# Thursday, May 14, 2009

Skype on a mac, what to do when it fails

Skype today refused to receive messages. I could see the balloons, but the message-boxes were empty.

Rebooting failed.
Updating Skype failed.

I got tired and removed my account’s local db (history and other stuff) and it all worked as a charm.

Local db located at ~/Library/Application Support/Skype/[username]

# Tuesday, May 12, 2009

How to have a Subversion Repository on a Windows Server (+ security), part 1

The article is written based on Windows Server, CollabNet Subversion 1.6.1, Apache 2.2. Windows XP or Vista would do as well.

Subversion comes with it’s own server – svnserve. By default there is no security. One can install svn+ssh, but on a windows server and windows client that is a bit stupid.

The other option is to setup an Apache server with mod_dav and mod_dav_svn. Fortunately the CollabNet Subversion binary comes with Apache pre-bundled with those modules. The binary even installs viewvc, which is rather nice.

Installation steps.

After installing the bundle, however, there are a lot of things to do. Most of them manually. I’ll try to describe most of them here.

Download Collabnet Subversion Server binary from CollabNet (no other place to download it from). Registration required.

So we decided to use Apache instead of svnserve, so while installing one doesn’t have to make it a service. Only Apache should be installed as a service. Another pro for Apache is that it can host multiple SVN repositories as opposed to only one by svnserve AFAIK.

Now is the time to suggest that one make the Apache server run with limited credentials. By default the service would be running with Local System account which has more privileges than God the users in the Administrators group. The concrete steps would be to create one user with compmgmt.msc. Remove it from the Users group (which removes all the default privileges) and give this user Modify right for the httpd directory (one will most probably find it in C:\Program files\Subversion\httpd) and all the repositories.

The configuration. When installing Apache asks where is the repositories basedir. Using a basedir means that all the repositories are subdirectories of the basedir:

Subversion/httpd/conf/httpd.conf:

<Location /svn>
  DAV svn
  SVNParentPath "D:/SVN Repositories/"    <— put the qoutes. installer does not do it
</Location>

Note: by default the installer does not put quotes around the dir, so if there are space characters, the server will not start. One should put the quotes himself/herself.

Now is the time to say that the Apache server is very verbose. Every error show up in the Event Viewer in the Applications tab. There are always pretty good descriptions of what is wrong. I definitely like this feature of Apache. Unfortutely one has to use Google to figure how to fix it.

Another place to look for errors is httpd/logs/errors.log. Pretty readable. I’m positively surprised.

I don’t like the basedir approach – repositories with me are in different dirs. I do it like this

<Location /svn/mycompany>
   DAV svn
   SVNPath "D:/My Company/Repository"                   <— put the qoutes
</Location>

Authentication. Very shortly – http basic and http digest. Http basic is very insecure (only base64). Http basic looks like this:

<Location /svn/mycompany>
   DAV svn
   SVNPath "D:/My Company/Repository"
   AuthType Basic
   AuthName "MyCompany subversion repository"
  
AuthUserFile "C:\Program Files\Subversion/httpd/conf/svn_auth_file"
   Require valid-user
</Location>

Now, how to make the user’s file (svn_auth_file). Use htpasswd (only for http basic):

C:\Program Files\Subversion\httpd\bin>htpasswd -cm ..\conf\svn_auth_file mihail
New password: ******
Re-type new password: ******
Adding password for user mihail

C:\Program Files\Subversion\httpd\bin>htpasswd -m ..\conf\svn_auth_file ivan
New password: *****
Re-type new password: *****
Updating password for user ivan

The first time –c is used to create the file. Any subsequent user is with –m only (which stands for MD5 as far as I remember).

svn_auth_file:

mihail:$apr1$AzWq5tu5$k554PODb79n9TZwBxBDh..
ivan:$apr1$hlr9s6gK$oFLP1WtwvOLczyUSiP10v/

For http digest the configuration first the module has to be uncommented in httpd.conf:

LoadModule auth_digest_module modules/mod_auth_digest.so    <—uncomment this line

the configuration for the location is the following:

<Location /svn/mycompany>

AuthType Digest

And users are made with htdigest:

C:\Program Files\Subversion\httpd\bin>htdigest.exe –c ../conf/svn_auth_file "MyCompany subversion repository" mihail
Adding user mihail in realm MyCompany subversion repository
New password: ******
Re-type new password: ******

C:\Program Files\Subversion\httpd\bin>htdigest.exe ../conf/svn_auth_file "MyCompany subversion repository" ivan
Adding user ivan in realm MyCompany subversion repository
New password: ******
Re-type new password: ******

The file svn_auth_file looks a bit different now:

mihail:MyCompany subversion repository:3d16aced3eac2fc74ce5663df86d145b
ivan:MyCompany subversion repository:3ff20546c01028d5008651445b62d2e0

Note: keep in mind that the realms in svn_auth_file and the <Location AuthName should match.

Note: do not confuse htpasswd and htdigest. They produce users for http basic and http digest respectively and are not interchangeable.

For now there is a pretty usable svn server that supports multiple repositories and digest auth. But the communication with the server is plain and unencrypted http.

The svnbook is available here (most up-to-date version 1.5): http://svnbook.red-bean.com/en/1.5/svn.serverconfig.httpd.html. The chapter for servers is Chapter 6.

The next part is how to setup a SSL on top of Apache.

# Sunday, May 10, 2009

Pingbacks now work

The blog just said:

You were pinged back by
http://mihail.stoynov.com/blog/2009/05/10/TestBlogPostWithWindowsLiveWriter.aspx
on your weblog entry 'Usability of the blog'
(http://mihail.stoynov.com/blog/2009/05/05/UsabilityOfTheBlog.aspx

I’ve linked myself in the past but I guess this feature was off or broken.

Test blog post with Windows Live Writer

I’ve heard of Windows Live Writer but I’ve always thought that it only works for Blogger and Sharepoint. A comment to the blog (here) made me investigate whether dasBlog would support WLW. It does. This is the first blog post with WLW.

While installing WLW in my virtual Windows XP (I’ll write about that later if WLW works) I decided to update the blog. The update can now be installed with something called Web Platform Installer 2.0. It installs crap directly from the internet especially crap for IIS:

Web Platform Installer 2.0

(Wow, WLW can inline the image in the text. I’ve always missed that.)

So, let’s see how this blog post would look like.

Submit... (in this case “Publish”)



Update: this cannot be true. WLW has live preview that embeds the post in the blog, this is so f*cking cool. Look at it:

 


WLW live preview

 

 

 

 

 

 

 

 

 

 




Image thumbnails, resizing. Categories. Everything seems to work seamlessly. So let’s finally submit it and see what happens (I may start using this a lot).

# Tuesday, May 05, 2009

Usability of the blog

Watching the blog stat one can't help but notice the decreasing amount of articles (I guess my single reader and I are the ones that should notice). Maybe it's because a lack of time. Maybe it's because of too much work,study or travel (I'm currently in Turkey on vacation).

Lately one new reason is emerging in my head (yes, it takes them (the thought) some time to mature :). Maybe I'm not writing that much because of the usability of the blog. The usability from the readers' point of view is bad (here for example,), but it's hard to fix it and I'm too lazy to do it. But now I'd like to talk about usability from my perspective (as the author).

I'm running the blog (hosted on dasBlog) at my own server with a very cheap internet connection so it's a bit slow. dasBlog doesn't do any kind of image help (not to mention anything more complex) - I have to do my own thumbnails (I so very much hate that). dasBlog's rich text editor does not support my phone's browser or Safari.

So at the end even if i think of a good story it takes a lot of time to represent it in the blog. Especially if it's very visual, or even only a bit visual.

So I have to think of other ways to improve my experience. And I just thought of one. I'll write when I do it.

Good Night, and Good Luck.

I just watched the 2005 movie Good Night, and Good Luck. It basically depicts the communist witch-hunt that happened in the US just after the WWII. It's very moving and a bit sad (especially at the end with the faith of the main character).

The movie made me spend some time on Wikipedia reading about McCarthy, Murrow and Hollenbeck. Very interesting. Makes one think whether we have the same media now.

Directed by George Clooney. 6 Academy awards nominations. Highly recommended.

# Tuesday, April 21, 2009

Gmail's new attach file button

Gmail recently changed the "Attach..." button with a flash one. Today I found out why. Now one can attach multiple documents with one click. It's awesome.

Update: due to some comments here are some screenshots:

On a mac (firefox) it's working:





On Windows (firefox) there was no flash button. (I've seen Gmail and other google applications change the look&feel on different browsers and different google users. Maybe that's the reason.)

The screenshot:

# Friday, March 20, 2009

How to consolidate (add, gather) multiple private keys in one JKS file with keytool

Do the following multiple times:

keytool
  -importkeystore
    -srckeystore mycompany1.root.ca.jks
    -srcalias
mycompany1.ca
    -destalias
mycompany1.ca
    -srcstorepass
mycompany1.ca

    -destkeystore container.root.ca.jks
    -deststorepass container.root.ca

The first time you do it the container.root.ca.jks would be created. The subsequent times it will just be filled up with new and new keypairs (public and private keys).

# Thursday, March 19, 2009

How to set up networks and dhcp on vmware (on Mac and other OSs)

How to do networking with VMWare Workstation or VMWare Fusion?

For clarity, let's assume that the host (the machine running vmware fusion or vmware workstation) has the ip of 192.168.0.10.

On every virtual machine there are three options:
Bridged (VM becomes visible to other machines beside the host. It has an IP like 192.168.0.11).
Nat (VM is visible only to the host, there is internet).
Host only (VM is visible only to the host, but no internet).


Do ipconfig or ifconfig.
vmnet8 is for NAT.
vmnet1 is for host-only.
These are whole networks for virtual machines. If nat is chosen, then the VM would be supplied an IP from the vmnet8 pool.


DHCP.
If 'bridged' is chosen, then the administrator of 192.168.0.1 must assign an address to the VM.
if 'nat' or 'host-only' is chosen, then:
(I'll describe how to do this on a mac):

goto:
$cd /Library/Application Support/VMware Fusion

stop vmware networking:
$sudo ./boot.sh --stop



Let's suppose vmnet8 is 172.16.57.1 and vmnet1 is 172.16.163.1.


I would like to change the network from 172.16.57.1 to 172.16.16.1 and I would like to specify a virtual machine with a specific IP.

We're still in /Library/Application Support/VMware Fusion

Then:
$ grep 172.16.57 *
locations:answer VNET_8_HOSTONLY_HOSTADDR 172.16.57.1


Then all files in the list must be changed.
Then we go into /Library/Application Support/VMware Fusion/vmnet8/

Then the same:

$ grep 172.16.57 *
dhcpd.conf:subnet 172.16.57.0 netmask 255.255.255.0 {
dhcpd.conf: range 172.16.57.128 172.16.57.254;
dhcpd.conf: option broadcast-address 172.16.57.255;
dhcpd.conf: option domain-name-servers 172.16.57.2;
dhcpd.conf: option netbios-name-servers 172.16.57.2;
dhcpd.conf: option routers 172.16.57.2;
nat.conf:ip = 172.16.57.2
nat.conf:# or ip = 172.16.57.2/24




All of them must be changed.

If a specific VM must have a specific IP we go to:
/Library/Application Support/VMware Fusion/vmnet8/dhcpd.conf and we add the following:
(get the mac from the VM (ipconfig, ifconfig eth0))

host myhost {
hardware ethernet 00:0C:29:B2:C9:69;
fixed-address 172.16.16.16;
}


Then to renew the ip (ipconfig /release, ipconfig /renew for windows):
sudo ifconfig vmnet down
sudo ifconfig vmnet up


The last thing is to start the vmware networking:
sudo ./boot.sh --start



Then to renew the ip inside the VM (ipconfig /release, ipconfig /renew for windows):
sudo ifconfig vmnet down
sudo ifconfig vmnet up

# Wednesday, March 18, 2009

MS Office for Mac sucks

It's like bringing "the Vista experience" to a Mac.
I didn't like it.

It's super slow.
The windows do not open where they're supposed to. The tool boxes open in different window (I have Spaces on).
The interface is new and unintuitive.
The windows focus is changed randomly so I have to fight for it.

# Thursday, March 12, 2009

Certificates, keystores, java keytool utility and openssl

(Updated: four six typos fixed)

I)
From time to time I need a self-signed certificate. I use the java keytool utility to make one:

For a JKS (Java Key Store format):
keytool
  -genkeypair
    -keystore mihail.stoynov.jks
    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -keysize 2048
    -keyalg RSA
    -sigalg sha1withrsa
    -dname "cn=Mihail Stoynov,
ou=MyCompany Bulgaria, o=MyCompany, L=Sofia, S=Sofia, c=BG"
    -validity 3650
    -v

For a PKCS#12 keystore:
keytool
  -genkeypair
    -keystore mihail.stoynov.p12
    -storetype pkcs12
    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -keysize 2048
    -keyalg RSA
    -sigalg sha1withrsa
    -dname "cn=Mihail Stoynov, ou=MyCompany Bulgaria, o=MyCompany, L=Sofia, S=Sofia, c=BG"
    -validity 3650
    -v

When the public certificate is needed separately, one can be exported in a file (mihail.stoynov.cer) like this:
(from a JKS)
keytool
  -exportcert
    -keystore mihail.stoynov.jks
    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -file mihail.stoynov.cer
    -v

(from a PKCS#12)
keytool
  -exportcert
    -keystore mihail.stoynov.p12
    -storetype pkcs12
    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -file mihail.stoynov.cer
    -v

NOTE: keep storepass and keypass the same for easy importing into browsers


II)
Sometimes self-signed certificates are not enough and a CA root certificate must be made in order to sign a group of certificates.

First a Certificate signing request (CSR) must be made:
(from a JKS)
keytool
  -certreq
    -keystore mihail.stoynov.jks
    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -v
    >> mihail.stoynov.csr

(from a PKCS#12)
keytool
  -certreq
    -keystore mihail.stoynov.p12
    -storetype pkcs12
    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -v
    >> mihail.stoynov.csr

(the output is directed to a file: mihail.stoynov.cer)

The file looks something like that:
-----BEGIN NEW CERTIFICATE REQUEST-----
MIICtTCCAZ0CAQAwcDELMAkGA1UEBhMCQkcxDjAMBgNVBAgTBVNvZmlhMQ4wDAYDVQQHEwVTb2Zp
YTEQMA4GA1UEChMHTWF0ZXJuYTEWMBQGA1UECxMNTWF0ZXJuYSBTb2ZpYTEXMBUGA1UEAxMOTWlo
YWlsIFN0b3lub3YwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZ7XpdyHuF9ApZodSn
GS9/TiUtXqryPDD0elzlP2QreSkfYv8IaXnB1Xy1ZVmda/d+P4TZ/aHvAhDwQPcei4KaoRzJWX9I
Yz9hi4cmKksjg8ufDZzXUuMwtbVlricc5vWg1HcSsQJ8vpLCBIelliDJOxc4skDcT23LGQttiv0b
23pjMthEe2tJVp37Tnwr29SLz0AGziVwzb5cfAXU4PzpiASr8vF2A0c2DObS7zM5Wp7jXWIe71P5
BZgIMcUUGlCdfLQRoA7URWN2Yx2qH8gyiNaIaZYZB6o2ib8rH3UmDl/ErKJgWQyS7sr4bANY9WpA
m7H2nXfGs+X88xSbA0JRAgMBAAGgADANBgkqhkiG9w0BAQUFAAOCAQEAIn81dCSpVbI7IDLO2L2p
MW1gnjvuRs9xm6M9rMV6Kwy0Nw05qL0H8tTsFaq4J7bLBXJeXmiREUbrtpbHxLUfjtaqs5q5Txxn
c7Cm5kj7t9PWeRTW0rbzRssgT+sHqUlMKMydB8E+gGEIMQdgwdurhjpD7aevOOeN5fvv9kV7Rszv
6nC8dixyrsiiWjLUGJRP7I9HrEAXKfk3JluSYKS/ZNhTIw5a7fKvhXbRPlN1lDSvdkJAtcaG/9dZ
3KlXL7ozL8sOQTjFxUhN6kS6QujJ1T7TlkWHu9/ivIAkuXBu8P/czyLyjf1JD9fnwGnxCO2FPmcX
9/2IpwG33mMpaAmXpA==
-----END NEW CERTIFICATE REQUEST-----



Did we forget something? Yes, there's no Root CA certificate. Let's make one:
(JKS)
keytool
  -genkeypair
    -keystore mycompany.root.ca.jks
    -storepass "mycompany.root.ca"
    -alias "mycompany.root.ca"
    -keypass "mycompany.root.ca"
    -keyalg RSA
    -keysize 2048
    -sigalg SHA1withRSA
    -dname "cn=MyCompany Bulgaria, ou=Office No 5, o=MyCompany, L=Sofia, S=Sofia, c=BG"
    -validity 3650
    -v


(PKCS#12)

keytool
  -genkeypair
    -keystore mycompany.root.ca.p12
    -storetype pkcs12
    -storepass "mycompany.root.ca"
    -alias "mycompany.root.ca"
    -keypass "mycompany.root.ca"
    -keyalg RSA
    -keysize 2048
    -sigalg SHA1withRSA
    -dname "cn=MyCompany Bulgaria, ou=Office No 5, o=MyCompany, L=Sofia, S=Sofia, c=BG"
    -validity 3650
    -v




Problem No 1
Keytool cannot sign CSRs. Period.

Now what do we do?

I went to OpenSSL.

In order to sign with OpenSSL I needed the root certificate in the PEM format.
P12 (PKCS#12) -> PEM:
openssl
  pkcs12
    -in mycompany.root.ca.p12
    -out mycompany.root.ca.pem

Sign the CSR with OpenSSL:
openssl
  x509
    -req
    -in mihail.stoynov.csr
    -CA mycompany.root.ca.pem
    -out mihail.stoynov.signed.cer
    -days 3650
    -CAcreateserial

(I don't know what -CAcreateserial is but it works)

So now I have mihail.stoynov.signed.cer.

The last step is to import it to mihail.stoynov.p12 (or .jks) in order to override the self-signed certificate with the one signed by the MyCompany Root CA.

A Prerequisite step to that is to import mycompany.root.ca.cer into mihail.stoynov.p12 (or .jks) because every certificate in the chain must be contained in the certificate chain of mihail.stoynov.



Problem No 2
Importing mycompany.root.ca.cer into mihail.stoynov.p12 fails but importing it into mihail.stoynov.jks works?!

JKS:
keytool
  -importcert
    -keystore mihail.stoynov.jks
    -storepass mihail.stoynov
    -alias mycompany.root.ca
    -keypass
mycompany.root.ca
    -file mycompany.root.ca.cer
    -v
(this one works)

PKCS#12
keytool
  -importcert
    -keystore mihail.stoynov.p12
    -storetype pkcs12
    -storepass mihail.stoynov
    -alias mycompany.root.ca
    -keypass
mycompany.root.ca
    -file mycompany.root.ca.cer
    -v
this one fails with:
Owner: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Issuer: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Serial number: 49b8c365
Valid from: Thu Mar 12 08:12:13 GMT+00:02 2009 until: Sun Mar 10 08:12:13 GMT+00:02 2019
Certificate fingerprints:
     MD5:  1C:0C:82:0D:35:C8:1E:48:74:9F:13:43:C9:AE:D0:F7
     SHA1: DB:BB:D7:DB:8C:33:AA:06:6D:CF:D2:5C:EB:64:01:D5:AD:AB:94:38
     Signature algorithm name: SHA1withRSA
     Version: 3
Trust this certificate? [no]:  y

keytool error: java.security.KeyStoreException: TrustedCertEntry not supported
java.security.KeyStoreException: TrustedCertEntry not supported
    at com.sun.net.ssl.internal.pkcs12.PKCS12KeyStore.engineSetCertificateEntry(PKCS12KeyStore.java:620)
    at java.security.KeyStore.setCertificateEntry(KeyStore.java:941)
    at sun.security.tools.KeyTool.addTrustedCert(KeyTool.java:1958)
    at sun.security.tools.KeyTool.doCommands(KeyTool.java:818)
    at sun.security.tools.KeyTool.run(KeyTool.java:172)
    at sun.security.tools.KeyTool.main(KeyTool.java:166)

Actually P12 format does not permit trusted certificates. It is inteded to contain key/pairs only. So importing mycompany.root.ca.cer into mihail.stoynov.p12 failed.


I tried several things:

1) Importing mihail.stoynov.signed.cer directly into mihail.stoynov.p12:
keytool
  -importcert
    -keystore mihail.stoynov.p12
    -storetype pkcs12

    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -file mihail.stoynov.signed.cer
    -v
and the response was:
keytool error: java.lang.Exception: Failed to establish chain from reply
java.lang.Exception: Failed to establish chain from reply
    at sun.security.tools.KeyTool.establishCertChain(KeyTool.java:2662)
    at sun.security.tools.KeyTool.installReply(KeyTool.java:1870)
    at sun.security.tools.KeyTool.doCommands(KeyTool.java:807)
    at sun.security.tools.KeyTool.run(KeyTool.java:172)
    at sun.security.tools.KeyTool.main(KeyTool.java:166)

2) Importing mycompany.root.ca.cer into cacerts:
keytool -importcert -trustcacerts -file mycompany.root.ca.cer
This again didn't fix the problem.



Solution to Problem No 2:
Transform P12 to JKS, import the root certificate and the signed certificate into JKS keystore, transform the modified JKS back to P12.

1) Transform P12 to JKS
keytool
  -importkeystore
    -srckeystore mihail.stoynov.p12
    -destkeystore mihail.stoynov.jks
    -srcstoretype pkcs12
    -srcstorepass mihail.stoynov
    -deststorepass mihail.stoynov
2) import the root certificate into the JKS keystore
keytool
  -importcert
    -keystore mihail.stoynov.jks
    -storepass mihail.stoynov
    -alias mycompany.root.ca
    -keypass mycompany.root.ca
    -file mycompany.root.ca.cer
    -v
3) import signed certificate into JKS keystore
keytool
  -importcert
    -keystore mihail.stoynov.jks
    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -file mihail.stoynov.signed.cer
    -v
4) transform the modified JKS back to P12
keytool
  -importkeystore
    -srckeystore mihail.stoynov.jks
    -destkeystore mihail.stoynov.p12
    -deststoretype pkcs12
    -srcstorepass mihail.stoynov
    -deststorepass mihail.stoynov
it said something like:
Entry for alias mihail.stoynov successfully imported.
Problem importing entry for alias mycompany.root.ca: java.security.KeyStoreException: TrustedCertEntry not supported.
Entry for alias mycompany.root.ca not imported.
Do you want to quit the import process? [no]:  n
Import command completed:  1 entries successfully imported, 1 entries failed or cancelled
I clicked yes, and it worked.


Now let's see what's the difference between mihail.stoynov.jks and mihail.stoynov.p12:
JKS:
$ keytool -list -keystore mihail.stoynov.jks -storetype jks -storepass mihail.stoynov -v

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 2 entries

Alias name: mihail.stoynov
Creation date: Mar 12, 2009
Entry type: PrivateKeyEntry
Certificate chain length: 2
Certificate[1]:
Owner: CN=Mihail Stoynov, OU=MyCompany Sofia, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Issuer: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Serial number: f0e465bb77420e30
Valid from: Thu Mar 12 09:29:19 GMT+00:02 2009 until: Sun Mar 10 09:29:19 GMT+00:02 2019
Certificate fingerprints:
     MD5:  40:9D:C2:DE:AE:11:1E:01:92:F9:C8:01:C5:92:69:CB
     SHA1: D2:D0:03:5C:50:BC:F8:6C:EB:C0:36:B6:B0:8D:A8:3B:9E:B6:7B:B4
     Signature algorithm name: SHA1withRSA
     Version: 1
Certificate[2]:
Owner: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Issuer: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Serial number: 49b8c365
Valid from: Thu Mar 12 08:12:13 GMT+00:02 2009 until: Sun Mar 10 08:12:13 GMT+00:02 2019
Certificate fingerprints:
     MD5:  1C:0C:82:0D:35:C8:1E:48:74:9F:13:43:C9:AE:D0:F7
     SHA1: DB:BB:D7:DB:8C:33:AA:06:6D:CF:D2:5C:EB:64:01:D5:AD:AB:94:38
     Signature algorithm name: SHA1withRSA
     Version: 3


*******************************************
*******************************************


Alias name: mycompany.root.ca
Creation date: Mar 12, 2009
Entry type: trustedCertEntry

Owner: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Issuer: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Serial number: 49b8c365
Valid from: Thu Mar 12 08:12:13 GMT+00:02 2009 until: Sun Mar 10 08:12:13 GMT+00:02 2019
Certificate fingerprints:
     MD5:  1C:0C:82:0D:35:C8:1E:48:74:9F:13:43:C9:AE:D0:F7
     SHA1: DB:BB:D7:DB:8C:33:AA:06:6D:CF:D2:5C:EB:64:01:D5:AD:AB:94:38
     Signature algorithm name: SHA1withRSA
     Version: 3


*******************************************
*******************************************





P12 (PKCS#12)
$ keytool -list -keystore mihail.stoynov.p12 -storetype pkcs12 -storepass mihail.stoynov -v

Keystore type: PKCS12
Keystore provider: SunJSSE

Your keystore contains 1 entry

Alias name: mihail.stoynov
Creation date: Mar 12, 2009
Entry type: PrivateKeyEntry
Certificate chain length: 2
Certificate[1]:
Owner: CN=Mihail Stoynov, OU=MyCompany Sofia, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Issuer: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Serial number: f0e465bb77420e30
Valid from: Thu Mar 12 09:29:19 GMT+00:02 2009 until: Sun Mar 10 09:29:19 GMT+00:02 2019
Certificate fingerprints:
     MD5:  40:9D:C2:DE:AE:11:1E:01:92:F9:C8:01:C5:92:69:CB
     SHA1: D2:D0:03:5C:50:BC:F8:6C:EB:C0:36:B6:B0:8D:A8:3B:9E:B6:7B:B4
     Signature algorithm name: SHA1withRSA
     Version: 1
Certificate[2]:
Owner: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Issuer: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Serial number: 49b8c365
Valid from: Thu Mar 12 08:12:13 GMT+00:02 2009 until: Sun Mar 10 08:12:13 GMT+00:02 2019
Certificate fingerprints:
     MD5:  1C:0C:82:0D:35:C8:1E:48:74:9F:13:43:C9:AE:D0:F7
     SHA1: DB:BB:D7:DB:8C:33:AA:06:6D:CF:D2:5C:EB:64:01:D5:AD:AB:94:38
     Signature algorithm name: SHA1withRSA
     Version: 3


*******************************************
*******************************************






Do you see the difference?
It's in italic - JKS format keeps an extra trusted certificate of MyCompany Root CA.

Anyway both mihail.stoynov.jks and mihail.stoynov.p12 work perfectly.


P.S.
Does someone know better solutions to Problem No 1 and Problem No 2?
Does someone know how to sign certificates but without the cumbersome CSR step?
# Tuesday, March 03, 2009

The "Introduction to Programming with Java" is out

The book "Introduction to Programming with Java" I coauthored is out.



The book is in Bulgarian and it's free.

For now it's only in electronic form, but we're planning to print it. We're not planning on making profit from the printed book, so we're looking for sponsors.

I co-wrote the Exceptions chapter and authored the Object-oriented programming (OOP) chapter and the Qualitative programming code chapter.

# Monday, March 02, 2009

Windows XP's numerous connections



This happened on a Windows XP machine with the latest updates.
# Thursday, February 26, 2009

Nokia Maps 2.0 free navigation license for 1 week

While searching for updates I found out that Nokia gives 1-week free navigation licenses.
One can be obtained from here.

Instructions: a mobile phone has to be supplied and a serial key is sent as an sms that has to be inputted in Nokia Maps. Unfortunatelly +359 (Bulgaria's country code) is not supported (but Romania is) so I used a friend's phone.

Yesterday I tested the thing and it's amazing. The routes it calculates are better than Garmin's ones. Interacting with the software is so much better, especially browsing the map - awesome. There is voice guiding in Bulgarian.

The generally good thing with Nokia Maps is that it's free (the software). There are a lot of maps that are also free. Only the routing capability has to be purchased - it's not very cheap.

Unfortunately their maps are really poor. Bulgaria's map is only 4 megabytes. The Bolkans' map is like 40-50 if I recall correctly.

# Tuesday, February 10, 2009

Sniff TCP connections

In the world of windows there is no standard tool to see what's going on the network level.

I have been working quite a while with web services and encryption and signing, so it's vital to me to see what's going on when a web service is being called.

TCP proxies
The way I was doing it until recently was to use TCP proxies. TCP proxies open a TCP port and forward to some other host:port. In the process of doing so it dumps every connection on the screen or in a file.
For example if I want to listen what's going on a local (for the machine I'm working on) port 8080 the following had to be done: the software working on 8080 (a web service) is moved for example to 18080, then the proxy is opened at 8080 which forwards everything to localhost:18080.

There is one minor drawback to the whole story -  the clients have to be supplied with a port that is not the port where the service resides. So if the proxy is missing - the service is invisible.

I've used mostly tcpmon and wsmonitor. wsmonitor sucks a lot. tcpmon works, but cannot handle moderately heavy traffic and has a lot of quirks that are very annoying. Anyway until recently it was my primary way of doing things.


Reading direcly from the TCP/IP Stack
There has always been software that can plug something in the TCP/IP stack of the windows machine and thus sniff the traffic. The bad side is that the machine has to be tampered with some third-party software. And some machines cannot (should not) be tampered like that.


A third way
There seems to be a software that can sniff the traffic without plugging nasty stuff in the TCP/IP stack. On such example is SmartSniff. It has what they call a "Raw Sockets" way of sniffing and so far it's working great.

# Thursday, January 22, 2009

Server down for a few days

The server went down because of me being stupid.

I have stopped the http service (IIS), and backed it up. But then I was stupid enough not to bring it back on.

And then - why are there no events?

# Friday, December 26, 2008

Guitar tuner - how to tune up a guitar for dummies

I can't distinguish notes. This makes it hard for me to tune up my guitar.

There are tuners that just play a certain tone and one should be able to tune up based on the tone heard. I can't do it like that.

That's why I searched for a tuner that could "hear" my guitar.

Guess what - I found it. It's called AP Tuner 3:




It's amazing. It just works. No configuration, no nothing.
This is how software should be written.

What's new

I haven't written in over a month.

During this time I busted my ass off (worked a lot).

Somewhere around my last post I managed to stop the coffee, which for me is like a dream-come-true. One would ask - so what, it's not that hard? For me it was. I started drinking coffee in 10th grade. Around my first year in the university I started drinking a lot - my personal best is 8 cups per day. Since then it got stable around 6 cups/day.
From that time off I have made two attempts to stop it. They both failed. The first one managed to drop the dose to around 3 cups. The second attempt managed to drop to 1-2 cups per day. During the "dry period" I wasn't the same guy - I slept a lot, I couldn't stay focused - it was difficult.
The third attempt I did was different - it was easy. I guess the first two did the job. This time I just sealed the deal.
One would also ask - is coffee that bad? I don't know really. For me it was because I drank a lot and couldn't control it.

I stopped my facebook account - for me the cons are more than the pros.

# Thursday, November 20, 2008

The blog as a knowledge base

Microsoft has a term "knowledge base article" which solves a particular problem or at least describes it better.
It comes out, there's a term http://en.wikipedia.org/wiki/Knowledge_base

Today was the second time I use the blog as a knowledge base. I know I have stumbled upon a problem, I think I wrote about it, I search the blog - there it is, and it solves my problem again.
Great, another usage of the seemingly useless blog.

# Monday, November 17, 2008

Tomcat under attack, manager password exploited, trojan deployed

There's an Apache Tomcat I'm managing that's in the wild (internet).

Saturday evening it was under attack.

I use Tomcat's manager console to drop applications from time to time and I had it's password pretty simple. Within this console a new java web application may be installed.
What's even worse is that that Tomcat instance was running with pretty high privileges.

It was a test machine, only a few guys knew the address.

So using this console a trojan was inserted. The admin password was changed. This trojan might have succeeded if it weren't for the antivirus that got the trojan on time (yes, it was a windows machine).
The trojan is called TROJ_DELF.BDG and it was deployed in webapps/fexshell/init.exe

Now the tomcat is running with pretty low privileges, the port is not so obvious, and the manager password is changed.

# Friday, November 14, 2008

Importing a class from the 'default package' (no package) - impossible

Did you know that classes in the 'default package' (classes that don't have a package) cannot be imported from classes that do have a package?

I did not know that.

Try it:




This is what javac says:

>javac Class1.java

>javac package2\Clazz2.java -cp .

package2\Clazz2.java:3: '.' expected
import Class1;
             ^
package2\Clazz2.java:3: ';' expected
import Class1;
              ^
2 errors


How stupid is this?
Is this why omitting package is deprecated?

IE6: The last couple of posts look terribly, IE7 - ok

The last couple of posts look terribly in Internet Explorer 6. There are some background rectangles that should not be there:



IE7 displays them correctly.

Update: Maybe it's because I used Word 2007 to write the html for the colored code from Eclipse.
# Thursday, November 13, 2008

Javac bug, Eclipse innocent, bug in static imports

I had an issue compiling some java classes. Javac failed, Eclipse's compiler worked. The issue is described here.
I was blaming Eclipse, I was blaming java6's endorsing. I was thinking it was due to JAXB.

It comes out they all were innocent.

Here's my code:

package f;

 

import static f.ProblematicClass.E1.E2.VALUE;

 

import javax.annotation.Resource;

 

public class ProblematicClass {

 

    @Resource

    public static enum E1 {

        F(VALUE);

 

        private E1( E2 requiredBankAccounts ) {

        }

 

        public static enum E2 {

            VALUE;

        }

    }

}


The result with javac is:
>javac f\ProblematicClass.java

f\ProblematicClass.java:9: cannot find symbol
symbol  : class Resource
location: class f.CorrectClass1
        @Resource
         ^
1 error


After some research I think I simplified the problem:
(If I continue to simplify it would still fail to compile but at some point it would start to compile which yesterday drove me crazy.
This is the most simplistic case that consistently fails to compile)

package f;

 

import static f.ProblematicClass.E1.VALUE;

import javax.annotation.Resource;

 

public class ProblematicClass {

 

      @Resource

      public static enum E1 {

            VALUE;

      }

}


All of these changes fix the compilation error (from javac):

...

// Reverse the order of imports

import javax.annotation.Resource;

import static f.ProblematicClass.E1.VALUE;

...

or

...
      // Use the FQN of the annotation

      @javax.annotation.Resource

      public static enum E1 {

            VALUE;

      }

...


This all makes me think that the static import fails the next one only if the next one is an annotation (I've tried with a java.util.Collection - it compiled).
I have tried this with jdk6u3 and jdk6u10.
I don't have jdk 1.5. Can someone test it on jdk 1.5?



Update: GRRRRRRRRRRRRRR, Somebody found it before me:
http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6391197
It was reported on 27th of June, 2006 :'(

Here's what they say:

Workarounds:
1) switching the order of the import statements works (although they often get changed back by our development tools).
2) Commenting out the static import statements, then compiling, then putting the import statements back and
compiling again with the old classes still there also works. This means that the compiler errors happen at the strangest
of times
, and in large programs it can be very difficult to work out how to workaround the problems.

Weird javac case - Eclipse's compiler is wrong again.

I have some code.
I have two classes. They both have inner enums.
The two inner enums have an annotation.

But one of them does not compile. The other one compiles just fine.

In eclipse there's no error, but when I build the code from ant I get a compilation error - the annotation class is not found:

    [javac] ProblematicClass.java:147: cannot find symbol
    [javac] symbol  : class XmlType
    [javac] location: class package.ProblematicClass
    [javac]     @XmlType(name="fff")
    [javac]      ^
    [javac] 1 error

I spent some time looking for it - I thought that the classpath is wrong, I endorsed an updated version of the API (java 6). The issue persisted.

Then I decided to use javac directly:


javac -verbose -classpath lib\X.jar;lib\X2.jar -d bin -sourcepath src -encoding UTF-8 src\package\ProblematicClass.java

Strangely enough I got the same error?! Then I did the same for the class that did compile successfully using ant - it worked.
So there was a difference between the two classes and I had to find it.

And I found it, can you find it?

//Does not compile

public class ProblematicClass {

 

      @XmlType( name = "fff1" )

      public static enum InnerType {}

}

 

// Compiles

public class CompilableClass {

 

      @XmlType( name = "fff2" )

      public enum InnerType {}

}

Yes, you're correct. The second enum is not static.
This only happens with inner static enums. The anomaly does not occur if it's an inner static class. I don't know why.

So I'm thinking that in the ProblematicClass the annotation is not visible because the import of XmlType is not visible.
I was correct - this one works:

//Does not compile

public class ProblematicClass {

 

      @javax.xml.bind.annotation.XmlType( name = "fff1" )

      public static enum InnerType {}

}

I just supplied the FQN of @XmlType.

So eclipse is working, javac is not. Now is the time to say that Eclipse is not using javac. I thought it was using jikes (made by IBM), but that's not correct. Eclipse is using its own incremental compiler part of JDT Core. JDT stands for Eclipse Java Development Tools.

http://www.eclipse.org/jdt/core/:

JDT Core is the Java infrastructure of the Java IDE. It includes:

  • An incremental Java compiler. Implemented as an Eclipse builder, it is based on technology evolved from VisualAge for Java compiler. In particular, it allows to run and debug code which still contains unresolved errors.
  • ...

So either javac or Eclipse's compiler is wrong. I would bet that javac is following the spec more strictly.

This is the second time I'm catching Eclipse's compiler of misconduct. The first time was something related to a very complex case with generics - one of the compilers said it was a warning, the other - error. More here.


Update: I was wrong. I was trying to report the problem. I was making a pretty simple case. I used a different annotation: @javax.annotation.Resource. It worked both on Eclipse and on javac.
So the problem is somehow linked with JAXB.

 JAXB is an API bundled with Java 6 (an 'endorsed standard' a 'standalone technology'). The version bundled was JAXB 2.0. If one wants to use a newer version, say JAXB 2.1, an 'Endorsed Standards Override Mechanism' had to be used.

Info on JAXB here.
Info on endorsed mechanism here.

I'm currently with JDK 6 update 10. Somewhere I saw that 'endorsed standard override mechanism' was no longer necessary.

It looks like the problem is more on javac side than on Eclipse's compiler.

I will investigate further.


Update2: It comes out that 'Endorsed Standards Override Mechanism' was existing prior to java 6. Only the standalone technologies were added in Java 6.

Update3: It comes out that 'Endorsed Standards Override Mechanism' is still used.

Update4: It comes out that this bug is very hard to reproduce. My simple examples at some point just started compiling :(

Update5: I just created some code that consistently reproduces the bug. I'll write it in a new entry to be cleaner.

Update6: I fixed coloring and finished the new article on the bug.

# Wednesday, November 12, 2008

JAX-WS: Always clean-up generated stuff before regenerating.

I'm using JAX-WS.
When I'm generating stuff for a web service I generate the jaxws package in a 'gen' source folder.
I don't need the compiled stuff so I generate it to a temp folder that I don't care about.

It comes out that I do have to care about that folder because yesterday I got an obscure error:

com.sun.xml.ws.model.RuntimeModelerException: The serviceName cannot be retrieved from an interface.

This error has only 1 (one) hit on Google. Don't trust me?
Try this one out:
http://www.google.com/search?q=%22com.sun.xml.ws.model.RuntimeModelerException%3A+The+serviceName+cannot+be+retrieved+from+an+interface.%22

The use case in the forum has nothing to do with my environment so I cleaned up and everything worked like a charm.

I've always been unhappy with how production unready wsgen is (here).
# Tuesday, November 11, 2008
# Monday, November 10, 2008

A very cool merge and copy program that's free

WinMerge has great shortcuts for next/previous change, copy left/right.
It has textual comparison feature which works pretty well.

Thumbs.db

Recently I had to move 200GB from one hard-drive to another.
It was imperative to make sure everything was copied successfully.

Using a binary comparison tool would take a really long time. So I only check the total file size of all files copied and the number of files.
I tried copying these 200GB files several times and never succeeded. I was too lazy or busy to investigate until today when I got really pissed off.

It comes out that the difference comes from thumbs.db files.

Thumbs.db is a thumbnail cache used by Windows XP and Windows 2k3 Server.

How to stop the creation of these files:
  1. Click Start
  2. Double-click Control Panel
  3. Double-click Folder Options
  4. Click on the View tab
  5. Check off the circle next to Do not cache thumbnails
  6. Click the Ok button

# Wednesday, November 05, 2008

Firefox new shortcut

Ctrl + Num = switch through tabs. Useful.

# Tuesday, November 04, 2008

Quote of the day

Those who would sacrifice liberty for security deserve neither.
Benjamin Franklin

In Bulgarian:
Този, който е готов да пожертва свободата заради сигурността, не заслужава нито едно от двете.
Бенджамин Франклин

Google translating whole sites

I accentally went to http://www.gaijin.at/.
The weird part is that when one presses "English" (since it's in German) it goes to:
http://translate.google.com/translate?hl=de&langpair=de|en&u=http://www.gaijin.at/index.php
I didn't know that Google can translate whole web sites.

The translation seems to be pretty good.
The site look&feel is exactly the same.

Very good thing.
# Friday, October 31, 2008

Пощенска банка - поредната олигофренска банка

Бях си казал, че повече с глупости няма да се занимавам.

Но, бях отново опроверган мислейки си, че вече най-големите тъпотии от банки съм ги видял. Особено след тъпотиите на Първа инвестиционна банка.

Сега основната ми банка е Пощенска банка: прилично е-банкиране.


Малко предистория:
Реших в сметката си вързана с дебитна карта да не държа прекалено много пари. Направих си втора (някакъв тъп влог) и я вързах с е-банкирането си.

Поредната олигофрения:
Оказва се, че тоя олигофренски влог не може да се управлява от е-банкирането. А като го правех изрично казах, че искам да ползвам от е-банкирането си.
Другите видове можели, но точно моя не може. И се оказва, че имам сметката, но точно като се опитам да превеждам - не може.

Естествено грешката се вижда от някакво забито меню, на самия трансфер не я пише.

Няколко часа се опитвах да се свържа на официалния им телефон - или заето или никой не вдига. Звънях и на други телефони - или не се вдигат или все ми се казва - не мога да помогна.

Писах им два имейла - чак на втория след 2 часа ми отговориха и даже ми се обадиха.
Като ми обясниха каква е хавата, естествено ги питам как да го реша сега проблема си? Те - ами отивате до някой клон. И сега аз ще трябва да се вдигна в работно време и да ходя до олигофренския им клон. Те естествено не са виновни и нищо не могат да направят.

Естествено мога да отида и да се навикам на пиклата, която не ми е обяснила тази подробност. Но какво ще ми донесе това?

Update:
Бях в един клон на банката. Първата мацка естествено ми каза: "Ама то би трябвало да може". Явно не е наясно горката, но аз бях кратък и ясен: "Искам да говоря с някого, който знае как работи всичко" и тая има благоразумието да ме насочи към правилния човек.
Говорих си с "администраторката" (явно нещо като шефка във фронт офиса им). Първо и тя: "ама то би трябвало да работи". После "ама ние нямаме други видове влогове". Докато накрая стигнахме до "ааааааааааааааааааааа". Явно разбраха какъв е проблема.
Направиха ми нова сметка прехвърлиха ми каквото трябва. Обещаха ми до днес (04.11) на обяд всичко да е в онлайн банкирането ми и да работи.
Естествено не работеше. Към 15 часа сметката се появи, но без наличност. От предната сметка знам, че след известно време всичко сработва, но досега (почти 19) това не се е случило.
Естествено не успях да се свържа с "администтраторката", за да я питам защо лъже.
В онлайн банкирането дори се опитват да бъдат забавни:
"Сметката не е на клиент на eBank (може и да е ама още не се грижим за нея)"
Дори пунктуационни грешки имат. И това банка. И кои сте вие, дето се "грижите" за нея? Обгрижихте я добре.

Въпроси към Пощенска:
Защо лъжете? Това е непрофесионално.
Толкова ли е трудно да си намерите качествени хора? Аз ви опознах системата за 24 часа и последния път като бях във ваш офис, я познавах по-добре от служителите ви.
Защо не си вдигате проклетите телефони?! Това е непрофесионално.
Защо олигофренския ви влог (с гръмкото име "мега") не може да се управлява онлайн?
Ако беше кредит и трябваше да го погасявам сигурно един ден закъснение щяхте през носа да ми го изкарате?

Оправданието:
Естествено пиклата ще каже: "Ама да сте питали". Common sense, скъпа, common sense е да ми кажеш за тая подробност.

Изводът:
Още една олигофренска банка, която не струва. Услугата ѝ е скапана.
Трябва ли да имам 5 дебитни карти с 10 сметки вътре?!
Трябва ли да си намеря някой пенсионер, който да ходи всеки ден и да ми е един вид "електронното банкиране"?
Трябва ли просто да се науча да си държа парите кеш, защото няма ни една банка, която просто да работи?
Update (към извода):
Стоят ми парите в банка - банката ги използва.
В разплащателна сметка по-скоро аз плащам (лихва няма, таксите са меко казано високи). Вие ми вземате парите, аз плащам?
Във влога уж получавам някаква келява лихва, но нищо не работи и тия олигофрени ми хабят време (което е в пъти по-ценно от смешната им лихва).
Често се случва тия приключения да завършат по кофти начин - аз тоя уикенд до тия пари достъп нямах.
Мисля си, че да си държиш парите в банка е тъпо, адски тъпо. Аз обиколих няколко банки, все нещо не им е наред. И обслужването - нямам думи, един долнопробен ресторант по морето има по-адекватно обслужване (поне служителите си познават ресторанта).

Въпросът:
Някой знае ли поне една професионална банка, която предлага само едно: да ми достави безупречно електронно банкиране? Не искам нито да я виждам на живо, нито да комуникирам с безумно противните лелки/какички, които знаят само едно "не сме ние виновни". Искам просто да ми се предоставят ограничен набор от услуги и те да работят 24/7.

П.П. Определено тонът ми е груб, но тия са поредните олигофрени, които ми губят времето и ми лазят по нервите.

П.П.2 И не, определено няма да пиша "молби" или "оплаквания". Отговорът ще е в стил Мтел: "ми откраднахме ти 100 лева за половин мегабайт интернет, ама да не си блял, целият ни бизнес план се гради на измами, ти кво искаш - да спрем да работим ли?"

# Wednesday, October 29, 2008

Apache Tomcat 6 - enlarge VM's heap space

By default enlarging Java VM's heap space happens via "-Xms128m -Xmx512m".

How do we tell Tomcat 6 about it? They say via the CATALINA_OPTS variable (which is shared by all Tomcat instances on that machine). Or even via JAVA_OPTS (all java programs would use these settings).

But what if I want to set these options only to a specific Tomcat instance?
Google couldn't answer that.

I could mess with the startup scripts, which is not a good idea.

The best solution I found is to set the variable (CATALINA_OPTS) only on the console instance that is to start the Tomcat. This variable is not visible to other instances.
This works on windows - because of the temporary variables.

# Monday, October 20, 2008

Vista...again...for the last time

I had a 2GB MemoryStick Duo Pro left from the last phone and I didn't know what do with it.
ReadyBoost was a nice feature to try out (Vista uses the flash card to boot faster).
The card was small in size so it wasn't a problem to keep it always in. I rarely if never use the card reader.

Now Vista starts even slower. The last boot it stood at least a minute on the login screen and hdd went crazy.
After my desktop appeared the it took a few more minutes for the hdd to calm down.

I'm waisting so much time complaining about it. I won't write for Vista anymore.

# Friday, October 17, 2008

XP and Vista restart when they've installed a new update

So I choose to do something on my laptop (Vista) and just when I start doing it there's this annoying window - you have to restart - and it's bugging you once and a while. If you choose to ignore it long enough, it'll restart the machine right in the middle of a movie. How frustrating is that?!

There's an XP machine I have that has a service running. The service MUST be up all the time. The choice of operating system was not mine. So the XP updates and then restarts without restarting the service. How frustrating is that?!

I know that Vista and XP are end-user OSs, but how can Vista restart while I'm using it?!