minoring or majoring in mathematics), however, it still sounds like you are throwing on another dimension to make it work.  This is the type of science that has proven the higgs boson to exist, either it doesn’t want to be found, or we have found it.  Also, no, that is not a new thing, long before the recent study about the LHC being sabotaged by the future, physicists seamed to speculate that it the higgs existed, and we just haven’t found a way to see it, yet.  Also, what if Occam’s Razor is incorrect in the first place, after all, is it not also just an observation that was made?

At some point we do have to throw in the towel.  We do admit we don’t know everything, even the most fanatical people admit that.  And in order to stop speculating about what is true, what is good, and what we should and should not do, we just plunge in, and take a risk.  Not only that, but rarely do we just stick our belief in just the bible, or just in the science textbook.  Rather, most people that I have seen, look about them.  To a certain extent, they act as scientists.  Taking in any form of input they can get, and processing it with both reason and emotion.  With both what makes sense, and what feels right to them.  And to that, I say good job, I do the same thing.  But maybe someone has had a different set of experiences than you, maybe the way they are set up, causes them to value something differently.  Maybe there’s something we have yet to consider.  The moral of the story though, is that just because someone believes something different than you, that doesn’t mean they’re instantly wrong.  I admit it, this whole paper could be wrong.  But to me, it feels true and good, and I will stand behind it so long as it continue to feel that way.  So please, rather than constantly trying to make your argument look better by tearing others down, why not make yours better, by listening to them.  By valuing what they have to say, by considering their beliefs, despite how illogical they may seem, or may even be.  People are people, we all make mistakes, let’s grow together, whether or not there is a God, whether or not we evolved, whether or not I am just off of my rocker.

I am Leif Andersen, and I am a sceptic, who tries to keep an open mind, even if he fails a lot.

Update:  Upon further contemplation upon this subject, I don’t think this argument is specific to just science and religion.  For example, I see this to a large extent in software, where one group of people believe very passionately about  a certain way of making software, and how it should be delivered, such as open source, where as another group cares more about how it looks, and the hierarchy structure of the people that make it, such as Apple.