Theoretical & Applied Problems

— Barry Mazur, Foreword to Fearless Symmetry

The Best of Discrete & Recreational Maths

This is a work in progress! It will showcase some of the best, most underrated theorems in maths. Stay tuned and wait for your mind to be blown — or if you're impatient, solve the math jester challenges and submit your solutions to see the deeper meaning behind each problem.

Geometry

• Edmond Boyer's introduction to Projective Geometry.

Linear Algebra

• Invertibility Theorems. They're really amazing. Try experimenting with some matrices and get an intuition for the components of this theorem!

Recreational Maths

• Continued Fractions

  1. Continued Fractions described in a very engaging Plus Magazine article.

'Tis not too late to seek a newer world.
Push constants to the stack machines,
And sitting well in order smite
The sounding furrows; for my purpose holds
To sail beyond the VM stacks, and the baths
Of all the western stars, until I die.
It may be that the GOOG will wash us down;
It may be we shall touch the Hasty Likes,
And see the great Turing, whom we knew.
Though much is taken, much abides; and tho'
We are not now that strength which in old days
Moved earth and heaven, that which we are, we are,
One equal temper of heroic hearts,
Made weak by time and fate, but strong in will
To strive, to seek, to find,
and not to yield [control].

— Based on "Ulysses" by Alfred Lord Tennyson (1809-1892)
Modded by FX of Phenoelit; republished in Phrack Magazine

Code Exploits

How to Know When You're in a Simulation

• Can you escape from a VM?

Every year, nay, every month, there are new security vulnerabilities being found and exploited. This is especially true viz-à-viz our phones. Here I intend to keep a consolidated list of security vulnerabilities related to people's phones — security holes that most people are blissfully unaware of.

• WiFi and Bluetooth "coexistence" attacks on Broadcom chips.

Cellular data plans got more affordable during recent years and cellular network coverage increased. Disabling Wi-Fi by default and only enabling it when using trusted networks can be considered a good security practice, even if cumbersome.

The paper's mitigation recommendation includes "disabling Wi-Fi by default," which suggests that we should be using mobile network data plans by default instead. However, using these networks has drawbacks and security vulnerabilities of its own:

• Man-in-the-Middle attacks can be launched during the handover protocols. You might argue that this only applies when you're on-the-move (and thus triggering a handover routine), and this appears to be true. However, other exploits are even scarier.
• Stay tuned...

There are even modern exploits that use the phone's sensors, including the gyroscope, to collect data on the phone's user. Take a look at those articles, and Dr. Guri's site for more.

Stay secure, my friends.

— Edsger Dijkstra

Corollary: The best computer science courses are the ones that don't ever require you to touch a computer.

— The Math Jester

Fancy Algorithms

This is a place to collect interesting algorithms, many of which I did not even learn in my university curricula. Join me on a tour of some eye-opening algorithms. These are genuinely impressive creative accomplishments.

• WFC
• LR
• FFT
• LZ-77

— Louis Brandy

The C++ Dialogues

This is a collection of dialogues, some real and others imaginary, which help to solidify knowledge of C++. If you're reading this, please treat these as approachable lessons and parables, inspired by those in The Number Devil, Fearless Symmetry, and other books. The best part is, the code provided is easily copiable — so you can verify the results on your machine!

Prerequisite: These parables are geared toward someone with knowledge of C.

Disclaimer: They are provided as a reference^[1] with NO WARRANTY.

• [0001] Tedious Troubles, part 1 — a more practical discussion about how actions that are simple in other languages are not so simple in C++. Normally, the tradeoff is worth it, but this is the perfect example of a task that becomes overly tedious to code quickly in C++.
• [1002] The Instantiation Paradox — an imaginary dialogue, based on real struggles in understanding C++ through the lens of C. It is technically a work-in-progress, but mostly finished.
• [1003] C Linkage — an imaginary dialogue, based on even more compatibility problems between C and C++.
• [2001] Template Trouble, part 1 — an attempt to help solidify the syntax for template methods and template classes in C++. Be patient for this one...
• [2003] Understanding LValue and RValue References — an explanation, complete with diagrams, about RValue references, to settle my confusion once and for all. Again, be patient.
• [2990] Conversations with a Guru (external!) — existing narratives, written by Herb Stutter and Jim Hyslop, which provide additional inspiration for these dialogues. I especially recommend the talk on null references.
• [2992] C++ Seniores Blog (external!) — a more modern, up-to-date blog with a treasure trove of features and oddities from C++. Explore them. You won't be disappointed.
• [5001] Advice from the Gods: Move Semantics — a dialogue adapted from a real conversation on IRC.
• [5002] The C++17 Standard — a dialogue to help us remember the features introduced in modern C++ standards.

^[1] no pun intended.

Python — The Twitter of Programming Languages

1. A significant fraction, between 11 and 46 percent, of packages distributed on PyPI have security vulnerabilities.


2. Whitespace is required. No language should require a particular quantity of blank space. Rather, the interpreter should be more concerned about semantics than about forcing a certain formatting scheme. More specifically, curly brackets should always be an option for the programmer to use to specify the bounds of a control structure.


3. Variables do not have a scope. You can have a variable that is defined within a nested control structure and use it outside that control structure by accident (e.g., by merely copying and pasting code and forgetting to rename a variable reference)! This has happened to me before, and it is insane.


4. Common English words, like sum, min, and list, are built-in functions in CPython, so it is a bad practice to use them as identifiers. This may not sound like such a bad thing — after all, it incentivizes you to "just use more descriptive names" — but it also restricts the developer's ability to write code that (a) is good-quality (using distinct variable names) and (b) doesn't take too long to write, e.g. for Advent of Code challenges, etc. It also appears to be an inescapable feature (is it not?).


5. People give you a weird look for using semicolons to demarcate the end of a statement.


6. Error messages are so often counter-intuitive and unclear. Allow me to present some examples.

This message is infuriatingly vague. It uses one and only one line to describe the error, and the description uses no more than six words. It does not state which expression corresponds to the 'int' object (e.g., is it newBoardState, or is it newBoardState[size-1]? etc.). It also does not give any column index, so this information cannot be easily inferred. In fact, because python is dynamically typed, it is difficult enough to track down the error: whereas a compiler would have checked this ahead of time before blindly running the program, with errors like these, the programmer must waste time re-checking the code manually. In this case, the error was caused on an earlier line of code, so as it turns out, the line being printed isn't even that helpful.

How fun, another six-word message. The documentation suggests that find_elements_by_class_name is a valid method on a Selenium webdriver. In practice, it does not exist; no problem, it is probably a simple matter of different versions in use. But then, why should the error mention a "NoneType object" if the selenium_driver object is not a NoneType?? If it is a method that is not found, then this should be made as clear and consistent as possible, without using any ambiguous or counter-intuitive language about "NoneType objects." Anything else runs a high risk of communicating poorly and acting smug when you're misunderstood:

Does python have a rule that their error messages cannot exceed six words??? Apparently, even though I am printing the value of loc and see it displayed as a string, I soon discover that the variable loc is not even a string. This is yet another perfect example of how dynamic typing causes headaches and confusion at runtime.

The auto-casting rules in JavaScript always confused me. Let me reproduce a table to explain why.

The reason why this is so confusing is partly because it is not self-consistent: if you pass a variable through multiple stages of conversion, its boolean value may change in unexpected ways. If you read a string from the user, and they type "false", then casting that string to a boolean yields true, but casting it to a number and THEN casting to a boolean yields false. Casting [3, 14] to a number and THEN to a boolean yields false, but converting it directly to a boolean yeilds true. See what I mean?

But it gets even worse.

When you are working with an array, and you try to retrieve an element outside its bounds, you get an undefined. Simple enough, right? But here's the problem: you can manually set a value in the array to undefined (in which case the array length doesn't change!), and you can even set a value of the array at an out-of-bounds index! This is absurd because it violates the very concept of a fixed-length array.

But it gets even worse.

It turns out that, much like PyPI packages have security vuilnerabilities, so do the packages on NodeJS.

This reinforces a joke I have made in the past: that Python and JavaScript are in constant competition for the title "Least Enjoyable Programming Language."

Every time I have this discussion with a C# fanboy it always goes like this:

Here are some obscure protocols & FOSS applications, if you're into that sort of thing:

• IRC
• V-tools: gprbuild and gnat?

• scrcpy

This is a program that will allow you to access an Android phone from your laptop. After a lot of struggling and debugging, I have successfully tested this program from my Linux machine.

I also want to save this bookmark about restarting the ADB server — which addresses an error I frequently got when running scrcpy.

To access my phone and send texts from my computer has been a dream of mine for years (I will make a blog post about this sooner or later). Now this dream is becoming a reality!

• GNU Net

• In January 2021, I re-installed Devuan on my daily-driver Linux laptop. In September of that year, I decided to experiment with this operating system, so I updated apt sources in order to include "chimaera," the more experimental repository. But when I did a reboot, I could no longer even decrypt my disk drive, let alone log in!!
• The error message read, "libgcc_s.so.1 must be installed for pthread_cancel to work".
• Short-term solution
• Worry not, I said to myself. In the short run, I have a way to decrypt and access my data using a Devuan livecd that I attach to the same hardware.
• Update: This process has been a bit tedious, so I ended up writing a shell script to run these same routines (decrypting the drive, copying my SSH key and browser profile, etc.) automatically. I debugged it some more. It is reproduced below in case it turns out to be helpful to anyone else -- but be forewarned, it does require some review & customization before you run it:

How I Fixed My OS

As it turns out, this is caused by an upgrade to GCC 10 and libpthread.

The thread above claims that "the upload of gcc-10 moved libgcc_s.so to /lib instead of /lib/x86_64-linux-gnu." But, on my machine, the library is in /lib/x86_64-linux-gnu and not in /lib. I try copying the library to make sure it is in both locations, but that doesn't fix the issue. Am I missing something obvious? It seems I need to modify a find command somewhere, but it's not clear where to add this.

In October, I finally find a time to ask the gods on IRC for some help. And sure enough, they are able to give me various recommendations for solving the root of the problem. I chroot into the system, mount the /boot files, and then re-install the initramfs for kernel version 5.10.0-8. I also may have re-installed grub2, but I cannot recall if that made a difference.

On October 15th, after doing another apt-get update/upgrade to be safe, I confirm that I can decrypt my drive and log in as usual. So: the issue is finally resolved!

Am I alone in thinking that the hardest part of backend webdev is setting up and connecting to a database in PHP?

Ever since I first tried to learn PHP (which was over a decade ago, and I had no idea what I was doing), and proceeding to this day, I have had endless amounts of stress and confusion whenever I try to glue the PHP and database service together my own.

Let me illustrate the most recent issue I've had — and mind you, this is just one small taste of the PHP difficulties I've experienced.

I decide to actually try out a NoSQL database for a change. Therefore, I try to install mongodb on my Linux host (in fact, it is the same Debian VM hosting this website! Say hello).

Thankfully, I am able to install this fairly easily; the instructions on the MongoDB website are very intuitive and to-the-point, and apt installs version 5.0.5.

I soon stumble upon some demos from tutorialspoint. Aha, I think to myself, this looks promising. I've used tutorialspoint before, in my efforts to learn perl and Rust (these deserve their own articles!) and when researching things like AJAX and Selenium. I know they won't let me down this time!

Alas, the very first line of their PHP script results in a failure. I dig deeper into the Apache logs (which is already a slightly painful endeavor, since I must invoke root permissions to access them) and find the following error:

For better or for worse, I am able to find a StackOverflow post that matches this error message (see also, my blog post criticizing of StackOverflow). This one at least cites a source that also suggests instantiating the MongoDB\Driver\Manager.

But as soon as I go to run this recommended one-line adjustment, I see a awfully simiar-looking error:

How does this make any sense??? Have I really not installed the right PHP MongoDB driver? But I had already installed php7.4-mongodb, which matches my active version of PHP (that's right, active version... more ranting about that is sure to come later) and thus should've done the job! After all, when I invoke ls /usr/lib/php/20190902/ as recommended in still other StackOverflow posts, I indeed see a mongo.so in my installed extensions.

I proceed to look up this latest error on DuckDuckGo, yet the top search results are different errors (e.g., connection timeout, authentication failure, an error in the pthreads extension, etc.). No luck.

Do I seriously need to install this specific MongoDB PHP Driver using PECL? If so, why isn't it enough to do the php7.4-mongodb installation above? Only time will tell; I am too exhausted to continue.

Intermission

To this day, part of me wonders: if it is the case that this is really just me, and no one else has trouble setting up databases and connecting with PHP, then perhaps webdev just isn't my forte.

What do you think? Am I a worthless comp sci major? Or am I just exhausted due to a lack of sleep?

Sure enough, the following night, I try to install the aforementioned "mongo-php-driver." The command recommended on that GitHub page fails, with a simple "pecl: command not found" error. Ok, so I need to install PECL somehow.

I stumble through the top search results, which are vague websites stating that pecl is accessed through PEAR, which can be installed with a simple php invocation. But does this really help me? No. While it does give me access to pearl and pecl executables, once I try to actually use them to install mongodb (you know... like the GitHub page suggests), they exit with the following error:

This is becoming increasingly frustrating the further I go. I then attempt to do research on this new command phpize.

Upon doing research on phpize, I need to remember to disregard the search result titled "How to install phpize for PHP7+", which, I kid you not, literally redirects to the base domain site newbedev.com. From other search results, I discern that it is used in the build-process for PHP extensions, which at least fits into the knowledge I already have, and it is allegedly included in a package called php<version>-dev. I then try to install that package as root, which miraculously works (all hail the debian maintainers).

Then I can finally run pecl to install the full, unmitigated mongodb package, right? The culmination of all this work! To the victor go the spoils!

...

The build proceeds...

...

...and terminates with the following few lines:

This is extraodinarily frustrating. Running a package manager ends in a segfault?? Normally, I am happy to debug software using GDB to diagnose a problem, but this is a package manager! One would expect it to be well-maintained and robust.

The only saving grace is that the error message gives a clear prescription for how to avert the problem (that is, assuming that the "you should add" suggestion is even related to the segmentation fault, which is no guarantee). But here's the problem: I have been checking my PHP configuration files (/etc/php/7.4/cli/php.ini and subdirectories) numerous times, and I have triple-checked the mongodb.so is set there explicitly.

None of this makes any sense.

How I Fixed My OS

As always, asking for help on IRC reveals answers that you never would've thought possible (see also, A Word with the Gods, a C++ dialogue).

1. The first takeaway is an obvious one, but it was so beginner-friendly that I had assumed I was above it: when debugging, don't hesitate to call phpinfo();.

2. The big revelation is an equally simple, though less intuitive, principle: cli !== webserver.

The version of PHP being invoked at terminal (e.g., if I run php --version and so on) is 7.4. By contrast, the version being invoked by the Apache2 web server is 7.3! They do not match! So, as a quick solution, I ended up enabling the PHP 7.4 module and disabling the PHP 7.3 module. I believe I could have stuck with the existing versions, but then I would have had to recompile the mongodb module for PHP 7.3, which could have been a hassle.

Special thanks to da_wunder nim on libera chat for sharing this insight.

3. The final lesson is not to trust tutorialspoint (lol). Even after I enable the matching version of PHP, I still encounter additional errors in the API for the MongoDB client!

Unfortunately, even this solution caused something else to break (I'm detecting a pattern here). Stay tuned for later when I debug Nextcloud, which broke entirely after the update to PHP 7.4!

I don't know if it's worth telling the full story. Just know that I try running docker and encounter a very difficult bug. After asking the gods on IRC, I am finally able to resolve the error. The problem is very well-explained on another tech blog you'll find here: my-take-on.tech

I am experiencing a problem whenever I try to "push" commits, either on an existing branch or on a new branch, to a remote git repository on bitbucket. Note that it is a private repository, but this should not matter, since I am using SSH authentication, something I used to do all the time for previous repositories, public and private.

The error message reads:

The obvious answer is that I have not added my SSH key to the ssh agent. But I have done so, using ssh-add and the infamous eval "$(ssh-agent)" command and updating the known_hosts.

When I try ssh -T git@bitbucket.org, the response is "authenticated via ssh key. You can use git to connect to bitbucket."

I have been trying to follow the suggestions here at cyberciti. I have upgraded git (verison is now 2.30.2).

Even the git remote.origin.url matches the "clone URL" that bitbucket tells me! So this StackOverflow answer does not apply either.

Any advice for me?

OpenPGP

Part I: May 2022

I am exploring a library to use PGP on PHP. However, I run ito a great many difficulties, as I describe below.

So far, I can:

• export my PGP key as a binary file
• sign a message and output a binary file
• verify the message in PHP, using both binary files (woo!)

In order to verify the message's authenticity, I use the following example script:

If I run this basic example, using binary files, then the output is a rather complex JSON dump, but it appears to correctly identify the fingerprint of the public key, as well as the text in the file being verified.

That's a good start, I think to myself. But, for my eventual use-case, I really want to make this process more user-friendly, so I want to allow the user to submit ASCII (base-64-encoded) text as inputs to the function.

So I start to follow the same steps:

• export my PGP key as an ASCII file
• sign a message and output an ASCII file

But if I simply go to modify the php script to de-armor the files, it fails completely!

• verify the message in PHP, using both ASCII-armored files

I try modifying the example script to use the OpenPGP::unamor method (as in the example below):

But this fails, giving an extraordinarily unclear output:

There must be some additional byte-processing calls that I am missing. If you know what these are, please contact me! In the meantime, I have decided to require binary signatures.

As of March 2023, I have finally resolved this issue. However, if you're interested in diving deep into technical nonsense, click to show the problem.

• Tiny Core Linux
• NiceOS Linux

This is a place to store some of the more obscure Linux commands that I often forget.

Server

• Make a new TLS certificate that works for both themathjester.com and www.themathjester.com! (source: StackOverflow)

certbot certonly --standalone -d themathjester.com -d www.themathjester.com




• Ways of clearing disk space on a small VPS. (source: AskUbuntu)

sudo rm /var/lib/snapd/cache/*


sudo journalctl --vacuum-size=100M


sudo snap list --all
sudo snap remove "$packagename" --revision="$revision"

Desktop

• Open a file in Libre Draw.

/usr/lib/libreoffice/program/soffice.bin --draw $filename


The libreoffice executable (at least on my laptop) is a symlink to this binary.


• Search through a whole folder full of .docx files (I needed to do this once in 2021).


You can do this using searchmonkey — it contains a GUI that you can launch from terminal.


searchmonkey -d /home/chozorho/Downloads -f docx -t Waldo


• Use a USB-attached digital scanner to scan an image into Linux:

scanimage -vp -d epson2:libusb:001:007 --resolution 1200dpi --format png --mode colorl > image_name.png


This may look relatively simple and memorable, but the fact that the resulting file is generated by redirecting std output, rather than using a -o flag, is counter-intuitive, as is the fact that the resolution is passed as a string and not an int.

Anywhere (General-purpose)

• Select a desired Java version to use (on a system with alternatives).

sudo update-alternatives --config java


• Remove CLRF from a file using vim! (source: StackOverflow)

:set noendofline binary


• Record the timestamp for each executed bash command!

This helps in cases when you want to distinguish between different times you ran the same command consecutively, or when you want to search through commands you run on a particular day. You can do it by setting the following variable in your .bashrc:

export HISTTIMEFORMAT="%F %T $ "


• Get the most used commands on your Linux terminal! (source: Linux Reviews)

history | awk '{print $2}' | sort | uniq -c | sort -nr | head


Most of these piped commands are self-explanatory, but the awk syntax is counter-intuitive:
print $0 prints an entire line, and then each token in the line is indexed from $1 (akin to how python regexes work). In this case, invoking index $1 prints a line index (simply the line number, starting at one!), but I believe this is because it is part of the output from the history command.

Be sure to use single-quotes and not double-quotes!

The other upshot is that the $2 may need to change to a $5 if you apply the "history timestamps" suggested above.


• Require root access in a shell script (source: xmatthias)

if [ ! ${EUID} -eq 0 ]; then

...

fi

Finally, take a look at many utilities written by Zaiste in Rust.

If you've made it this far, congratulations! Here's a GIF I made, using the advice on this forum:

Or, How They Managed to Lock Me Out of the Good Jobs This Month

Rationale

First, allow me to explain that I have a passion for understanding a system at a deep conceptual level and I also have a fascination with old-fashioned technologies (languages and hardware). These interests lend themselves well to mainframe development. But I have no hands-on experience with these things, because, how would I (how many people have a decades-old mainframe sitting in their basement?). Meanwhile, by pure coincidence, I hear rumors about how people can get paid large sums of money to do work with fortran and COBOL — allegedly, because there are so few programmers who know these languages. Soon after I start recording these narratives in writing, a tech journalist writes that, "if you can wrap your head around this relatively simple but verbose language, you are basically guaranteed a job."

However, as I soon discover, there are no entry-level mainframe positions, as I will attempt to illustrate below.

Ok, well, perhaps this is like the other good jobs in computer science: they demand a few years of experence even for their entry-level positions. Over the course of several years, as I gain more years of experience, the job openings explicitly require an even greater number of years of experience (a moving goalpost). This leads me to the conclusion that the most interesting jobs at the most interesting companies are being reserved for a static set of people: those born before 1997.

So, which is it? Are the jobs paying a high salary because of low Supply, i.e., they cannot find any programmers who know the languages (mere knowledge)? Or are they using that as a pretense, when in reality, they only want highly experienced engineers (several "years of experience")? Or is there an element of ageism, in which Gen Xers "pulled the ladder up behind them?" I have set out to investigate these narratives, by recording data about job vacancies and how their "minimum qualifications" change over time (month after month).

Methodology

The following are actual excerpts from COBOL-related vacancies. I promise you, I did not skew the data by cherry-picking jobs wth unusually high requirements for "prior experience;" rather, these are very representative job openings. If you doubt this, then I challenge you to search it yourself and prove me wrong. In the long run, I intend to integrate a PHP script to automatically append vacancies to this table to drive the point home.

Data

Notice that many positions give ambiguous descriptions that do not give an exact number of years for COBOL specifically, but nonetheless state that it is required. Examples include: "Experience with mainframe and Cobol is a plus" (Edward Jones); "Experience with COBOL and other programming languages such as [...]" (Zigabyte); "Experience with COBOL, CI/CD, DB2 is required" (Benedsoft).

Font credits