# Monday, June 22, 2009

How’s it going with the US

210620091371 So, how’s the trip going?

Its 2 o’clock. I’m trying to arrange all the photos from the 18062009988camera and to find time to write something. I just (3 hours ago) got out of the pool and the water slide in the hotel (somewhere in Montana) and now I have Two and a half men on the background while drinking Yellow Trail (merlo).

Here are a few teasers.

I’ll write when I have more time to do so. Gotta go to sleep because I’m doing rafting tomorrow.

# Thursday, June 18, 2009

NY, part 3

12062009369 We just got on the plane to LA. And I just finished my fourth coffee. The flight attendant on the last flight asked me where I’m from when I asked for the strongest thing he had. Then told me a story about his stay in Sweden where some people laughed at him when he made something and called it coffee, they called it warm water. There wasn’t enough time to eat the Wendy’s salad I bought at the Phoenix’s airport, so brought some food on board. BTW, on these domestic flights they don’t serve food. The cheap bastards. On the last flight there wasn’t any food. Only some chips for 6 bucks.

On the left is a picture of these guys wanting to x-ray even my shoes. USA is such a police state.10062009272

So NY. This is the third post for it. What more could be said about it? It’s crowded, it’s dirty. The metro, being 100 years old, is OLD and ugly. The asphalt on the roads is not that well made.

There’s the “grid system” which means that all street are perpendicular (and I’m talking only about Manhattan, because this is where I stayed). The streets parallel to the length of 10062009274 the island are called Avenues (1st, 2nd, Madison ….). The streets parallel to the width of the island are called streets. So I stayed on the intersection of 2nd and 86th.

Update: On the right is Macy’s – the biggest department store in the world – it has nine floors, mostly girl stuff. There was only half a floor of men’s shoes. There were still something like 4000 pairs, but' that’s another story.11062009283

Oh, yea, we also went to Broadway and watched Shrek. It was amazing. The storyline was based on the first Shrek movie (or the other way around). The stage was something very hi-tech, because it was split into different parts that could move in circles and up and down. The costumes were very well done.  Did I say it was a musical? Yes it 10062009280was. They were singing all the time, but there were so many jokes that it was pretty fun. We were first row on the terrace and I was prohibited to put my legs on the terrace itself. I so wanted to :(

The left is me having a jin and tonic in the intermission.

On the right is me on the 46th floor (the rooftop) of a building close to Empire State Building. And still ESB seems like going sky high.

That’s it from NY for now. Gotta go rafting.

Update: Pictures here: http://picasaweb.google.com/mihail.stoynov

# Monday, June 15, 2009

Long Island, Fire Island

Currently I’m on a A320 (very comfortable seats) plane flying from Chicago to Phoenix en route to LA. This is the only 07062009178 opportunity for writing blog posts. But it’s hard the muse has left me (only 3 hours of sleep and some Metaxa (hope I spelled it right) last night.

So Long Island. When I came to US my geography was pretty bad. I wasn’t good with states, and cities. Everybody know where NY is on the map but I had no idea that NY is entirely seated on islands. Manhattan is an island (one of the five boroughs). The others are Queens (to the right of Manhattan), Brooklyn (below Queens), Bronx (to the north) and Staten Island (just below Manhattan).

So after a night in Queens we all decided we could use the Sunday and go the bea07062009197ch. We went to Fire Island – a small island below another island below the middle of Long Island. We went to a nude beach (friend’s choice) where the view wasn’t pretty. Anyway we had fun as seen from the  picture and went inside the water (was very cold).

Oh yea, and we brought a small freezer with like 4 sixpacks (twenty-four .330l bottles) of some crappy beer and only the three of us tried to drink it.

The gorgeous girl on the right is Erica.

Update: Pictures here: http://picasaweb.google.com/mihail.stoynov

New Haven

09062009213

Meet Iva. Iva is a friend of mine and I’m staying with her in New Haven. Both of us will also travel through the US. After a few days in New York, we went to Chicago for the weekend (will try to write about it too) and now we’re flying to LA.

S03062009082o New Haven. New Haven is where Yale University is. It’s a small and poor (in Iva’s words) town that has a pretty high crime level. On the right is some important building part of Yale, but God forbid I can’t remember what it is. Anyway. After landing in the US the first place I stayed was New Haven. Because of the time difference the next morning I woke up at 6:00 and had to be quite for 6 more hours and stay in my room because Iva doesn’t get up very early.

Since they don’t have internet I 09062009215had to steal some from a nearby wi-fi router. The good thing was that in Bulgaria everyone was up so I had something to do.

When the trip around the US is over I’ll make some more pictures. Until then here a nice one – 20 one-dollar bills are drying after being in the washer.

Update: Pictures here: http://picasaweb.google.com/mihail.stoynov

NY, continued

09062009230

Still on the flight to Phoenix. The battery is half-dead. And I’m drinking the third coffee. Oh, not to mention that I burned my hand pretty bad with a Starbucks L09062009218atte so now I hate Starbucks.

I was just looking the pictures and it’s hard, really hard. I still have to write a lot about NY and then Staten Island, and then Chicago, And from Chicago I have a lot of picture. Damn memory card that can hold 2000 hi-quality (the phone says they are high quality) pictures.

So what else was there is NY. I was mostly in Manhattan, so let’s talk about it. The first picture on the right is from the Marriott Hotel on the 46th floor on a platform th09062009236 at turns 60 degrees in 60 minutes. The platform is a restaurant and the view is awesome. Unfortunately it was at night and the picture is not very nice.

09062009229 The elevator that took us there was one with an open view and we could see the lobbies on every 15 floors. The inside of the hotel was hollow and there lobbies (major floors) were separating the inside of it. Flying with it was a bit scary because at one time one could see the bars 20-30 meters  away and then suddenly a concrete wall with a hole wide enough only for the elevator to go through. The elevator could be seen on the upper left picture.

So what else did we do? Oh yea a friend invited me to see her workplace at the UN headquarters. The one on the left shows10062009259 the General Assembly. There was a session going on and still tourist were let in. The one on the right shows the Security 10062009255Council’s press “wall”. And I’m there giving a press conference and discus sing the problems in North Korea and there second test of their missile. The last one in in front of the building with all the flags. (The pictures are so big that’s hard to write enough text that fills the space between them).

The picture below is part of my sole walk on Times Square in the middle of the night and it shows the NYPD which is in the middle of 

10062009267

the square and is full of cops. 09062009245Isn’t that enough for this post? I just looked at it and it looks very ugly, but I’m too tired to make it look better

 

 

 

Update: Pictures here: http://picasaweb.google.com/mihail.stoynov

NY, first impressions

Updated

Here’s the first pic I have from the US: standing in front of Grand Central station 03062009081in Manhattan

Couple of days ago i was in New York and stayed there for a few nights. The first two nights I stayed in Manhattan (2nd ave) pretty close to Central Park. The first time I went there it was raining for 20 hours so obviously I didn’t enjoy it much. I had to stay the whole day with my shoes being wet.

05062009088The next day I walked on my own and here’s what I saw: the NY fire department :)

The first evening the roommate of one of the friends had a birthday and celebrated it in East Village. It looks a bit like Amsterdam.

This is Ivan and I in front of a building in which the outdoor scenes of Vanilla Sky with Tom Cruise (if I’m not wrong) was filmed. That day it was raining, I was 05062009099wet, he was late and both of us were really hungry. That’s why we’re not so happy.

It was a pretty sleepless stay. We broke in in the Russian Tea Room restaurant (2nd floor was closed) to make pictures with the giant crystal bear (it was 2 meters tall). Then being with t-shits went to the ball on the 3rd floor and made pictures while on the dancing floor.

The cab drivers all seem to be Pakistanis and they all seem to have taken the driver’s license by change. They don’t care how comfortable one feels. The cars most of the times are some old Fords which seem IMG_0492like 10 years old. The driver is separated from us with a glass. They have this touch screens on the glass that airs commercials or have a map with where the taxi is at the moment.

This is the World Trade Center 7 building which was rebuild after it fell on 9/11. I can be seen having a beer on the 27th floor on a working Friday in the office of Company magazine (Erica, correct me if I got the wrong name).IMG_0500

The one on the right is with Ivan. Behind us is the construction site on Ground Zero where some really big building is supposed to be built.

(I have to write more text, otherwise the pictures fail to display correctly, so this is my filling text :)

06062009145 This one is from the the tour we made around NY with Silva. We’re on Brooklyn Bridge.

I saw Times Square, Wall Street, Brooklyn Bridge, I dined beneath a skyscraper in the only restaurant where one could smoke. We all went in the nude beach in Long Island (called the Fire Island).

I’ve been to Queens and today I’ll stay in Brooklyn. I’ve seen the Queensboro bridge. Made fun of the cab drivers. Got pretty drunk.06062009166

This is the bear on the right. The picture is with pretty bad quality, but that’s the best my phone can do in the dark.

Maybe I should write a bit more to fill in the space that the picture opened. But I’m too tired to think.

Update: Pictures here: http://picasaweb.google.com/mihail.stoynov

Having mobile internet in a foreign country – one of the best things one can do

In a previous post I was complaining a bit of the speed of the internet bandwidth from T-Mobile which was something like 3-4 kb/s. Well is some areas it went up to 30 kb/s and stayed at 20 average. But that’s not the point.

Even at 3-4 kb/sec one could use the internet for so many things – the first one is Google Maps. Undoubtedly one of the most useful apps. Especially when you can search for your hotel just when typing “The Gershwin Hotel” and it finds it or just “Public transport –> airport”.

But that’s not all. We could check in online. I could work using skype (Skype for symbian is just too slow, so I use fring; Fring doesn’t support skype chats though which is kind of annoying). We could search for nearby restaurants. We even bought tickets online for Madison Square Garden. We wrote mails, send pictures to friends which we just made.

But that’s not all. The top of the cherry is another amazing story. So here it is. On my laptop I didn’t have Picasa, which I needed to upload the pictures to Picasa Web Albums. So I wanted to download it, but I didn’t want to stay in the hotel and wait for 20mb to be downloaded while the laptop was using the phone as a modem, so I opened the default browser on the phone and tried to download Picasa on the phone. The default browser couldn’t handle the javascript so I tried with Opera Mini. The latest versions of Opera Mini download files themselves, they don’t depend on the default browser for downloads. BTW Opera Mini operates by using a special proxy which “chews” the internet page to be more suitable for the Opera Mini browser. So with Opera Mini the downloads started and while I was enjoying Chicago in my pocket Picasa3 was downloading. I could still make calls, browse with the default browser or use Google Maps. I downloaded Picasa for Windows and for Mac, and I downloaded each twice to make sure that at least one of the downloads would work. So in one afternoon being in the pocket Opera Mini downloaded something like 60 megabytes using a connection that could sometimes drop down to 1 kb/sec.

# Friday, June 12, 2009

Offline blogging

The stuff is written offline in Windows Live Writer and when there’s internet I commit it (publish it). Nice.

Preserving battery life on a macbook

Stopping the Bluetooth and the wi-fi card on a mac adds like an hour to battery life. Amazing, until now I’ve never stopped them.

Google Maps for Symbian vs. Garmin XT

When one goes to an entirely unknown place one tends to take stuff that gives him some security and might help in case of emergency. That’s why I loaded my GPS with offline map of the US using the Garmin XT software.

The GPS device is a Nokia E71 mobile phone (there are some other articles in the blog about it I think, but can’t link to them – I’m in offline mode). It has a 1500 miliamperhour-battery, which is the most I’ve ever seen on a phone and a pretty small screen, so lot’s of time being online.

I had to buy a data plan (I chose T-Mobile, $77 sim with unlimited data) so naturally I decided to try Google Maps for Symbian S60. First of all it’s free as opposed to Garmin XT (even the software is not free, not to mention the maps).

Navigation

Google Maps has an outstanding navigation (by navigation I mean going up/down/left/right and zooming in/out), it’s always fast no matter if the map is loaded or not (shrinks/enlarges the image it has, then replaces that with the newly downloaded one). Garmin’s navigation is plain stupid – the cursor accelerates as one presses up/down/left/right, so one would never know where the cursor would end up.

Searching

Searching in Garmin is like this: Where to go? –> Address/City/POI –> Choose Country –> Choose City –> Choose number –> Choose street. And this takes a while. And it doesn’t always return a result or at least not what one would expect. Google Maps would give you a result if you type “Grand Central, NY”. With Garmin XT if it works it would be hard and time-consuming to do.

Speed

Garmin wasn’t very fast with a 20 mb map of Bulgaria. But it’s definitely slow with a 1.2 gb map of the US, even on “very low detail” setting. Google Maps is always responsive no matter how much it takes for it to load.

Routing

Currently I use trains or metro or just walk. Routing with with Google Maps is fast – three tabs (Public transport, Car, Walk) and then I have to give only start and end locations – that’s it. It gives me amazingly correct results. In Garmin one has to go to the settings and change the Routing to Pedestrian/Car. I don’t even think it has the public transport option.

No GPS option

Google Maps can work without a GPS – it uses the network cells and wi-fi routers to know where it stands. It’s not very accurate but it doesn’t drain the battery with the GPS. It’s very easy to start the GPS – a few clicks away.

The Nokia E71’s GPS is always very quick to find it’s location. I’m guessing the phone starts the GPS for short period once and a while to keep it’s internal clock synchronized. So this option of Google Maps is extremely useful.

Start time

Google Maps is faster and it doesn’t have the annoying warning in the beginning that one has to click on to continue using the Garmin XT.

Satellite view

Very useful in Google Maps. I think Garmin has something similar, but can’t remember how was it.

Maps

Google Maps works so good only in the States. The last time I tested it in Sofia the map was pretty low detail. And Google Maps obviously needs a data connection. The traffic is not that much though, the data flowing is pretty size-optimized it would seem.

Overall

Google Maps is fast, user-friendly and easy to use, but needs internet. It can do more in less time, but sometimes it’s maps are not as good as Garmin ones. Garmin XT is pretty unusable and slow but can work offline and the maps most of the times are the best one can find.

Garmin is a nice-to-have second option in case Google Maps fails somewhere or there’s no network coverage.

# Friday, June 05, 2009

European Parliament and local government elections

This is stealing. They are denying a taxpayer to post his vote (no voting section will be raised in NYC):

http://www.webhousing.biz/~bulgaria/news.php?id=148
(Bulgarian Embassy in the USA on the EP elections on 7th of June)

For such a voting section to exist for the local Bulgaria government, 100 voters have to register “either personally, via FAX or via a scanned document saying they want to vote”. So now I have to find a scanner.

The vote is on 5th of July.

http://www.webhousing.biz/~bulgaria/news.php?id=149

Idiots.

First impressions from the US

The cars are different, the pipes are different, the knobs are different.

The mobile internet

Today we were wandering for half a day in the local ghetto looking for an AT&T store.. They wanted $20 for 100 megabytes and we decided to turn to T-Mobile.

T-Mobile offers unlimited mobile data for $24.99s and 600 minutes for $39.99. So for a total of $77 ($5 for some tax) I’m now always connected. The connection sucks big time. It’s normally like 2-3 kb/sec and the max I’ve seen is like 20kb/s.

The knobs

After 20 something hours of travel (2-hour flight, 2-hour wait, 9-hour flight, 1-hour bus ride, 2-hour train ride, 20 minutes in a cab, and god knows what else) there were so many smells coming out of me, so the first thing I needed was a shower. It took me like a minute to figure out how to start the shower and a minute more how to get the hot water. The knob was like an arrow of a clock. Originally it pointed 11 o’clock. It could move only counter-clockwise and from 10 o’clock until 8 o’clock is the cold water. The hot water is at 3 o’clock. At first I moved it only a bit and had to move away pretty fast. The strength of water flow cannot be controlled – it’s always the same and it’s pretty well chosen.

Politically correct

The word negro MUST NOT be used in any conversation even one being taken in Bulgarian or at least I was told so. Otherwise one could get beaten up, or when being in a ghetto - get shot.

Update: Pictures here: http://picasaweb.google.com/mihail.stoynov

# Thursday, June 04, 2009

USA, here I come

It’s been one day since I landed at JFK International Airport in New York. Here’s one picture from Grand Central Station:

03062009081 

I’ll be staying in the US for a month.

Update: Pictures here: http://picasaweb.google.com/mihail.stoynov

# Monday, May 18, 2009

How to start matrixtunnel

Matrixtunnel is a small http wrapper that adds ssl on top of plain http. Small memory footprint.

Here’s how to start it:

user:~# matrixtunnel -A /etc/ssl/domain.com.cer -p /etc/ssl/domain.com.key -r 80 -d 444

Print help screen:

user:~# matrixtunnel -h
usage: [-c] [-v] [-d localip:port] [-r remoteip:port]

    -A      Certificate Authority file
    -p      private key and certificate chain PEM file name
    -c      client mode. remote is ssl, local plain
    -v      validate certificate
    -d      listen locally on this [host:]port
    -r      connect to remote machine on [host:]port
    -P      pidfile
    -f      foreground mode
    -D      syslog level (0...7)

If one wants to test, one can use –f (start on the console, not as a daemon).

Note: don’t use –v, sometimes it fails. I don’t know why.

Few extra commands (openssl, certificates)

This is an addendum to http://mihail.stoynov.com/blog/2009/03/12/CertificatesKeystoresJavaKeytoolUtilityAndOpenssl.aspx 

Key file is a format that keeps the private key in unencrypted format. It does not keep the certificate.

Converting pem –> key

openssl rsa –in mycompany.pem –out mycompany.key

Check out a certificate (pem, key)

openssl x509 –in mycompany.pem -text –noout
openssl x509 –in mycompany.key -text –noout

Output the private key

openssl rsa –in mycompany.key
openssl rsa –in mycompany.pem

(if they’re the sam certificate, they output the same thing).

Output the private key in readable format

openssl rsa –in mycompany.key –text
openssl rsa –in mycompany.key –text –noout (omit the binary part)
openssl rsa –in mycompany.pem –text
openssl rsa –in mycompany.pem –text –noout (omit the binary part)

Update:

Launch small https server to test a certificate

# on one host, set up the server (using default port 4433)
openssl s_server -cert mycert.pem –www

Check the speeds to that server

# on second host (or even the same one), run s_time
openssl s_time -connect myhost:4433 -www / -new -ssl3

# Thursday, May 14, 2009

Skype on a mac, what to do when it fails

Skype today refused to receive messages. I could see the balloons, but the message-boxes were empty.

Rebooting failed.
Updating Skype failed.

I got tired and removed my account’s local db (history and other stuff) and it all worked as a charm.

Local db located at ~/Library/Application Support/Skype/[username]

# Tuesday, May 12, 2009

How to have a Subversion Repository on a Windows Server (+ security), part 1

The article is written based on Windows Server, CollabNet Subversion 1.6.1, Apache 2.2. Windows XP or Vista would do as well.

Subversion comes with it’s own server – svnserve. By default there is no security. One can install svn+ssh, but on a windows server and windows client that is a bit stupid.

The other option is to setup an Apache server with mod_dav and mod_dav_svn. Fortunately the CollabNet Subversion binary comes with Apache pre-bundled with those modules. The binary even installs viewvc, which is rather nice.

Installation steps.

After installing the bundle, however, there are a lot of things to do. Most of them manually. I’ll try to describe most of them here.

Download Collabnet Subversion Server binary from CollabNet (no other place to download it from). Registration required.

So we decided to use Apache instead of svnserve, so while installing one doesn’t have to make it a service. Only Apache should be installed as a service. Another pro for Apache is that it can host multiple SVN repositories as opposed to only one by svnserve AFAIK.

Now is the time to suggest that one make the Apache server run with limited credentials. By default the service would be running with Local System account which has more privileges than God the users in the Administrators group. The concrete steps would be to create one user with compmgmt.msc. Remove it from the Users group (which removes all the default privileges) and give this user Modify right for the httpd directory (one will most probably find it in C:\Program files\Subversion\httpd) and all the repositories.

The configuration. When installing Apache asks where is the repositories basedir. Using a basedir means that all the repositories are subdirectories of the basedir:

Subversion/httpd/conf/httpd.conf:

<Location /svn>
  DAV svn
  SVNParentPath "D:/SVN Repositories/"    <— put the qoutes. installer does not do it
</Location>

Note: by default the installer does not put quotes around the dir, so if there are space characters, the server will not start. One should put the quotes himself/herself.

Now is the time to say that the Apache server is very verbose. Every error show up in the Event Viewer in the Applications tab. There are always pretty good descriptions of what is wrong. I definitely like this feature of Apache. Unfortutely one has to use Google to figure how to fix it.

Another place to look for errors is httpd/logs/errors.log. Pretty readable. I’m positively surprised.

I don’t like the basedir approach – repositories with me are in different dirs. I do it like this

<Location /svn/mycompany>
   DAV svn
   SVNPath "D:/My Company/Repository"                   <— put the qoutes
</Location>

Authentication. Very shortly – http basic and http digest. Http basic is very insecure (only base64). Http basic looks like this:

<Location /svn/mycompany>
   DAV svn
   SVNPath "D:/My Company/Repository"
   AuthType Basic
   AuthName "MyCompany subversion repository"
  
AuthUserFile "C:\Program Files\Subversion/httpd/conf/svn_auth_file"
   Require valid-user
</Location>

Now, how to make the user’s file (svn_auth_file). Use htpasswd (only for http basic):

C:\Program Files\Subversion\httpd\bin>htpasswd -cm ..\conf\svn_auth_file mihail
New password: ******
Re-type new password: ******
Adding password for user mihail

C:\Program Files\Subversion\httpd\bin>htpasswd -m ..\conf\svn_auth_file ivan
New password: *****
Re-type new password: *****
Updating password for user ivan

The first time –c is used to create the file. Any subsequent user is with –m only (which stands for MD5 as far as I remember).

svn_auth_file:

mihail:$apr1$AzWq5tu5$k554PODb79n9TZwBxBDh..
ivan:$apr1$hlr9s6gK$oFLP1WtwvOLczyUSiP10v/

For http digest the configuration first the module has to be uncommented in httpd.conf:

LoadModule auth_digest_module modules/mod_auth_digest.so    <—uncomment this line

the configuration for the location is the following:

<Location /svn/mycompany>

AuthType Digest

And users are made with htdigest:

C:\Program Files\Subversion\httpd\bin>htdigest.exe –c ../conf/svn_auth_file "MyCompany subversion repository" mihail
Adding user mihail in realm MyCompany subversion repository
New password: ******
Re-type new password: ******

C:\Program Files\Subversion\httpd\bin>htdigest.exe ../conf/svn_auth_file "MyCompany subversion repository" ivan
Adding user ivan in realm MyCompany subversion repository
New password: ******
Re-type new password: ******

The file svn_auth_file looks a bit different now:

mihail:MyCompany subversion repository:3d16aced3eac2fc74ce5663df86d145b
ivan:MyCompany subversion repository:3ff20546c01028d5008651445b62d2e0

Note: keep in mind that the realms in svn_auth_file and the <Location AuthName should match.

Note: do not confuse htpasswd and htdigest. They produce users for http basic and http digest respectively and are not interchangeable.

For now there is a pretty usable svn server that supports multiple repositories and digest auth. But the communication with the server is plain and unencrypted http.

The svnbook is available here (most up-to-date version 1.5): http://svnbook.red-bean.com/en/1.5/svn.serverconfig.httpd.html. The chapter for servers is Chapter 6.

The next part is how to setup a SSL on top of Apache.

# Sunday, May 10, 2009

Pingbacks now work

The blog just said:

You were pinged back by
http://mihail.stoynov.com/blog/2009/05/10/TestBlogPostWithWindowsLiveWriter.aspx
on your weblog entry 'Usability of the blog'
(http://mihail.stoynov.com/blog/2009/05/05/UsabilityOfTheBlog.aspx

I’ve linked myself in the past but I guess this feature was off or broken.

Test blog post with Windows Live Writer

I’ve heard of Windows Live Writer but I’ve always thought that it only works for Blogger and Sharepoint. A comment to the blog (here) made me investigate whether dasBlog would support WLW. It does. This is the first blog post with WLW.

While installing WLW in my virtual Windows XP (I’ll write about that later if WLW works) I decided to update the blog. The update can now be installed with something called Web Platform Installer 2.0. It installs crap directly from the internet especially crap for IIS:

Web Platform Installer 2.0

(Wow, WLW can inline the image in the text. I’ve always missed that.)

So, let’s see how this blog post would look like.

Submit... (in this case “Publish”)



Update: this cannot be true. WLW has live preview that embeds the post in the blog, this is so f*cking cool. Look at it:

 


WLW live preview

 

 

 

 

 

 

 

 

 

 




Image thumbnails, resizing. Categories. Everything seems to work seamlessly. So let’s finally submit it and see what happens (I may start using this a lot).

# Tuesday, May 05, 2009

Usability of the blog

Watching the blog stat one can't help but notice the decreasing amount of articles (I guess my single reader and I are the ones that should notice). Maybe it's because a lack of time. Maybe it's because of too much work,study or travel (I'm currently in Turkey on vacation).

Lately one new reason is emerging in my head (yes, it takes them (the thought) some time to mature :). Maybe I'm not writing that much because of the usability of the blog. The usability from the readers' point of view is bad (here for example,), but it's hard to fix it and I'm too lazy to do it. But now I'd like to talk about usability from my perspective (as the author).

I'm running the blog (hosted on dasBlog) at my own server with a very cheap internet connection so it's a bit slow. dasBlog doesn't do any kind of image help (not to mention anything more complex) - I have to do my own thumbnails (I so very much hate that). dasBlog's rich text editor does not support my phone's browser or Safari.

So at the end even if i think of a good story it takes a lot of time to represent it in the blog. Especially if it's very visual, or even only a bit visual.

So I have to think of other ways to improve my experience. And I just thought of one. I'll write when I do it.

Good Night, and Good Luck.

I just watched the 2005 movie Good Night, and Good Luck. It basically depicts the communist witch-hunt that happened in the US just after the WWII. It's very moving and a bit sad (especially at the end with the faith of the main character).

The movie made me spend some time on Wikipedia reading about McCarthy, Murrow and Hollenbeck. Very interesting. Makes one think whether we have the same media now.

Directed by George Clooney. 6 Academy awards nominations. Highly recommended.

# Tuesday, April 21, 2009

Gmail's new attach file button

Gmail recently changed the "Attach..." button with a flash one. Today I found out why. Now one can attach multiple documents with one click. It's awesome.

Update: due to some comments here are some screenshots:

On a mac (firefox) it's working:





On Windows (firefox) there was no flash button. (I've seen Gmail and other google applications change the look&feel on different browsers and different google users. Maybe that's the reason.)

The screenshot:

# Friday, March 20, 2009

How to consolidate (add, gather) multiple private keys in one JKS file with keytool

Do the following multiple times:

keytool
  -importkeystore
    -srckeystore mycompany1.root.ca.jks
    -srcalias
mycompany1.ca
    -destalias
mycompany1.ca
    -srcstorepass
mycompany1.ca

    -destkeystore container.root.ca.jks
    -deststorepass container.root.ca

The first time you do it the container.root.ca.jks would be created. The subsequent times it will just be filled up with new and new keypairs (public and private keys).

# Thursday, March 19, 2009

How to set up networks and dhcp on vmware (on Mac and other OSs)

How to do networking with VMWare Workstation or VMWare Fusion?

For clarity, let's assume that the host (the machine running vmware fusion or vmware workstation) has the ip of 192.168.0.10.

On every virtual machine there are three options:
Bridged (VM becomes visible to other machines beside the host. It has an IP like 192.168.0.11).
Nat (VM is visible only to the host, there is internet).
Host only (VM is visible only to the host, but no internet).


Do ipconfig or ifconfig.
vmnet8 is for NAT.
vmnet1 is for host-only.
These are whole networks for virtual machines. If nat is chosen, then the VM would be supplied an IP from the vmnet8 pool.


DHCP.
If 'bridged' is chosen, then the administrator of 192.168.0.1 must assign an address to the VM.
if 'nat' or 'host-only' is chosen, then:
(I'll describe how to do this on a mac):

goto:
$cd /Library/Application Support/VMware Fusion

stop vmware networking:
$sudo ./boot.sh --stop



Let's suppose vmnet8 is 172.16.57.1 and vmnet1 is 172.16.163.1.


I would like to change the network from 172.16.57.1 to 172.16.16.1 and I would like to specify a virtual machine with a specific IP.

We're still in /Library/Application Support/VMware Fusion

Then:
$ grep 172.16.57 *
locations:answer VNET_8_HOSTONLY_HOSTADDR 172.16.57.1


Then all files in the list must be changed.
Then we go into /Library/Application Support/VMware Fusion/vmnet8/

Then the same:

$ grep 172.16.57 *
dhcpd.conf:subnet 172.16.57.0 netmask 255.255.255.0 {
dhcpd.conf: range 172.16.57.128 172.16.57.254;
dhcpd.conf: option broadcast-address 172.16.57.255;
dhcpd.conf: option domain-name-servers 172.16.57.2;
dhcpd.conf: option netbios-name-servers 172.16.57.2;
dhcpd.conf: option routers 172.16.57.2;
nat.conf:ip = 172.16.57.2
nat.conf:# or ip = 172.16.57.2/24




All of them must be changed.

If a specific VM must have a specific IP we go to:
/Library/Application Support/VMware Fusion/vmnet8/dhcpd.conf and we add the following:
(get the mac from the VM (ipconfig, ifconfig eth0))

host myhost {
hardware ethernet 00:0C:29:B2:C9:69;
fixed-address 172.16.16.16;
}


Then to renew the ip (ipconfig /release, ipconfig /renew for windows):
sudo ifconfig vmnet down
sudo ifconfig vmnet up


The last thing is to start the vmware networking:
sudo ./boot.sh --start



Then to renew the ip inside the VM (ipconfig /release, ipconfig /renew for windows):
sudo ifconfig vmnet down
sudo ifconfig vmnet up

# Wednesday, March 18, 2009

MS Office for Mac sucks

It's like bringing "the Vista experience" to a Mac.
I didn't like it.

It's super slow.
The windows do not open where they're supposed to. The tool boxes open in different window (I have Spaces on).
The interface is new and unintuitive.
The windows focus is changed randomly so I have to fight for it.

# Thursday, March 12, 2009

Certificates, keystores, java keytool utility and openssl

(Updated: four six typos fixed)

I)
From time to time I need a self-signed certificate. I use the java keytool utility to make one:

For a JKS (Java Key Store format):
keytool
  -genkeypair
    -keystore mihail.stoynov.jks
    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -keysize 2048
    -keyalg RSA
    -sigalg sha1withrsa
    -dname "cn=Mihail Stoynov,
ou=MyCompany Bulgaria, o=MyCompany, L=Sofia, S=Sofia, c=BG"
    -validity 3650
    -v

For a PKCS#12 keystore:
keytool
  -genkeypair
    -keystore mihail.stoynov.p12
    -storetype pkcs12
    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -keysize 2048
    -keyalg RSA
    -sigalg sha1withrsa
    -dname "cn=Mihail Stoynov, ou=MyCompany Bulgaria, o=MyCompany, L=Sofia, S=Sofia, c=BG"
    -validity 3650
    -v

When the public certificate is needed separately, one can be exported in a file (mihail.stoynov.cer) like this:
(from a JKS)
keytool
  -exportcert
    -keystore mihail.stoynov.jks
    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -file mihail.stoynov.cer
    -v

(from a PKCS#12)
keytool
  -exportcert
    -keystore mihail.stoynov.p12
    -storetype pkcs12
    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -file mihail.stoynov.cer
    -v

NOTE: keep storepass and keypass the same for easy importing into browsers


II)
Sometimes self-signed certificates are not enough and a CA root certificate must be made in order to sign a group of certificates.

First a Certificate signing request (CSR) must be made:
(from a JKS)
keytool
  -certreq
    -keystore mihail.stoynov.jks
    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -v
    >> mihail.stoynov.csr

(from a PKCS#12)
keytool
  -certreq
    -keystore mihail.stoynov.p12
    -storetype pkcs12
    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -v
    >> mihail.stoynov.csr

(the output is directed to a file: mihail.stoynov.cer)

The file looks something like that:
-----BEGIN NEW CERTIFICATE REQUEST-----
MIICtTCCAZ0CAQAwcDELMAkGA1UEBhMCQkcxDjAMBgNVBAgTBVNvZmlhMQ4wDAYDVQQHEwVTb2Zp
YTEQMA4GA1UEChMHTWF0ZXJuYTEWMBQGA1UECxMNTWF0ZXJuYSBTb2ZpYTEXMBUGA1UEAxMOTWlo
YWlsIFN0b3lub3YwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZ7XpdyHuF9ApZodSn
GS9/TiUtXqryPDD0elzlP2QreSkfYv8IaXnB1Xy1ZVmda/d+P4TZ/aHvAhDwQPcei4KaoRzJWX9I
Yz9hi4cmKksjg8ufDZzXUuMwtbVlricc5vWg1HcSsQJ8vpLCBIelliDJOxc4skDcT23LGQttiv0b
23pjMthEe2tJVp37Tnwr29SLz0AGziVwzb5cfAXU4PzpiASr8vF2A0c2DObS7zM5Wp7jXWIe71P5
BZgIMcUUGlCdfLQRoA7URWN2Yx2qH8gyiNaIaZYZB6o2ib8rH3UmDl/ErKJgWQyS7sr4bANY9WpA
m7H2nXfGs+X88xSbA0JRAgMBAAGgADANBgkqhkiG9w0BAQUFAAOCAQEAIn81dCSpVbI7IDLO2L2p
MW1gnjvuRs9xm6M9rMV6Kwy0Nw05qL0H8tTsFaq4J7bLBXJeXmiREUbrtpbHxLUfjtaqs5q5Txxn
c7Cm5kj7t9PWeRTW0rbzRssgT+sHqUlMKMydB8E+gGEIMQdgwdurhjpD7aevOOeN5fvv9kV7Rszv
6nC8dixyrsiiWjLUGJRP7I9HrEAXKfk3JluSYKS/ZNhTIw5a7fKvhXbRPlN1lDSvdkJAtcaG/9dZ
3KlXL7ozL8sOQTjFxUhN6kS6QujJ1T7TlkWHu9/ivIAkuXBu8P/czyLyjf1JD9fnwGnxCO2FPmcX
9/2IpwG33mMpaAmXpA==
-----END NEW CERTIFICATE REQUEST-----



Did we forget something? Yes, there's no Root CA certificate. Let's make one:
(JKS)
keytool
  -genkeypair
    -keystore mycompany.root.ca.jks
    -storepass "mycompany.root.ca"
    -alias "mycompany.root.ca"
    -keypass "mycompany.root.ca"
    -keyalg RSA
    -keysize 2048
    -sigalg SHA1withRSA
    -dname "cn=MyCompany Bulgaria, ou=Office No 5, o=MyCompany, L=Sofia, S=Sofia, c=BG"
    -validity 3650
    -v


(PKCS#12)

keytool
  -genkeypair
    -keystore mycompany.root.ca.p12
    -storetype pkcs12
    -storepass "mycompany.root.ca"
    -alias "mycompany.root.ca"
    -keypass "mycompany.root.ca"
    -keyalg RSA
    -keysize 2048
    -sigalg SHA1withRSA
    -dname "cn=MyCompany Bulgaria, ou=Office No 5, o=MyCompany, L=Sofia, S=Sofia, c=BG"
    -validity 3650
    -v




Problem No 1
Keytool cannot sign CSRs. Period.

Now what do we do?

I went to OpenSSL.

In order to sign with OpenSSL I needed the root certificate in the PEM format.
P12 (PKCS#12) -> PEM:
openssl
  pkcs12
    -in mycompany.root.ca.p12
    -out mycompany.root.ca.pem

Sign the CSR with OpenSSL:
openssl
  x509
    -req
    -in mihail.stoynov.csr
    -CA mycompany.root.ca.pem
    -out mihail.stoynov.signed.cer
    -days 3650
    -CAcreateserial

(I don't know what -CAcreateserial is but it works)

So now I have mihail.stoynov.signed.cer.

The last step is to import it to mihail.stoynov.p12 (or .jks) in order to override the self-signed certificate with the one signed by the MyCompany Root CA.

A Prerequisite step to that is to import mycompany.root.ca.cer into mihail.stoynov.p12 (or .jks) because every certificate in the chain must be contained in the certificate chain of mihail.stoynov.



Problem No 2
Importing mycompany.root.ca.cer into mihail.stoynov.p12 fails but importing it into mihail.stoynov.jks works?!

JKS:
keytool
  -importcert
    -keystore mihail.stoynov.jks
    -storepass mihail.stoynov
    -alias mycompany.root.ca
    -keypass
mycompany.root.ca
    -file mycompany.root.ca.cer
    -v
(this one works)

PKCS#12
keytool
  -importcert
    -keystore mihail.stoynov.p12
    -storetype pkcs12
    -storepass mihail.stoynov
    -alias mycompany.root.ca
    -keypass
mycompany.root.ca
    -file mycompany.root.ca.cer
    -v
this one fails with:
Owner: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Issuer: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Serial number: 49b8c365
Valid from: Thu Mar 12 08:12:13 GMT+00:02 2009 until: Sun Mar 10 08:12:13 GMT+00:02 2019
Certificate fingerprints:
     MD5:  1C:0C:82:0D:35:C8:1E:48:74:9F:13:43:C9:AE:D0:F7
     SHA1: DB:BB:D7:DB:8C:33:AA:06:6D:CF:D2:5C:EB:64:01:D5:AD:AB:94:38
     Signature algorithm name: SHA1withRSA
     Version: 3
Trust this certificate? [no]:  y

keytool error: java.security.KeyStoreException: TrustedCertEntry not supported
java.security.KeyStoreException: TrustedCertEntry not supported
    at com.sun.net.ssl.internal.pkcs12.PKCS12KeyStore.engineSetCertificateEntry(PKCS12KeyStore.java:620)
    at java.security.KeyStore.setCertificateEntry(KeyStore.java:941)
    at sun.security.tools.KeyTool.addTrustedCert(KeyTool.java:1958)
    at sun.security.tools.KeyTool.doCommands(KeyTool.java:818)
    at sun.security.tools.KeyTool.run(KeyTool.java:172)
    at sun.security.tools.KeyTool.main(KeyTool.java:166)

Actually P12 format does not permit trusted certificates. It is inteded to contain key/pairs only. So importing mycompany.root.ca.cer into mihail.stoynov.p12 failed.


I tried several things:

1) Importing mihail.stoynov.signed.cer directly into mihail.stoynov.p12:
keytool
  -importcert
    -keystore mihail.stoynov.p12
    -storetype pkcs12

    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -file mihail.stoynov.signed.cer
    -v
and the response was:
keytool error: java.lang.Exception: Failed to establish chain from reply
java.lang.Exception: Failed to establish chain from reply
    at sun.security.tools.KeyTool.establishCertChain(KeyTool.java:2662)
    at sun.security.tools.KeyTool.installReply(KeyTool.java:1870)
    at sun.security.tools.KeyTool.doCommands(KeyTool.java:807)
    at sun.security.tools.KeyTool.run(KeyTool.java:172)
    at sun.security.tools.KeyTool.main(KeyTool.java:166)

2) Importing mycompany.root.ca.cer into cacerts:
keytool -importcert -trustcacerts -file mycompany.root.ca.cer
This again didn't fix the problem.



Solution to Problem No 2:
Transform P12 to JKS, import the root certificate and the signed certificate into JKS keystore, transform the modified JKS back to P12.

1) Transform P12 to JKS
keytool
  -importkeystore
    -srckeystore mihail.stoynov.p12
    -destkeystore mihail.stoynov.jks
    -srcstoretype pkcs12
    -srcstorepass mihail.stoynov
    -deststorepass mihail.stoynov
2) import the root certificate into the JKS keystore
keytool
  -importcert
    -keystore mihail.stoynov.jks
    -storepass mihail.stoynov
    -alias mycompany.root.ca
    -keypass mycompany.root.ca
    -file mycompany.root.ca.cer
    -v
3) import signed certificate into JKS keystore
keytool
  -importcert
    -keystore mihail.stoynov.jks
    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -file mihail.stoynov.signed.cer
    -v
4) transform the modified JKS back to P12
keytool
  -importkeystore
    -srckeystore mihail.stoynov.jks
    -destkeystore mihail.stoynov.p12
    -deststoretype pkcs12
    -srcstorepass mihail.stoynov
    -deststorepass mihail.stoynov
it said something like:
Entry for alias mihail.stoynov successfully imported.
Problem importing entry for alias mycompany.root.ca: java.security.KeyStoreException: TrustedCertEntry not supported.
Entry for alias mycompany.root.ca not imported.
Do you want to quit the import process? [no]:  n
Import command completed:  1 entries successfully imported, 1 entries failed or cancelled
I clicked yes, and it worked.


Now let's see what's the difference between mihail.stoynov.jks and mihail.stoynov.p12:
JKS:
$ keytool -list -keystore mihail.stoynov.jks -storetype jks -storepass mihail.stoynov -v

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 2 entries

Alias name: mihail.stoynov
Creation date: Mar 12, 2009
Entry type: PrivateKeyEntry
Certificate chain length: 2
Certificate[1]:
Owner: CN=Mihail Stoynov, OU=MyCompany Sofia, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Issuer: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Serial number: f0e465bb77420e30
Valid from: Thu Mar 12 09:29:19 GMT+00:02 2009 until: Sun Mar 10 09:29:19 GMT+00:02 2019
Certificate fingerprints:
     MD5:  40:9D:C2:DE:AE:11:1E:01:92:F9:C8:01:C5:92:69:CB
     SHA1: D2:D0:03:5C:50:BC:F8:6C:EB:C0:36:B6:B0:8D:A8:3B:9E:B6:7B:B4
     Signature algorithm name: SHA1withRSA
     Version: 1
Certificate[2]:
Owner: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Issuer: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Serial number: 49b8c365
Valid from: Thu Mar 12 08:12:13 GMT+00:02 2009 until: Sun Mar 10 08:12:13 GMT+00:02 2019
Certificate fingerprints:
     MD5:  1C:0C:82:0D:35:C8:1E:48:74:9F:13:43:C9:AE:D0:F7
     SHA1: DB:BB:D7:DB:8C:33:AA:06:6D:CF:D2:5C:EB:64:01:D5:AD:AB:94:38
     Signature algorithm name: SHA1withRSA
     Version: 3


*******************************************
*******************************************


Alias name: mycompany.root.ca
Creation date: Mar 12, 2009
Entry type: trustedCertEntry

Owner: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Issuer: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Serial number: 49b8c365
Valid from: Thu Mar 12 08:12:13 GMT+00:02 2009 until: Sun Mar 10 08:12:13 GMT+00:02 2019
Certificate fingerprints:
     MD5:  1C:0C:82:0D:35:C8:1E:48:74:9F:13:43:C9:AE:D0:F7
     SHA1: DB:BB:D7:DB:8C:33:AA:06:6D:CF:D2:5C:EB:64:01:D5:AD:AB:94:38
     Signature algorithm name: SHA1withRSA
     Version: 3


*******************************************
*******************************************





P12 (PKCS#12)
$ keytool -list -keystore mihail.stoynov.p12 -storetype pkcs12 -storepass mihail.stoynov -v

Keystore type: PKCS12
Keystore provider: SunJSSE

Your keystore contains 1 entry

Alias name: mihail.stoynov
Creation date: Mar 12, 2009
Entry type: PrivateKeyEntry
Certificate chain length: 2
Certificate[1]:
Owner: CN=Mihail Stoynov, OU=MyCompany Sofia, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Issuer: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Serial number: f0e465bb77420e30
Valid from: Thu Mar 12 09:29:19 GMT+00:02 2009 until: Sun Mar 10 09:29:19 GMT+00:02 2019
Certificate fingerprints:
     MD5:  40:9D:C2:DE:AE:11:1E:01:92:F9:C8:01:C5:92:69:CB
     SHA1: D2:D0:03:5C:50:BC:F8:6C:EB:C0:36:B6:B0:8D:A8:3B:9E:B6:7B:B4
     Signature algorithm name: SHA1withRSA
     Version: 1
Certificate[2]:
Owner: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Issuer: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Serial number: 49b8c365
Valid from: Thu Mar 12 08:12:13 GMT+00:02 2009 until: Sun Mar 10 08:12:13 GMT+00:02 2019
Certificate fingerprints:
     MD5:  1C:0C:82:0D:35:C8:1E:48:74:9F:13:43:C9:AE:D0:F7
     SHA1: DB:BB:D7:DB:8C:33:AA:06:6D:CF:D2:5C:EB:64:01:D5:AD:AB:94:38
     Signature algorithm name: SHA1withRSA
     Version: 3


*******************************************
*******************************************






Do you see the difference?
It's in italic - JKS format keeps an extra trusted certificate of MyCompany Root CA.

Anyway both mihail.stoynov.jks and mihail.stoynov.p12 work perfectly.


P.S.
Does someone know better solutions to Problem No 1 and Problem No 2?
Does someone know how to sign certificates but without the cumbersome CSR step?
# Tuesday, March 03, 2009

The "Introduction to Programming with Java" is out

The book "Introduction to Programming with Java" I coauthored is out.



The book is in Bulgarian and it's free.

For now it's only in electronic form, but we're planning to print it. We're not planning on making profit from the printed book, so we're looking for sponsors.

I co-wrote the Exceptions chapter and authored the Object-oriented programming (OOP) chapter and the Qualitative programming code chapter.

# Monday, March 02, 2009

Windows XP's numerous connections



This happened on a Windows XP machine with the latest updates.
# Thursday, February 26, 2009

Nokia Maps 2.0 free navigation license for 1 week

While searching for updates I found out that Nokia gives 1-week free navigation licenses.
One can be obtained from here.

Instructions: a mobile phone has to be supplied and a serial key is sent as an sms that has to be inputted in Nokia Maps. Unfortunatelly +359 (Bulgaria's country code) is not supported (but Romania is) so I used a friend's phone.

Yesterday I tested the thing and it's amazing. The routes it calculates are better than Garmin's ones. Interacting with the software is so much better, especially browsing the map - awesome. There is voice guiding in Bulgarian.

The generally good thing with Nokia Maps is that it's free (the software). There are a lot of maps that are also free. Only the routing capability has to be purchased - it's not very cheap.

Unfortunately their maps are really poor. Bulgaria's map is only 4 megabytes. The Bolkans' map is like 40-50 if I recall correctly.

# Tuesday, February 10, 2009

Sniff TCP connections

In the world of windows there is no standard tool to see what's going on the network level.

I have been working quite a while with web services and encryption and signing, so it's vital to me to see what's going on when a web service is being called.

TCP proxies
The way I was doing it until recently was to use TCP proxies. TCP proxies open a TCP port and forward to some other host:port. In the process of doing so it dumps every connection on the screen or in a file.
For example if I want to listen what's going on a local (for the machine I'm working on) port 8080 the following had to be done: the software working on 8080 (a web service) is moved for example to 18080, then the proxy is opened at 8080 which forwards everything to localhost:18080.

There is one minor drawback to the whole story -  the clients have to be supplied with a port that is not the port where the service resides. So if the proxy is missing - the service is invisible.

I've used mostly tcpmon and wsmonitor. wsmonitor sucks a lot. tcpmon works, but cannot handle moderately heavy traffic and has a lot of quirks that are very annoying. Anyway until recently it was my primary way of doing things.


Reading direcly from the TCP/IP Stack
There has always been software that can plug something in the TCP/IP stack of the windows machine and thus sniff the traffic. The bad side is that the machine has to be tampered with some third-party software. And some machines cannot (should not) be tampered like that.


A third way
There seems to be a software that can sniff the traffic without plugging nasty stuff in the TCP/IP stack. On such example is SmartSniff. It has what they call a "Raw Sockets" way of sniffing and so far it's working great.

# Thursday, January 22, 2009

Server down for a few days

The server went down because of me being stupid.

I have stopped the http service (IIS), and backed it up. But then I was stupid enough not to bring it back on.

And then - why are there no events?

# Friday, December 26, 2008

Guitar tuner - how to tune up a guitar for dummies

I can't distinguish notes. This makes it hard for me to tune up my guitar.

There are tuners that just play a certain tone and one should be able to tune up based on the tone heard. I can't do it like that.

That's why I searched for a tuner that could "hear" my guitar.

Guess what - I found it. It's called AP Tuner 3:




It's amazing. It just works. No configuration, no nothing.
This is how software should be written.

What's new

I haven't written in over a month.

During this time I busted my ass off (worked a lot).

Somewhere around my last post I managed to stop the coffee, which for me is like a dream-come-true. One would ask - so what, it's not that hard? For me it was. I started drinking coffee in 10th grade. Around my first year in the university I started drinking a lot - my personal best is 8 cups per day. Since then it got stable around 6 cups/day.
From that time off I have made two attempts to stop it. They both failed. The first one managed to drop the dose to around 3 cups. The second attempt managed to drop to 1-2 cups per day. During the "dry period" I wasn't the same guy - I slept a lot, I couldn't stay focused - it was difficult.
The third attempt I did was different - it was easy. I guess the first two did the job. This time I just sealed the deal.
One would also ask - is coffee that bad? I don't know really. For me it was because I drank a lot and couldn't control it.

I stopped my facebook account - for me the cons are more than the pros.

# Thursday, November 20, 2008

The blog as a knowledge base

Microsoft has a term "knowledge base article" which solves a particular problem or at least describes it better.
It comes out, there's a term http://en.wikipedia.org/wiki/Knowledge_base

Today was the second time I use the blog as a knowledge base. I know I have stumbled upon a problem, I think I wrote about it, I search the blog - there it is, and it solves my problem again.
Great, another usage of the seemingly useless blog.

# Monday, November 17, 2008

Tomcat under attack, manager password exploited, trojan deployed

There's an Apache Tomcat I'm managing that's in the wild (internet).

Saturday evening it was under attack.

I use Tomcat's manager console to drop applications from time to time and I had it's password pretty simple. Within this console a new java web application may be installed.
What's even worse is that that Tomcat instance was running with pretty high privileges.

It was a test machine, only a few guys knew the address.

So using this console a trojan was inserted. The admin password was changed. This trojan might have succeeded if it weren't for the antivirus that got the trojan on time (yes, it was a windows machine).
The trojan is called TROJ_DELF.BDG and it was deployed in webapps/fexshell/init.exe

Now the tomcat is running with pretty low privileges, the port is not so obvious, and the manager password is changed.

# Friday, November 14, 2008

Importing a class from the 'default package' (no package) - impossible

Did you know that classes in the 'default package' (classes that don't have a package) cannot be imported from classes that do have a package?

I did not know that.

Try it:




This is what javac says:

>javac Class1.java

>javac package2\Clazz2.java -cp .

package2\Clazz2.java:3: '.' expected
import Class1;
             ^
package2\Clazz2.java:3: ';' expected
import Class1;
              ^
2 errors


How stupid is this?
Is this why omitting package is deprecated?

IE6: The last couple of posts look terribly, IE7 - ok

The last couple of posts look terribly in Internet Explorer 6. There are some background rectangles that should not be there:



IE7 displays them correctly.

Update: Maybe it's because I used Word 2007 to write the html for the colored code from Eclipse.
# Thursday, November 13, 2008

Javac bug, Eclipse innocent, bug in static imports

I had an issue compiling some java classes. Javac failed, Eclipse's compiler worked. The issue is described here.
I was blaming Eclipse, I was blaming java6's endorsing. I was thinking it was due to JAXB.

It comes out they all were innocent.

Here's my code:

package f;

 

import static f.ProblematicClass.E1.E2.VALUE;

 

import javax.annotation.Resource;

 

public class ProblematicClass {

 

    @Resource

    public static enum E1 {

        F(VALUE);

 

        private E1( E2 requiredBankAccounts ) {

        }

 

        public static enum E2 {

            VALUE;

        }

    }

}


The result with javac is:
>javac f\ProblematicClass.java

f\ProblematicClass.java:9: cannot find symbol
symbol  : class Resource
location: class f.CorrectClass1
        @Resource
         ^
1 error


After some research I think I simplified the problem:
(If I continue to simplify it would still fail to compile but at some point it would start to compile which yesterday drove me crazy.
This is the most simplistic case that consistently fails to compile)

package f;

 

import static f.ProblematicClass.E1.VALUE;

import javax.annotation.Resource;

 

public class ProblematicClass {

 

      @Resource

      public static enum E1 {

            VALUE;

      }

}


All of these changes fix the compilation error (from javac):

...

// Reverse the order of imports

import javax.annotation.Resource;

import static f.ProblematicClass.E1.VALUE;

...

or

...
      // Use the FQN of the annotation

      @javax.annotation.Resource

      public static enum E1 {

            VALUE;

      }

...


This all makes me think that the static import fails the next one only if the next one is an annotation (I've tried with a java.util.Collection - it compiled).
I have tried this with jdk6u3 and jdk6u10.
I don't have jdk 1.5. Can someone test it on jdk 1.5?



Update: GRRRRRRRRRRRRRR, Somebody found it before me:
http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6391197
It was reported on 27th of June, 2006 :'(

Here's what they say:

Workarounds:
1) switching the order of the import statements works (although they often get changed back by our development tools).
2) Commenting out the static import statements, then compiling, then putting the import statements back and
compiling again with the old classes still there also works. This means that the compiler errors happen at the strangest
of times
, and in large programs it can be very difficult to work out how to workaround the problems.

Weird javac case - Eclipse's compiler is wrong again.

I have some code.
I have two classes. They both have inner enums.
The two inner enums have an annotation.

But one of them does not compile. The other one compiles just fine.

In eclipse there's no error, but when I build the code from ant I get a compilation error - the annotation class is not found:

    [javac] ProblematicClass.java:147: cannot find symbol
    [javac] symbol  : class XmlType
    [javac] location: class package.ProblematicClass
    [javac]     @XmlType(name="fff")
    [javac]      ^
    [javac] 1 error

I spent some time looking for it - I thought that the classpath is wrong, I endorsed an updated version of the API (java 6). The issue persisted.

Then I decided to use javac directly:


javac -verbose -classpath lib\X.jar;lib\X2.jar -d bin -sourcepath src -encoding UTF-8 src\package\ProblematicClass.java

Strangely enough I got the same error?! Then I did the same for the class that did compile successfully using ant - it worked.
So there was a difference between the two classes and I had to find it.

And I found it, can you find it?

//Does not compile

public class ProblematicClass {

 

      @XmlType( name = "fff1" )

      public static enum InnerType {}

}

 

// Compiles

public class CompilableClass {

 

      @XmlType( name = "fff2" )

      public enum InnerType {}

}

Yes, you're correct. The second enum is not static.
This only happens with inner static enums. The anomaly does not occur if it's an inner static class. I don't know why.

So I'm thinking that in the ProblematicClass the annotation is not visible because the import of XmlType is not visible.
I was correct - this one works:

//Does not compile

public class ProblematicClass {

 

      @javax.xml.bind.annotation.XmlType( name = "fff1" )

      public static enum InnerType {}

}

I just supplied the FQN of @XmlType.

So eclipse is working, javac is not. Now is the time to say that Eclipse is not using javac. I thought it was using jikes (made by IBM), but that's not correct. Eclipse is using its own incremental compiler part of JDT Core. JDT stands for Eclipse Java Development Tools.

http://www.eclipse.org/jdt/core/:

JDT Core is the Java infrastructure of the Java IDE. It includes:

  • An incremental Java compiler. Implemented as an Eclipse builder, it is based on technology evolved from VisualAge for Java compiler. In particular, it allows to run and debug code which still contains unresolved errors.
  • ...

So either javac or Eclipse's compiler is wrong. I would bet that javac is following the spec more strictly.

This is the second time I'm catching Eclipse's compiler of misconduct. The first time was something related to a very complex case with generics - one of the compilers said it was a warning, the other - error. More here.


Update: I was wrong. I was trying to report the problem. I was making a pretty simple case. I used a different annotation: @javax.annotation.Resource. It worked both on Eclipse and on javac.
So the problem is somehow linked with JAXB.

 JAXB is an API bundled with Java 6 (an 'endorsed standard' a 'standalone technology'). The version bundled was JAXB 2.0. If one wants to use a newer version, say JAXB 2.1, an 'Endorsed Standards Override Mechanism' had to be used.

Info on JAXB here.
Info on endorsed mechanism here.

I'm currently with JDK 6 update 10. Somewhere I saw that 'endorsed standard override mechanism' was no longer necessary.

It looks like the problem is more on javac side than on Eclipse's compiler.

I will investigate further.


Update2: It comes out that 'Endorsed Standards Override Mechanism' was existing prior to java 6. Only the standalone technologies were added in Java 6.

Update3: It comes out that 'Endorsed Standards Override Mechanism' is still used.

Update4: It comes out that this bug is very hard to reproduce. My simple examples at some point just started compiling :(

Update5: I just created some code that consistently reproduces the bug. I'll write it in a new entry to be cleaner.

Update6: I fixed coloring and finished the new article on the bug.

# Wednesday, November 12, 2008

JAX-WS: Always clean-up generated stuff before regenerating.

I'm using JAX-WS.
When I'm generating stuff for a web service I generate the jaxws package in a 'gen' source folder.
I don't need the compiled stuff so I generate it to a temp folder that I don't care about.

It comes out that I do have to care about that folder because yesterday I got an obscure error:

com.sun.xml.ws.model.RuntimeModelerException: The serviceName cannot be retrieved from an interface.

This error has only 1 (one) hit on Google. Don't trust me?
Try this one out:
http://www.google.com/search?q=%22com.sun.xml.ws.model.RuntimeModelerException%3A+The+serviceName+cannot+be+retrieved+from+an+interface.%22

The use case in the forum has nothing to do with my environment so I cleaned up and everything worked like a charm.

I've always been unhappy with how production unready wsgen is (here).
# Tuesday, November 11, 2008