;login SUMMER 2016 VOL. 41, NO. 2 : & Causal Profiling Charlie Curtsinger and Emery D. Berger & Fuzzing with AFL and ASAN Peter Gutmann & HPC and Storage John Bent, Brad Settlemyer, and Gary Grider & Adding Privacy Back to Android Apps Michael Backes, Sven Bugiel, Oliver Schranz, and Philipp von Styp-Rekowsky & Policy-based Routing with iproute2 Jonathon Anderson & Linux FAST ’16 Summary Rik Farrow Columns Cutting Memory Usage in Python David Beazley Using the Spotify API David N. Blank-Edelman Vendoring in Go Kelsey Hightower Intrumenting a Go Service Dave Josephsen Security Trends Dan Geer Fuzzy Thinking Robert G. Ferrell UPCOMING EVENTS USENIX ATC ’16: 2016 USENIX Annual Technical OSDI ’16: 12th USENIX Symposium on Operating Conference Systems Design and Implementation June 22–24, 2016, Denver, CO, USA November 2–4, 2016, Savannah, GA, USA www.usenix.org/atc16 www.usenix.org/osdi16 Co-located with USENIX ATC ’16: Co-located with OSDI ’16 SOUPS 2016: Twelfth Symposium on Usable Privacy INFLOW ’16: 4th Workshop on Interactions of NVM/Flash and Security with Operating Systems and Workloads June 22–24, 2016 November 1, 2016 www.usenix.org/soups2016 Submissions due August 5, 2016 www.usenix.org/inflow16 HotCloud ’16: 8th USENIX Workshop on Hot Topics in Cloud Computing Diversity ’16: 2016 Workshop on Supporting Diversity in June 20–21, 2016 Systems Research www.usenix.org/hotcloud16 November 1, 2016 HotStorage ’16: 8th USENIX Workshop on Hot Topics in LISA16 Storage and File Systems June 20–21, 2016 December 4–9, 2016, Boston, MA, USA www.usenix.org/hotstorage16 www.usenix.org/lisa16 Co-located with LISA16 SREcon16 Europe SESA ’16: 2016 USENIX Summit for Educators in System July 11–13, 2016, Dublin, Ireland Administration www.usenix.org/srecon16europe December 6, 2016 Submissions due September 19, 2016 USENIX Security ’16: 25th USENIX Security Symposium www.usenix.org/sesa16 August 10–12, 2016, Austin, TX, USA USENIX Journal of Education in System Administration (JESA) www.usenix.org/sec16 Published in conjunction with SESA Co-located with USENIX Security ’16 Submissions due August 26, 2016 WOOT ’16: 10th USENIX Workshop on Offensive www.usenix.org/jesa Technologies August 8–9, 2016 Enigma 2017 www.usenix.org/woot16 January 30–February 1, 2017, Oakland, CA, USA enigma.usenix.org CSET ’16: 9th Workshop on Cyber Security Experimentation and Test August 8, 2016 FAST ’17 www.usenix.org/cset16 February 27–March 2, 2017, Santa Clara, CA, USA Submissions due September 27, 2016 FOCI ’16: 6th USENIX Workshop on Free and Open www.usenix.org/fast17 Communications on the Internet August 8, 2016 www.usenix.org/foci16 SREcon17 March 13–14, 2017, San Francisco, CA, USA ASE ’16: 2016 USENIX Workshop on Advances in Security Education NSDI ’17 August 9, 2016 March 27–29, 2017, Boston, MA, USA www.usenix.org/ase16 Paper titles and abstracts due September 14, 2016 HotSec ’16: 2016 USENIX Summit on Hot Topics www.usenix.org/nsdi17 in Security August 9, 2016 SREcon17 Asia www.usenix.org/hotsec16 May 22–24, 2017, Singapore www.usenix.org/facebook www.usenix.org/gplus www.usenix.org/linkedin twitter.com/usenix www.usenix.org/youtube SUMMER 2016 VOL. 41, NO. 2 EDITOR Rik Farrow [email protected] EDITORIAL MANAGING EDITOR Michele Nelson 2 Musings Rik Farrow [email protected] PROGRAMMING COPY EDITORS Steve Gilmartin 6 COZ: This Is the Profiler You’re Looking For Amber Ankerholz Charlie Curtsinger and Emery D. Berger PRODUCTION 11 Fuzzing Code with AFL Peter Gutmann Arnold Gatilao Jasmine Murcia SECURITY TYPESETTER 16 Boxify: Bringing Full-Fledged App Sandboxing to Stock Android Star Type Michael Backes, Sven Bugiel, Oliver Schranz, and [email protected] Philipp von Styp-Rekowsky USENIX ASSOCIATION 2560 Ninth Street, Suite 215 22 Using OpenSCAP Martin Preisler Berkeley, California 94710 27 Interview with Nick Weaver Rik Farrow Phone: (510) 528-8649 FAX: (510) 548-5738 29 Interview with Peter Gutmann Rik Farrow www.usenix.org STORAGE ;login: is the official magazine of the USENIX 34 Serving Data to the Lunatic Fringe: The Evolution of HPC Storage Association. ;login: (ISSN 1044-6397) is published bi-monthly by the USENIX John Bent, Brad Settlemyer, and Gary Grider Association, 2560 Ninth Street, Suite 215, 40 Linux FAST Summit ’16 Summary Rik Farrow Berkeley, CA 94710. $90 of each member’s annual dues is for a SYSADMIN subscription to ;login:. Subscriptions for non- 44 Improve Your Multi-Homed Servers with Policy Routing members are $90 per year. Periodicals postage Jonathon Anderson paid at B erkeley, CA, and additional offices. POSTMASTER: Send address changes to 48 MongoDB Database Administration Mihalis Tsoukalos ;login:, USENIX Association, 2560 Ninth Street, Suite 215, Berkeley, CA 94710. HISTORY ©2016 USENIX Association 56 Linux at 25 Peter H. Salus USENIX is a registered trademark of the USENIX Association. Many of the designa- COLUMNS tions used by manufacturers and sellers 60 Precious Memory David Beazley to distinguish their products are claimed as trademarks. USENIX acknowledges all 67 iVoyeur: Go Instrument Some Stuff Dave Josephsen trademarks herein. Where those desig- nations appear in this publication and 71 Practical Perl Tools: Perl to the Music David N. Blank-Edelman USENIX is aware of a trademark claim, Kelsey Hightower the designations have been printed in caps 76 What’s New in Go 1.6—Vendoring or initial caps. 80 For Good Measure: Five Years of Listening to Security Operations Dan Geer 87 /dev/random Robert G. Ferrell BOOKS 89 Book Reviews Mark Lamourine, Peter Gutmann, and Rik Farrow USENIX NOTES 92 Results of the Election for the USENIX Board of Directors, 2016–2018 93 What USENIX Means to Me John Yani Arrasjid Musings RIK FARROWEDITORIAL Rik is the editor of ;login:. fter having worked in one area for so many years, I decided that it is [email protected] time to choose that area as a topic for musing. That area is writing A and writing’s relationship to programming. Stephen King wrote that writing is telepathy [1]. Although King often writes about the meta- physical, in this case he is writing metaphorically. By telepathy, King means that the success- ful writer takes the ideas in his head and transfers them into someone else’s head. There is no magic involved. What is involved is a lot of time, work, and careful consideration. Technical Writing I imagine that anyone reading this essay routinely does technical writing of one sort or another: emails, bug reports, proposals, articles, and especially papers. And this is where the telepathy had better happen. If you fail to pierce the fog between you and your readers, your thoughts will not be transmitted or will, at best, be misunderstood. I ran across a wonderful example of just how technical writing can fail when done poorly and succeed when carefully crafted. I was reading a paper to be presented at a USENIX workshop and was amazed at just how clearly the authors presented their ideas. They explained each concept, which then flowed into the explanation of the following concept, until they had built both a description and an argument about the validity of the research in their paper. Their writing was crystal clear. That paper received a Best Paper award. At this point you might be wondering why I am not citing that paper, but I have a reason. The first time these authors submitted their paper to the same conference, the paper was rejected because the program committee members didn’t understand it. The authors were convinced that their work was good, but they had failed to truly communicate their ideas. The concepts were stuck in the authors’ heads. So they rewrote their paper, then edited it to within an inch of its life. I found this out after I met the authors during the conference, commended them on their wonderful writing, and asked them to reprise their paper for ;login:. That’s when I learned of their tale of failure and redemption. I often run into very similar problems when editing articles for ;login:. The authors clearly understand their topic, but leave out so much of what is familiar to them that the result is incomprehensible to everyone else. They have failed at telepathy, not because they are not psychic, but because they have not managed to communicate what other people who didn’t work on their project couldn’t possibly know. When I run into this I try to coax people into explaining the missing parts. But I often fail for two reasons. There are people who just can’t make the leap between ideas being in their heads, perhaps in wondrously beautiful constructs, and the very lack of the foundations nec- essary for these constructs to appear in the heads of their readers. The second failing is my own. Once I have read an article many times I begin to understand the authors’ points. Sometimes, instead of editing the article, the authors will attempt to explain the subtleties in email communications. So I learn what the authors have been trying 2 SUMMER 2016 VOL. 41, NO. 2 www.usenix.org EDITORIAL Musings to communicate—I become contaminated with the very ideas siders have to guess that right-clicking or swiping over those that they failed to include in their article. At that point, I can no pixels will produce a desired result and, hopefully, not be the icon longer discern that the article has failed to communicate, except for resetting the app to factory defaults, including wiping all the to those who already understand the topic and won’t be reading app’s data. the article anyway. Again, the program’s authors have failed at their telepathy, keep- ing in mind that telepathy is not magic.