# Saturday, October 17, 2009

Tip: how to make Outlook reconnect faster to an Exchange server

I have a problem.

In our company we use MS Exchange as a mail server and we’re away from the company network we can connect to Exchange via a special VPN software. This software disconnects pretty often. When I reconnect it takes quite a while for Outlook to figure out there a working connection. It does eventually but I have to wait for that to happen since I want to make sure a mail is being sent correctly.

I found out that setting “Work offline” on and off quickly makes Outlook connect a lot faster:

outlook work offline mode

There’s this problem though – it’s tedious to go click on the menu and then on the menu item so many times per day. So a solution:

  1. Right click somewhere on the toolbar –> Customize:
    outlook 2007 customize toolbar


  2. Make a new toolbar:
    outlook 2007 new toolbar 

  3. Then the most unnatural step – drag the menu item from the File menu to the new toolbar:
    outlook 2007 add a button to a toolbar

  4. Press Ctrl while dragging, this way the button will be copied, not moved.
  5. That’s pretty much it. Now pressing the button quickly is very easy:
    outlook 2007 the new toolbar on place
# Tuesday, October 13, 2009

Курсът “Социални мрежи” във Факултет по математика и информатика на Софийски Университет

Участвам в избираем курс във ФМИ и днес мина първата ми лекция.

Курсът се казва “Социални мрежи” (официално “Теория на мрежите”) и основната му цел е да запознае студентите с Facebook, Twitter, LinkedIn и други от гледната точка на разработчиците на софтуер.

В него ще бъдат обяснени понятия като социални медии, семантични мрежи и други, но основната му цел е да покаже как се разработват приложения за основните социални мрежи.

Най-популярният програмен език в тази сфера е PHP, а база – MySQL.

Моята задача беше да запозная студентите с SQL като език и MySQL като сървър.

Сайтът на курса е http://socialnetworks.dev.bg/

Лекцията е тук: Databases 101 with MySQL.

# Thursday, October 08, 2009

How to make Eclipse validate XSL (and of course XML) files

Intro on Eclipse

Eclipse has two major bundles:

  • Eclipse IDE for Java Developers
  • Eclipse IDE for Java EE Developers.

Info here: http://www.eclipse.org/downloads/

The major difference is that Eclipse for JavaEE includes the Web Tools Platform (WTP). WTP has editors, designers, JavaEE perspective, new projects and so on.

I generally prefer to use the ‘Java’ perspective as opposed to the ‘JavaEE’ perspective, because the latter is too cluttered, but the one thing from WTP without which I cannot live is the XML editor. There are variations for XSL transformations and XML Schemas.

XML Schemas (XSD)

By default Eclipse can validate XML Schemas, because it has the schema for XSDs. Did you get this one? Let’s try again. XSD is a language written in xml that defines rules for xml files who want to conform to certain rules. This allows us to validate such files versus a schema. Finally XSD is also XML, so there is a special XSD Schema that defines how to write XSD Schemas. And the dog catches its tail.

XML Schema language is also defined in DTD. DTD is the predecessor of XSD.

Anyway, if you want to learn more, go to W3C Schools - the best place to learn XML, XSD, XSLT. This is also the official site of WWW Consortium (W3C) which handles the expert groups that define these standards.

Where is XSL.xsd?

XSL is written in xml, so there is an XSD Schema that defines how to write XSL files.

The schema for XSLT 2.0 (2007 revision) is here: http://www.w3.org/2007/schema-for-xslt20.xsd (the most up-to-date)
The DTD for XSLT 1.0 (1999 revision) is here: http://www.w3.org/TR/1999/REC-xslt-19991116.xml (I couldn’t find XSD for XSL 1.0, maybe because XSL 1.0 is too old)

So the only thing I need to do is put XSL.xsd in Eclipse?

Yes. Here’s how: go to Window –> Preferences and then to XML –> XML Catalogs:

(XML Catalogs are a very interesting topic. There’s an article on them in this blog here)

Eclipse 3.5 preferences 

Then "Add”:

Add XML Catalog from http

There are 3 ways to add an XML Schema to Eclipse

  1. Via an URL (as in the picture)
  2. Via a workspace location
  3. Via a file on the file system

How do we validate?

Here’s how:

Validate button in Eclipse

Via the "Validate" button on the context menu on any XML/XSL file.

The exact same thing can be performed for any XML File that has to be validated against an XML Schema (or DTD, of course)

XML Catalogs

XML Catalogs are ways to describe the connection between XML namespace URL and the actual location to an XSD.

Before XML Catalogs existed, the way to tell where an XSD is was through the schemaLocation directive. This is unpractical because if one has many XSDs that refer to one another or many XMLs, then refactoring or location changing becomes impossible.

TBD.

# Wednesday, October 07, 2009
# Thursday, October 01, 2009

Рубриката No comment: "Българският софтуер по световните стъпки на пловдивския джаз II"

2009/10/1 plovdiv.fair@orakgroup.eu

Здравейте Михаил Стойнов от […],

Имаме удоволствието да Ви поканим на джаз сешън под надслов "Българският софтуер по световните стъпки на пловдивския джаз II". Събитието е в чест на връчването на два златни медала за софтуерни продукти от иновативната бизнес платформа ОРАК R6 на провеждащото се в момента 65-то юбилейно издание на Международния технически панаир в Пловдив. Джаз сешънът ще се състои в нощта на музеите и галериите - 2.10.2009 /петък/ от 19.30 часа, в градината край басейна на хотел SPS,Пловдив /срещу магазин Метро/

За резервация и безплатен електронен ВИП куверт, моля направете онлайн регистрация на http://www.OrakGroup.com/GoldMedals или на национален телефон 0700 1 1234 /24 часа в денонощието/

Нека със световен джаз и чаша пловдивска бира отбележим поредния успех на българската софтуерна индустрия !

Поздрави от целия екип на ОРАК Инженеринг !
Очакваме Ви !

За ОРАК Инженеринг:
ОРАК Инженеринг е лидер на пазара за комплексни софтуерни бизнес продукти и решения за търговия, туризъм и производство, носител на златен медал от Пловдивския технически панаир за продукта ORAK R5 през 2004г., 2007г и на два златни медала за продукти от иновативната бизнес платформа ORAK R6 през 2009г . В България компанията е представена в градовете София, Варна, Бургас, Пловдив, Стара Загора, Слънчев бряг и Банско. Извън страната ОРАК Инженеринг има свои представителства в Македония, Сърбия, Румъния, Турция, Украйна, Русия, САЩ и Обединени арабски емирства. През последните 13 години екипите на ОРАК Инженеринг, в страната и чужбина, имат успешно внедрени над 5000 търговски обекти, ресторанти, заведения, магазини, складове на едро и дребно, разносна търговия, супермаркети, фитнес зали, бензиностанции, обменни бюра, фризьорски салони, хотелски комплекси, управление на собственост, СПА центрове, месо и млекопреработващи предприятия, управление на паркинги и др., които осигуриха многофункционална среда за работа и постигнаха висока ефективност и полезност.

# Friday, September 25, 2009

Централна Кооперативна Банка

ЦКБ е банката, която работи.

Електронното банкиране на ЦКБ е едно от по-грозните - прилича на стария интерфейс на epay.bg. Но е стабилно и работи. И е достатъчно конформистко спрямо уеб стандарти, за да тръгне без никакви грижи на мобилния ми телефон. За целта от УЕП трябваше да мина на софтуерен сертификат на банката. Никакви грижи.

Едно от страхотните неща е, че мога да прехвърля сметки на друг титуляр на моето ел. банкиране и така да ги управлявам централизирано. Което ми се струваше невероятно.

Голям минус за ел. банкирането е, че няма email нотификация, но пък има SMS такава.

Обслужването в повечето случаи е добро, а понякога дори страхотно. При по-трудни казуси съм получавал адекватни отговори.

Таксите са ниски спрямо другите банки, които съм ползвал. Имам 6% лихва на разплащателна сметка с дебитна карта.

Та ЦКБ е работното муле при банките – не е най-лъскавата, но работи.

# Friday, September 18, 2009

Must read: BSD vs. Linux: Design Philosophies

An amazing article on the basic differences between BSD and Linux. The author is a FreeBSD user, so one could expect the bias, but anyway a must-read.

Update: Ups, here's the article itself: http://www.over-yonder.net/~fullermd/rants/bsd4linux/bsd4linux8.php.

# Tuesday, September 15, 2009

OpenWrt

Most wireless routers these days have web interfaces can share USB hard drives, have firewalls and so on.

OpenWrt is an open-source firmware that can be installed on such routers. It started thanks to Linksys using GPL software on it’s WRT54G router and had to release the source. This was the base for the project.

OpenWrt is a minimized linux based on the Busybox distribution that can run on the limited hardware of the devices. Thus the devices become a lot more flexible – ssh, telnet, portforwarding, iptables, firewall and so on.

The current version of OpenWrt is 8.09.01, code-named Kamikaze. They use cocktail names for code-names, the last one was called White Russian.

Another project, x-wrt, uses OpenWrt as a base and creates an elaborate web interface, called webif2, that allows the configuration of router via a web interface for users not familiar with linux. x-wrt uses the same version numbers when they bundle their web interface with OpenWrt.

I’ve used x-wrt 7.09 with webif (version 1) which had it’s glitches. Now I’m using OpenWrt 8.09 that provides its own web interface (quite good really). I haven’t tried webif2. But if I do, I’ll try to write something about it.

What about routers?

The starting point is the table of harware section in OpenWrt’s wiki. For every major manifacturer they have a wiki page with info whether they support the router and how good they support it. My router for example is supported fully with OpenWrt based on linux kernel 2.4. They don’t support the wireless (some binary driver issue) with kernel 2.6. So I’m using the latest version of OpenWrt, but with an older kernel.

Some routers have USB ports which can be used for harddrives, flash memories, usb cameras. For my router they have a manual for live streaming from a web camera. USB harddrives can be shared via ftp, samba…. (it’s a linux box after all).

The pro’s of these machines is that they’re cheap, very powerful, and very quiet.

The con’s come from limited memory (can be extended with a flash), lack of all linux commands and options (busybox).

How traceroute saved the day

After a couple of days of struggling to understand why my laptop was the only one that couldn’t open a connection to a network resource. I finally found out that it was a mac address mix-up.

Sometime ago while testing I used my laptop to pretend that it was that resource. To do that the laptop had its physical address changed. Since then I have forgotten to change the mac address back.

Today I tried traceroute and got surprised. The resource is a couple of hops away, but traceroute said it’s right next to me. I should have noticed that since the machine was responding to a ping 10 times faster than before.

Thanks, traceroute.

Smart port forwarding

This is one of those it-just-works piece of software. It’s a port forwarder for windows. No installation. Easy to use. And it works.

Great.

UPDATE: first, the link to the software: http://www.brooksyounce.com/soft/spf.htm

UPDATE2: The site of this guy, Brooks, is interesting. Especially after reading about the software and then to see this guy’s pictures. The site: http://www.brooksyounce.com/

# Thursday, August 06, 2009

2nd birthday

The blog became 2 a month ago. Happy birthday.

It’s been a lot of fun writing here. I have no idea if expressing myself in English has gotten any better, but the whole thing is very exciting.

The best thing is that I haven’t stopped yet. There were periods when I haven’t written a lot but still – here I am.

I’ve been planning to write some tutorials for such a long time, so I wish to myself that I’ll do write them this year.

# Wednesday, August 05, 2009

The laptop therapy

I’ve been told so many times by people who know me that I spend a lot of time on my laptop doing unnecessary things. I remember my mom trying to get me out of the house when I was ten, but I didn’t want to since I was playing Lethal Weapon, Dune, UFO, Wolfenstein 3D, Doom or watching manga.

I realized that that is true and I could be doing so many offline things. So I invented the laptop therapy.

My last desktop I sold to friend a couple of years ago. The last laptop I got (dell, mentioned so many times in this blog) went to my sister. Now I have a couple of machines with no monitor and a macbook.

So the laptop therapy states: “leave the laptop at work”. So when I’m home I have to do offline things. I’ve been doing the therapy for a couple of weeks now and it really works. The only minor problem is that my roommate has an idle desktop that is always on and always free so I get tempted to use it from time to time. Fortunately it’s so slow that I get annoyed after half an hour. 

Spammers

I’m getting a lot of comments looking like this:

Could you help me. Man is the only animal that can remain on friendly terms with the victims he intends to eat until he eats them.
I am from Micronesia and learning to speak English, tell me right I wrote the following sentence: "More often than not, the limit of the cash advance is a percentage of the total balance available on the credit card."

Someone know how to defend dasBlog against spammers?

# Friday, July 17, 2009

Мирзакарим Норбеков и вярата в шарлатани

Пиша този пост на български, защото ще цитирам разговори на български.

Та майка ми е луднала по Мирзакарим Норбеков.

Днес реших да се разтърся и ето какво й написах:

Това е страничката за Норбеков в уикипедия:
http://en.wikipedia.org/wiki/Mirzakarim_Norbekov

Накратко там пише, че е Узбекистанец и твърди, че може да лекува болести на очите и белези.
На няколко места пише, че заблуждава читателите си с титлата Академик и с други титли, с изследванията си върху еритроцитите (червените кръвни телца) и некви други неща.

Пише, че върху неговите практики няма много изследвания, но пък има изледвания като цяло върху разни източни практики от алтернативната медицина и че Норбеков копира дословно от тях. СЗО (Световната здравна организация) казва, че тези практики като цяло са полезни за здравето.

Та Норбеков е малко шарлатанин и послъгва за научните си успехи, но като цяло практиките му са по-скоро полезни за здравето (СЗО).

Хубаво е да се чете от различни източници.

Тя прие това като заяждане и ми отговори доста гневно:

Мишел, не пращай човека дръзнал да помисли за зрението си, за зелен хайвер.
Вместо да чете разни популярни издания, нека да получи информация директно от източника (курсовете, книгите, учениците).
Научи се да получаваш информация от източника, когато това е възможно. Освен всичко друго той е завеждащ катедра по палингенезия в Международната академия по форматизация към ООН. Откога и в САЩ започнаха да дават високи постове на шарлатани. И там ли имало корупция? И защо му правят този подарък?
Ако искаш да си в час посети някой от мероприятията в София или прочети книга, ако ли не, не вземай отношения по неща за които не си компетентен.

Моят втори отговор и надявам се край на кореспонденцията:

Странно защо като напиша в гугъл "международна академия по форматизация в ООН" ми излизат само страници за Норбеков. Тая академия сайт няма ли си? Нищо ли не пише в интернет за нея? Дори и на английски го търсих - "International Academy of Formatization of UN" и пак само страници за Норбеков излизат.

И какво, по дяволите, означава форматизация. Търсих само думата форматизация и пак само страници за Норбеков. Според гугъл подобна дума не съществува (гугъл има специално търсене за термини и се търси така: "define:formatization" или "define:formatisation").

Норбеков не е първият човек, който е помислил за зрението си. Стига глупости.

Просто не идеализирай нещата. Започни от фактите. И под факти разбирам не само нещата написани в книгите му.

В тая връзка ще ви разкажа една история. Преди време един приятел ми препоръча курс за бързо четене. А момчето умно и си казвам защо пък не. И отиваме при един измамник, който за 150 лева ни проведе 2 седмичен курс като гледахме разни малоумни картинки, за да сме си разтягали зрението и т.н.
Упражнения правихме за очите, които бих казал, че бяха полезни, но не за бързото четене.
Та накрая никой от нас не можеше да чете бързо. Сигурно с Норбеков поне получаваш нещо ценно.

Едно е да вярваш в Господ. Съвсем друго е да отричаш Еволюцията и да твърдиш, че земята е плоска.

iReport 3.0.0 on Mac OS. How to make it work?

iReport is a gui for designing jrxml (the actual reports) files for JasperReports. It is supposed to work on any platform.

We’re using 3.0 instead of 3.5 because 3.5 is based on Netbeans.

I’m trying to work with it on Mac OS (it was extremely slow in the virtual machine, something to do with java I guess).

First:

chmod u+x iReport.sh

…because it’s not executable.

But then it gave me a weird error:

comp:iReport-3.0.0 user$ ./iReport.sh
-bash: ./iReport.sh: /bin/bash^M: bad interpreter: No such file or directory

Google said it’s because of the problem with newline in different platforms. In linux it’s LF (\n)(line feed). In windows it’s CRLF (\r\n) (carriage return, line feed).

So this ^M character appearing in the error is actually the left-out CR.

How to fix it? Wikipedia says:

tr -d '\r' < inputfile > outputfile

This works. But then the next error. iReport.sh calls bin/startup.sh.

The same thing for it.

That’s it. Why was the shell script in a dos format only god can tell.

Note that iReport on a Mac should be in a place whose path does not involve spaces. Here’s a solution for that too.

# Friday, July 10, 2009

MSG

11062009344Madison Square Garden is an amazing structure. I had to pay a full ticket to the totally-unknown-to-me band Flintwood Mac and even to listen to them just to see the MSG. But it was worth it.

Pictures:
http://picasaweb.google.com/mihail.stoynov

Staten Island

Back to the US story.

While staying at the Fitzgerald's (thank you, Kaf) on a rainy day we decided to get the famous free 11062009294ferry to Staten Island (just like Harlem the Staten Island’s name come from the Dutch).

11062009308 The ferry itself passes close to Elis Island on which the Statue of Liberty stands. This is the closest I’ve been to it. The queues are impossible.

The white race is not represented well on Staten Island. The place itself is not as bad as I expected and the parks are very beautiful.

When I watch the pictures now, I don’t think Staten Island is at all interesting. The most 11062009331interesting part about it is the ferry and the view towards Manhattan. Manhattan is awesome.

It was so foggy that day, but that makes the view so much more surreal.

Pictures:
http://picasaweb.google.com/mihail.stoynov

Macbook, the mac way of doing things.

After having a Dell Inspiron for a year (search ‘dell’ in the blog) and having issues with stability (battery died in less than a year, the power charger blew up, it started falling apart, heating up) I decided it’s time for a change. I wanted something very sturdy and then saw the new aluminum body Macbook. So I thought this was it.

I now have it for 6 months and I’m pretty happy with it. Battery takes up to 4 hours, usually 2.5h. The body is exceptionally strong. It' doesn’t heat as much although when Firefox goes berserk (100% processor time) it does heat up.

Switching to Mac OS took some time, but still a lot less than expected. There’s always a windows on a virtual machine, but I rarely use it. Mac OS is really nice to play with. And a lot faster than the vista I had on the dell (search vista in the blog).

I’m not an Apple fan for so many reasons, but they made a pretty stable and usable laptop. That’s my initial experience.

While in the states I saw the new one, with the only major difference being a battery they claim could support the laptop for 7 hours. I don’t believe it, but even 5 would be very nice. Especially for 9-hour over-Atlantic-ocean flights.

A new and more exiting way of going around (Honda CBR600 F3)

Last year I got category A which allows me to ride a motorcycle. A few months ago I finally bought 02042009014 one – Honda CBR600F3. It’s 600 cc, 100 hp, manual 6-speed transmission.

The motorcycle is a bit old, but it was in a pretty good condition. I managed to scratch it a bit, but as far as I know this is part of the deal.

Riding a motorcycle in Sofia is pretty dangerous – the traffic here is pretty bad and drivers are not at all disciplined. But it’s so much fun: it’s fast and very exciting.

Having a bike is pretty cumbersome. I had to rent a garage at work and one close to home. There are the clothes, the limited space for baggage (only a backpack in my case) and the outside conditions (rain, cold weather, …). There’s also the cleaning, the chain oiling and so on. Servicing it is as expensive as an used car if not a bit more.  So having a bike is very unpractical, even having in mind that the traffic jams are no longer an issue.

But it makes life so much more colorful.

# Monday, June 22, 2009

How’s it going with the US

210620091371 So, how’s the trip going?

Its 2 o’clock. I’m trying to arrange all the photos from the 18062009988camera and to find time to write something. I just (3 hours ago) got out of the pool and the water slide in the hotel (somewhere in Montana) and now I have Two and a half men on the background while drinking Yellow Trail (merlo).

Here are a few teasers.

I’ll write when I have more time to do so. Gotta go to sleep because I’m doing rafting tomorrow.

# Thursday, June 18, 2009

NY, part 3

12062009369 We just got on the plane to LA. And I just finished my fourth coffee. The flight attendant on the last flight asked me where I’m from when I asked for the strongest thing he had. Then told me a story about his stay in Sweden where some people laughed at him when he made something and called it coffee, they called it warm water. There wasn’t enough time to eat the Wendy’s salad I bought at the Phoenix’s airport, so brought some food on board. BTW, on these domestic flights they don’t serve food. The cheap bastards. On the last flight there wasn’t any food. Only some chips for 6 bucks.

On the left is a picture of these guys wanting to x-ray even my shoes. USA is such a police state.10062009272

So NY. This is the third post for it. What more could be said about it? It’s crowded, it’s dirty. The metro, being 100 years old, is OLD and ugly. The asphalt on the roads is not that well made.

There’s the “grid system” which means that all street are perpendicular (and I’m talking only about Manhattan, because this is where I stayed). The streets parallel to the length of 10062009274 the island are called Avenues (1st, 2nd, Madison ….). The streets parallel to the width of the island are called streets. So I stayed on the intersection of 2nd and 86th.

Update: On the right is Macy’s – the biggest department store in the world – it has nine floors, mostly girl stuff. There was only half a floor of men’s shoes. There were still something like 4000 pairs, but' that’s another story.11062009283

Oh, yea, we also went to Broadway and watched Shrek. It was amazing. The storyline was based on the first Shrek movie (or the other way around). The stage was something very hi-tech, because it was split into different parts that could move in circles and up and down. The costumes were very well done.  Did I say it was a musical? Yes it 10062009280was. They were singing all the time, but there were so many jokes that it was pretty fun. We were first row on the terrace and I was prohibited to put my legs on the terrace itself. I so wanted to :(

The left is me having a jin and tonic in the intermission.

On the right is me on the 46th floor (the rooftop) of a building close to Empire State Building. And still ESB seems like going sky high.

That’s it from NY for now. Gotta go rafting.

Update: Pictures here: http://picasaweb.google.com/mihail.stoynov

# Monday, June 15, 2009

Long Island, Fire Island

Currently I’m on a A320 (very comfortable seats) plane flying from Chicago to Phoenix en route to LA. This is the only 07062009178 opportunity for writing blog posts. But it’s hard the muse has left me (only 3 hours of sleep and some Metaxa (hope I spelled it right) last night.

So Long Island. When I came to US my geography was pretty bad. I wasn’t good with states, and cities. Everybody know where NY is on the map but I had no idea that NY is entirely seated on islands. Manhattan is an island (one of the five boroughs). The others are Queens (to the right of Manhattan), Brooklyn (below Queens), Bronx (to the north) and Staten Island (just below Manhattan).

So after a night in Queens we all decided we could use the Sunday and go the bea07062009197ch. We went to Fire Island – a small island below another island below the middle of Long Island. We went to a nude beach (friend’s choice) where the view wasn’t pretty. Anyway we had fun as seen from the  picture and went inside the water (was very cold).

Oh yea, and we brought a small freezer with like 4 sixpacks (twenty-four .330l bottles) of some crappy beer and only the three of us tried to drink it.

The gorgeous girl on the right is Erica.

Update: Pictures here: http://picasaweb.google.com/mihail.stoynov

New Haven

09062009213

Meet Iva. Iva is a friend of mine and I’m staying with her in New Haven. Both of us will also travel through the US. After a few days in New York, we went to Chicago for the weekend (will try to write about it too) and now we’re flying to LA.

S03062009082o New Haven. New Haven is where Yale University is. It’s a small and poor (in Iva’s words) town that has a pretty high crime level. On the right is some important building part of Yale, but God forbid I can’t remember what it is. Anyway. After landing in the US the first place I stayed was New Haven. Because of the time difference the next morning I woke up at 6:00 and had to be quite for 6 more hours and stay in my room because Iva doesn’t get up very early.

Since they don’t have internet I 09062009215had to steal some from a nearby wi-fi router. The good thing was that in Bulgaria everyone was up so I had something to do.

When the trip around the US is over I’ll make some more pictures. Until then here a nice one – 20 one-dollar bills are drying after being in the washer.

Update: Pictures here: http://picasaweb.google.com/mihail.stoynov

NY, continued

09062009230

Still on the flight to Phoenix. The battery is half-dead. And I’m drinking the third coffee. Oh, not to mention that I burned my hand pretty bad with a Starbucks L09062009218atte so now I hate Starbucks.

I was just looking the pictures and it’s hard, really hard. I still have to write a lot about NY and then Staten Island, and then Chicago, And from Chicago I have a lot of picture. Damn memory card that can hold 2000 hi-quality (the phone says they are high quality) pictures.

So what else was there is NY. I was mostly in Manhattan, so let’s talk about it. The first picture on the right is from the Marriott Hotel on the 46th floor on a platform th09062009236 at turns 60 degrees in 60 minutes. The platform is a restaurant and the view is awesome. Unfortunately it was at night and the picture is not very nice.

09062009229 The elevator that took us there was one with an open view and we could see the lobbies on every 15 floors. The inside of the hotel was hollow and there lobbies (major floors) were separating the inside of it. Flying with it was a bit scary because at one time one could see the bars 20-30 meters  away and then suddenly a concrete wall with a hole wide enough only for the elevator to go through. The elevator could be seen on the upper left picture.

So what else did we do? Oh yea a friend invited me to see her workplace at the UN headquarters. The one on the left shows10062009259 the General Assembly. There was a session going on and still tourist were let in. The one on the right shows the Security 10062009255Council’s press “wall”. And I’m there giving a press conference and discus sing the problems in North Korea and there second test of their missile. The last one in in front of the building with all the flags. (The pictures are so big that’s hard to write enough text that fills the space between them).

The picture below is part of my sole walk on Times Square in the middle of the night and it shows the NYPD which is in the middle of 

10062009267

the square and is full of cops. 09062009245Isn’t that enough for this post? I just looked at it and it looks very ugly, but I’m too tired to make it look better

 

 

 

Update: Pictures here: http://picasaweb.google.com/mihail.stoynov

NY, first impressions

Updated

Here’s the first pic I have from the US: standing in front of Grand Central station 03062009081in Manhattan

Couple of days ago i was in New York and stayed there for a few nights. The first two nights I stayed in Manhattan (2nd ave) pretty close to Central Park. The first time I went there it was raining for 20 hours so obviously I didn’t enjoy it much. I had to stay the whole day with my shoes being wet.

05062009088The next day I walked on my own and here’s what I saw: the NY fire department :)

The first evening the roommate of one of the friends had a birthday and celebrated it in East Village. It looks a bit like Amsterdam.

This is Ivan and I in front of a building in which the outdoor scenes of Vanilla Sky with Tom Cruise (if I’m not wrong) was filmed. That day it was raining, I was 05062009099wet, he was late and both of us were really hungry. That’s why we’re not so happy.

It was a pretty sleepless stay. We broke in in the Russian Tea Room restaurant (2nd floor was closed) to make pictures with the giant crystal bear (it was 2 meters tall). Then being with t-shits went to the ball on the 3rd floor and made pictures while on the dancing floor.

The cab drivers all seem to be Pakistanis and they all seem to have taken the driver’s license by change. They don’t care how comfortable one feels. The cars most of the times are some old Fords which seem IMG_0492like 10 years old. The driver is separated from us with a glass. They have this touch screens on the glass that airs commercials or have a map with where the taxi is at the moment.

This is the World Trade Center 7 building which was rebuild after it fell on 9/11. I can be seen having a beer on the 27th floor on a working Friday in the office of Company magazine (Erica, correct me if I got the wrong name).IMG_0500

The one on the right is with Ivan. Behind us is the construction site on Ground Zero where some really big building is supposed to be built.

(I have to write more text, otherwise the pictures fail to display correctly, so this is my filling text :)

06062009145 This one is from the the tour we made around NY with Silva. We’re on Brooklyn Bridge.

I saw Times Square, Wall Street, Brooklyn Bridge, I dined beneath a skyscraper in the only restaurant where one could smoke. We all went in the nude beach in Long Island (called the Fire Island).

I’ve been to Queens and today I’ll stay in Brooklyn. I’ve seen the Queensboro bridge. Made fun of the cab drivers. Got pretty drunk.06062009166

This is the bear on the right. The picture is with pretty bad quality, but that’s the best my phone can do in the dark.

Maybe I should write a bit more to fill in the space that the picture opened. But I’m too tired to think.

Update: Pictures here: http://picasaweb.google.com/mihail.stoynov

Having mobile internet in a foreign country – one of the best things one can do

In a previous post I was complaining a bit of the speed of the internet bandwidth from T-Mobile which was something like 3-4 kb/s. Well is some areas it went up to 30 kb/s and stayed at 20 average. But that’s not the point.

Even at 3-4 kb/sec one could use the internet for so many things – the first one is Google Maps. Undoubtedly one of the most useful apps. Especially when you can search for your hotel just when typing “The Gershwin Hotel” and it finds it or just “Public transport –> airport”.

But that’s not all. We could check in online. I could work using skype (Skype for symbian is just too slow, so I use fring; Fring doesn’t support skype chats though which is kind of annoying). We could search for nearby restaurants. We even bought tickets online for Madison Square Garden. We wrote mails, send pictures to friends which we just made.

But that’s not all. The top of the cherry is another amazing story. So here it is. On my laptop I didn’t have Picasa, which I needed to upload the pictures to Picasa Web Albums. So I wanted to download it, but I didn’t want to stay in the hotel and wait for 20mb to be downloaded while the laptop was using the phone as a modem, so I opened the default browser on the phone and tried to download Picasa on the phone. The default browser couldn’t handle the javascript so I tried with Opera Mini. The latest versions of Opera Mini download files themselves, they don’t depend on the default browser for downloads. BTW Opera Mini operates by using a special proxy which “chews” the internet page to be more suitable for the Opera Mini browser. So with Opera Mini the downloads started and while I was enjoying Chicago in my pocket Picasa3 was downloading. I could still make calls, browse with the default browser or use Google Maps. I downloaded Picasa for Windows and for Mac, and I downloaded each twice to make sure that at least one of the downloads would work. So in one afternoon being in the pocket Opera Mini downloaded something like 60 megabytes using a connection that could sometimes drop down to 1 kb/sec.

# Friday, June 12, 2009

Offline blogging

The stuff is written offline in Windows Live Writer and when there’s internet I commit it (publish it). Nice.

Preserving battery life on a macbook

Stopping the Bluetooth and the wi-fi card on a mac adds like an hour to battery life. Amazing, until now I’ve never stopped them.

Google Maps for Symbian vs. Garmin XT

When one goes to an entirely unknown place one tends to take stuff that gives him some security and might help in case of emergency. That’s why I loaded my GPS with offline map of the US using the Garmin XT software.

The GPS device is a Nokia E71 mobile phone (there are some other articles in the blog about it I think, but can’t link to them – I’m in offline mode). It has a 1500 miliamperhour-battery, which is the most I’ve ever seen on a phone and a pretty small screen, so lot’s of time being online.

I had to buy a data plan (I chose T-Mobile, $77 sim with unlimited data) so naturally I decided to try Google Maps for Symbian S60. First of all it’s free as opposed to Garmin XT (even the software is not free, not to mention the maps).

Navigation

Google Maps has an outstanding navigation (by navigation I mean going up/down/left/right and zooming in/out), it’s always fast no matter if the map is loaded or not (shrinks/enlarges the image it has, then replaces that with the newly downloaded one). Garmin’s navigation is plain stupid – the cursor accelerates as one presses up/down/left/right, so one would never know where the cursor would end up.

Searching

Searching in Garmin is like this: Where to go? –> Address/City/POI –> Choose Country –> Choose City –> Choose number –> Choose street. And this takes a while. And it doesn’t always return a result or at least not what one would expect. Google Maps would give you a result if you type “Grand Central, NY”. With Garmin XT if it works it would be hard and time-consuming to do.

Speed

Garmin wasn’t very fast with a 20 mb map of Bulgaria. But it’s definitely slow with a 1.2 gb map of the US, even on “very low detail” setting. Google Maps is always responsive no matter how much it takes for it to load.

Routing

Currently I use trains or metro or just walk. Routing with with Google Maps is fast – three tabs (Public transport, Car, Walk) and then I have to give only start and end locations – that’s it. It gives me amazingly correct results. In Garmin one has to go to the settings and change the Routing to Pedestrian/Car. I don’t even think it has the public transport option.

No GPS option

Google Maps can work without a GPS – it uses the network cells and wi-fi routers to know where it stands. It’s not very accurate but it doesn’t drain the battery with the GPS. It’s very easy to start the GPS – a few clicks away.

The Nokia E71’s GPS is always very quick to find it’s location. I’m guessing the phone starts the GPS for short period once and a while to keep it’s internal clock synchronized. So this option of Google Maps is extremely useful.

Start time

Google Maps is faster and it doesn’t have the annoying warning in the beginning that one has to click on to continue using the Garmin XT.

Satellite view

Very useful in Google Maps. I think Garmin has something similar, but can’t remember how was it.

Maps

Google Maps works so good only in the States. The last time I tested it in Sofia the map was pretty low detail. And Google Maps obviously needs a data connection. The traffic is not that much though, the data flowing is pretty size-optimized it would seem.

Overall

Google Maps is fast, user-friendly and easy to use, but needs internet. It can do more in less time, but sometimes it’s maps are not as good as Garmin ones. Garmin XT is pretty unusable and slow but can work offline and the maps most of the times are the best one can find.

Garmin is a nice-to-have second option in case Google Maps fails somewhere or there’s no network coverage.

# Friday, June 05, 2009

European Parliament and local government elections

This is stealing. They are denying a taxpayer to post his vote (no voting section will be raised in NYC):

http://www.webhousing.biz/~bulgaria/news.php?id=148
(Bulgarian Embassy in the USA on the EP elections on 7th of June)

For such a voting section to exist for the local Bulgaria government, 100 voters have to register “either personally, via FAX or via a scanned document saying they want to vote”. So now I have to find a scanner.

The vote is on 5th of July.

http://www.webhousing.biz/~bulgaria/news.php?id=149

Idiots.

First impressions from the US

The cars are different, the pipes are different, the knobs are different.

The mobile internet

Today we were wandering for half a day in the local ghetto looking for an AT&T store.. They wanted $20 for 100 megabytes and we decided to turn to T-Mobile.

T-Mobile offers unlimited mobile data for $24.99s and 600 minutes for $39.99. So for a total of $77 ($5 for some tax) I’m now always connected. The connection sucks big time. It’s normally like 2-3 kb/sec and the max I’ve seen is like 20kb/s.

The knobs

After 20 something hours of travel (2-hour flight, 2-hour wait, 9-hour flight, 1-hour bus ride, 2-hour train ride, 20 minutes in a cab, and god knows what else) there were so many smells coming out of me, so the first thing I needed was a shower. It took me like a minute to figure out how to start the shower and a minute more how to get the hot water. The knob was like an arrow of a clock. Originally it pointed 11 o’clock. It could move only counter-clockwise and from 10 o’clock until 8 o’clock is the cold water. The hot water is at 3 o’clock. At first I moved it only a bit and had to move away pretty fast. The strength of water flow cannot be controlled – it’s always the same and it’s pretty well chosen.

Politically correct

The word negro MUST NOT be used in any conversation even one being taken in Bulgarian or at least I was told so. Otherwise one could get beaten up, or when being in a ghetto - get shot.

Update: Pictures here: http://picasaweb.google.com/mihail.stoynov

# Thursday, June 04, 2009

USA, here I come

It’s been one day since I landed at JFK International Airport in New York. Here’s one picture from Grand Central Station:

03062009081 

I’ll be staying in the US for a month.

Update: Pictures here: http://picasaweb.google.com/mihail.stoynov

# Monday, May 18, 2009

How to start matrixtunnel

Matrixtunnel is a small http wrapper that adds ssl on top of plain http. Small memory footprint.

Here’s how to start it:

user:~# matrixtunnel -A /etc/ssl/domain.com.cer -p /etc/ssl/domain.com.key -r 80 -d 444

Print help screen:

user:~# matrixtunnel -h
usage: [-c] [-v] [-d localip:port] [-r remoteip:port]

    -A      Certificate Authority file
    -p      private key and certificate chain PEM file name
    -c      client mode. remote is ssl, local plain
    -v      validate certificate
    -d      listen locally on this [host:]port
    -r      connect to remote machine on [host:]port
    -P      pidfile
    -f      foreground mode
    -D      syslog level (0...7)

If one wants to test, one can use –f (start on the console, not as a daemon).

Note: don’t use –v, sometimes it fails. I don’t know why.

Few extra commands (openssl, certificates)

This is an addendum to http://mihail.stoynov.com/blog/2009/03/12/CertificatesKeystoresJavaKeytoolUtilityAndOpenssl.aspx 

Key file is a format that keeps the private key in unencrypted format. It does not keep the certificate.

Converting pem –> key

openssl rsa –in mycompany.pem –out mycompany.key

Check out a certificate (pem, key)

openssl x509 –in mycompany.pem -text –noout
openssl x509 –in mycompany.key -text –noout

Output the private key

openssl rsa –in mycompany.key
openssl rsa –in mycompany.pem

(if they’re the sam certificate, they output the same thing).

Output the private key in readable format

openssl rsa –in mycompany.key –text
openssl rsa –in mycompany.key –text –noout (omit the binary part)
openssl rsa –in mycompany.pem –text
openssl rsa –in mycompany.pem –text –noout (omit the binary part)

Update:

Launch small https server to test a certificate

# on one host, set up the server (using default port 4433)
openssl s_server -cert mycert.pem –www

Check the speeds to that server

# on second host (or even the same one), run s_time
openssl s_time -connect myhost:4433 -www / -new -ssl3

# Thursday, May 14, 2009

Skype on a mac, what to do when it fails

Skype today refused to receive messages. I could see the balloons, but the message-boxes were empty.

Rebooting failed.
Updating Skype failed.

I got tired and removed my account’s local db (history and other stuff) and it all worked as a charm.

Local db located at ~/Library/Application Support/Skype/[username]

# Tuesday, May 12, 2009

How to have a Subversion Repository on a Windows Server (+ security), part 1

The article is written based on Windows Server, CollabNet Subversion 1.6.1, Apache 2.2. Windows XP or Vista would do as well.

Subversion comes with it’s own server – svnserve. By default there is no security. One can install svn+ssh, but on a windows server and windows client that is a bit stupid.

The other option is to setup an Apache server with mod_dav and mod_dav_svn. Fortunately the CollabNet Subversion binary comes with Apache pre-bundled with those modules. The binary even installs viewvc, which is rather nice.

Installation steps.

After installing the bundle, however, there are a lot of things to do. Most of them manually. I’ll try to describe most of them here.

Download Collabnet Subversion Server binary from CollabNet (no other place to download it from). Registration required.

So we decided to use Apache instead of svnserve, so while installing one doesn’t have to make it a service. Only Apache should be installed as a service. Another pro for Apache is that it can host multiple SVN repositories as opposed to only one by svnserve AFAIK.

Now is the time to suggest that one make the Apache server run with limited credentials. By default the service would be running with Local System account which has more privileges than God the users in the Administrators group. The concrete steps would be to create one user with compmgmt.msc. Remove it from the Users group (which removes all the default privileges) and give this user Modify right for the httpd directory (one will most probably find it in C:\Program files\Subversion\httpd) and all the repositories.

The configuration. When installing Apache asks where is the repositories basedir. Using a basedir means that all the repositories are subdirectories of the basedir:

Subversion/httpd/conf/httpd.conf:

<Location /svn>
  DAV svn
  SVNParentPath "D:/SVN Repositories/"    <— put the qoutes. installer does not do it
</Location>

Note: by default the installer does not put quotes around the dir, so if there are space characters, the server will not start. One should put the quotes himself/herself.

Now is the time to say that the Apache server is very verbose. Every error show up in the Event Viewer in the Applications tab. There are always pretty good descriptions of what is wrong. I definitely like this feature of Apache. Unfortutely one has to use Google to figure how to fix it.

Another place to look for errors is httpd/logs/errors.log. Pretty readable. I’m positively surprised.

I don’t like the basedir approach – repositories with me are in different dirs. I do it like this

<Location /svn/mycompany>
   DAV svn
   SVNPath "D:/My Company/Repository"                   <— put the qoutes
</Location>

Authentication. Very shortly – http basic and http digest. Http basic is very insecure (only base64). Http basic looks like this:

<Location /svn/mycompany>
   DAV svn
   SVNPath "D:/My Company/Repository"
   AuthType Basic
   AuthName "MyCompany subversion repository"
  
AuthUserFile "C:\Program Files\Subversion/httpd/conf/svn_auth_file"
   Require valid-user
</Location>

Now, how to make the user’s file (svn_auth_file). Use htpasswd (only for http basic):

C:\Program Files\Subversion\httpd\bin>htpasswd -cm ..\conf\svn_auth_file mihail
New password: ******
Re-type new password: ******
Adding password for user mihail

C:\Program Files\Subversion\httpd\bin>htpasswd -m ..\conf\svn_auth_file ivan
New password: *****
Re-type new password: *****
Updating password for user ivan

The first time –c is used to create the file. Any subsequent user is with –m only (which stands for MD5 as far as I remember).

svn_auth_file:

mihail:$apr1$AzWq5tu5$k554PODb79n9TZwBxBDh..
ivan:$apr1$hlr9s6gK$oFLP1WtwvOLczyUSiP10v/

For http digest the configuration first the module has to be uncommented in httpd.conf:

LoadModule auth_digest_module modules/mod_auth_digest.so    <—uncomment this line

the configuration for the location is the following:

<Location /svn/mycompany>

AuthType Digest

And users are made with htdigest:

C:\Program Files\Subversion\httpd\bin>htdigest.exe –c ../conf/svn_auth_file "MyCompany subversion repository" mihail
Adding user mihail in realm MyCompany subversion repository
New password: ******
Re-type new password: ******

C:\Program Files\Subversion\httpd\bin>htdigest.exe ../conf/svn_auth_file "MyCompany subversion repository" ivan
Adding user ivan in realm MyCompany subversion repository
New password: ******
Re-type new password: ******

The file svn_auth_file looks a bit different now:

mihail:MyCompany subversion repository:3d16aced3eac2fc74ce5663df86d145b
ivan:MyCompany subversion repository:3ff20546c01028d5008651445b62d2e0

Note: keep in mind that the realms in svn_auth_file and the <Location AuthName should match.

Note: do not confuse htpasswd and htdigest. They produce users for http basic and http digest respectively and are not interchangeable.

For now there is a pretty usable svn server that supports multiple repositories and digest auth. But the communication with the server is plain and unencrypted http.

The svnbook is available here (most up-to-date version 1.5): http://svnbook.red-bean.com/en/1.5/svn.serverconfig.httpd.html. The chapter for servers is Chapter 6.

The next part is how to setup a SSL on top of Apache.

# Sunday, May 10, 2009

Pingbacks now work

The blog just said:

You were pinged back by
http://mihail.stoynov.com/blog/2009/05/10/TestBlogPostWithWindowsLiveWriter.aspx
on your weblog entry 'Usability of the blog'
(http://mihail.stoynov.com/blog/2009/05/05/UsabilityOfTheBlog.aspx

I’ve linked myself in the past but I guess this feature was off or broken.

Test blog post with Windows Live Writer

I’ve heard of Windows Live Writer but I’ve always thought that it only works for Blogger and Sharepoint. A comment to the blog (here) made me investigate whether dasBlog would support WLW. It does. This is the first blog post with WLW.

While installing WLW in my virtual Windows XP (I’ll write about that later if WLW works) I decided to update the blog. The update can now be installed with something called Web Platform Installer 2.0. It installs crap directly from the internet especially crap for IIS:

Web Platform Installer 2.0

(Wow, WLW can inline the image in the text. I’ve always missed that.)

So, let’s see how this blog post would look like.

Submit... (in this case “Publish”)



Update: this cannot be true. WLW has live preview that embeds the post in the blog, this is so f*cking cool. Look at it:

 


WLW live preview

 

 

 

 

 

 

 

 

 

 




Image thumbnails, resizing. Categories. Everything seems to work seamlessly. So let’s finally submit it and see what happens (I may start using this a lot).

# Tuesday, May 05, 2009

Usability of the blog

Watching the blog stat one can't help but notice the decreasing amount of articles (I guess my single reader and I are the ones that should notice). Maybe it's because a lack of time. Maybe it's because of too much work,study or travel (I'm currently in Turkey on vacation).

Lately one new reason is emerging in my head (yes, it takes them (the thought) some time to mature :). Maybe I'm not writing that much because of the usability of the blog. The usability from the readers' point of view is bad (here for example,), but it's hard to fix it and I'm too lazy to do it. But now I'd like to talk about usability from my perspective (as the author).

I'm running the blog (hosted on dasBlog) at my own server with a very cheap internet connection so it's a bit slow. dasBlog doesn't do any kind of image help (not to mention anything more complex) - I have to do my own thumbnails (I so very much hate that). dasBlog's rich text editor does not support my phone's browser or Safari.

So at the end even if i think of a good story it takes a lot of time to represent it in the blog. Especially if it's very visual, or even only a bit visual.

So I have to think of other ways to improve my experience. And I just thought of one. I'll write when I do it.

Good Night, and Good Luck.

I just watched the 2005 movie Good Night, and Good Luck. It basically depicts the communist witch-hunt that happened in the US just after the WWII. It's very moving and a bit sad (especially at the end with the faith of the main character).

The movie made me spend some time on Wikipedia reading about McCarthy, Murrow and Hollenbeck. Very interesting. Makes one think whether we have the same media now.

Directed by George Clooney. 6 Academy awards nominations. Highly recommended.

# Tuesday, April 21, 2009

Gmail's new attach file button

Gmail recently changed the "Attach..." button with a flash one. Today I found out why. Now one can attach multiple documents with one click. It's awesome.

Update: due to some comments here are some screenshots:

On a mac (firefox) it's working:





On Windows (firefox) there was no flash button. (I've seen Gmail and other google applications change the look&feel on different browsers and different google users. Maybe that's the reason.)

The screenshot:

# Friday, March 20, 2009

How to consolidate (add, gather) multiple private keys in one JKS file with keytool

Do the following multiple times:

keytool
  -importkeystore
    -srckeystore mycompany1.root.ca.jks
    -srcalias
mycompany1.ca
    -destalias
mycompany1.ca
    -srcstorepass
mycompany1.ca

    -destkeystore container.root.ca.jks
    -deststorepass container.root.ca

The first time you do it the container.root.ca.jks would be created. The subsequent times it will just be filled up with new and new keypairs (public and private keys).

# Thursday, March 19, 2009

How to set up networks and dhcp on vmware (on Mac and other OSs)

How to do networking with VMWare Workstation or VMWare Fusion?

For clarity, let's assume that the host (the machine running vmware fusion or vmware workstation) has the ip of 192.168.0.10.

On every virtual machine there are three options:
Bridged (VM becomes visible to other machines beside the host. It has an IP like 192.168.0.11).
Nat (VM is visible only to the host, there is internet).
Host only (VM is visible only to the host, but no internet).


Do ipconfig or ifconfig.
vmnet8 is for NAT.
vmnet1 is for host-only.
These are whole networks for virtual machines. If nat is chosen, then the VM would be supplied an IP from the vmnet8 pool.


DHCP.
If 'bridged' is chosen, then the administrator of 192.168.0.1 must assign an address to the VM.
if 'nat' or 'host-only' is chosen, then:
(I'll describe how to do this on a mac):

goto:
$cd /Library/Application Support/VMware Fusion

stop vmware networking:
$sudo ./boot.sh --stop



Let's suppose vmnet8 is 172.16.57.1 and vmnet1 is 172.16.163.1.


I would like to change the network from 172.16.57.1 to 172.16.16.1 and I would like to specify a virtual machine with a specific IP.

We're still in /Library/Application Support/VMware Fusion

Then:
$ grep 172.16.57 *
locations:answer VNET_8_HOSTONLY_HOSTADDR 172.16.57.1


Then all files in the list must be changed.
Then we go into /Library/Application Support/VMware Fusion/vmnet8/

Then the same:

$ grep 172.16.57 *
dhcpd.conf:subnet 172.16.57.0 netmask 255.255.255.0 {
dhcpd.conf: range 172.16.57.128 172.16.57.254;
dhcpd.conf: option broadcast-address 172.16.57.255;
dhcpd.conf: option domain-name-servers 172.16.57.2;
dhcpd.conf: option netbios-name-servers 172.16.57.2;
dhcpd.conf: option routers 172.16.57.2;
nat.conf:ip = 172.16.57.2
nat.conf:# or ip = 172.16.57.2/24




All of them must be changed.

If a specific VM must have a specific IP we go to:
/Library/Application Support/VMware Fusion/vmnet8/dhcpd.conf and we add the following:
(get the mac from the VM (ipconfig, ifconfig eth0))

host myhost {
hardware ethernet 00:0C:29:B2:C9:69;
fixed-address 172.16.16.16;
}


Then to renew the ip (ipconfig /release, ipconfig /renew for windows):
sudo ifconfig vmnet down
sudo ifconfig vmnet up


The last thing is to start the vmware networking:
sudo ./boot.sh --start



Then to renew the ip inside the VM (ipconfig /release, ipconfig /renew for windows):
sudo ifconfig vmnet down
sudo ifconfig vmnet up

# Wednesday, March 18, 2009

MS Office for Mac sucks

It's like bringing "the Vista experience" to a Mac.
I didn't like it.

It's super slow.
The windows do not open where they're supposed to. The tool boxes open in different window (I have Spaces on).
The interface is new and unintuitive.
The windows focus is changed randomly so I have to fight for it.

# Thursday, March 12, 2009

Certificates, keystores, java keytool utility and openssl

(Updated: four six typos fixed)

I)
From time to time I need a self-signed certificate. I use the java keytool utility to make one:

For a JKS (Java Key Store format):
keytool
  -genkeypair
    -keystore mihail.stoynov.jks
    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -keysize 2048
    -keyalg RSA
    -sigalg sha1withrsa
    -dname "cn=Mihail Stoynov,
ou=MyCompany Bulgaria, o=MyCompany, L=Sofia, S=Sofia, c=BG"
    -validity 3650
    -v

For a PKCS#12 keystore:
keytool
  -genkeypair
    -keystore mihail.stoynov.p12
    -storetype pkcs12
    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -keysize 2048
    -keyalg RSA
    -sigalg sha1withrsa
    -dname "cn=Mihail Stoynov, ou=MyCompany Bulgaria, o=MyCompany, L=Sofia, S=Sofia, c=BG"
    -validity 3650
    -v

When the public certificate is needed separately, one can be exported in a file (mihail.stoynov.cer) like this:
(from a JKS)
keytool
  -exportcert
    -keystore mihail.stoynov.jks
    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -file mihail.stoynov.cer
    -v

(from a PKCS#12)
keytool
  -exportcert
    -keystore mihail.stoynov.p12
    -storetype pkcs12
    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -file mihail.stoynov.cer
    -v

NOTE: keep storepass and keypass the same for easy importing into browsers


II)
Sometimes self-signed certificates are not enough and a CA root certificate must be made in order to sign a group of certificates.

First a Certificate signing request (CSR) must be made:
(from a JKS)
keytool
  -certreq
    -keystore mihail.stoynov.jks
    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -v
    >> mihail.stoynov.csr

(from a PKCS#12)
keytool
  -certreq
    -keystore mihail.stoynov.p12
    -storetype pkcs12
    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -v
    >> mihail.stoynov.csr

(the output is directed to a file: mihail.stoynov.cer)

The file looks something like that:
-----BEGIN NEW CERTIFICATE REQUEST-----
MIICtTCCAZ0CAQAwcDELMAkGA1UEBhMCQkcxDjAMBgNVBAgTBVNvZmlhMQ4wDAYDVQQHEwVTb2Zp
YTEQMA4GA1UEChMHTWF0ZXJuYTEWMBQGA1UECxMNTWF0ZXJuYSBTb2ZpYTEXMBUGA1UEAxMOTWlo
YWlsIFN0b3lub3YwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZ7XpdyHuF9ApZodSn
GS9/TiUtXqryPDD0elzlP2QreSkfYv8IaXnB1Xy1ZVmda/d+P4TZ/aHvAhDwQPcei4KaoRzJWX9I
Yz9hi4cmKksjg8ufDZzXUuMwtbVlricc5vWg1HcSsQJ8vpLCBIelliDJOxc4skDcT23LGQttiv0b
23pjMthEe2tJVp37Tnwr29SLz0AGziVwzb5cfAXU4PzpiASr8vF2A0c2DObS7zM5Wp7jXWIe71P5
BZgIMcUUGlCdfLQRoA7URWN2Yx2qH8gyiNaIaZYZB6o2ib8rH3UmDl/ErKJgWQyS7sr4bANY9WpA
m7H2nXfGs+X88xSbA0JRAgMBAAGgADANBgkqhkiG9w0BAQUFAAOCAQEAIn81dCSpVbI7IDLO2L2p
MW1gnjvuRs9xm6M9rMV6Kwy0Nw05qL0H8tTsFaq4J7bLBXJeXmiREUbrtpbHxLUfjtaqs5q5Txxn
c7Cm5kj7t9PWeRTW0rbzRssgT+sHqUlMKMydB8E+gGEIMQdgwdurhjpD7aevOOeN5fvv9kV7Rszv
6nC8dixyrsiiWjLUGJRP7I9HrEAXKfk3JluSYKS/ZNhTIw5a7fKvhXbRPlN1lDSvdkJAtcaG/9dZ
3KlXL7ozL8sOQTjFxUhN6kS6QujJ1T7TlkWHu9/ivIAkuXBu8P/czyLyjf1JD9fnwGnxCO2FPmcX
9/2IpwG33mMpaAmXpA==
-----END NEW CERTIFICATE REQUEST-----



Did we forget something? Yes, there's no Root CA certificate. Let's make one:
(JKS)
keytool
  -genkeypair
    -keystore mycompany.root.ca.jks
    -storepass "mycompany.root.ca"
    -alias "mycompany.root.ca"
    -keypass "mycompany.root.ca"
    -keyalg RSA
    -keysize 2048
    -sigalg SHA1withRSA
    -dname "cn=MyCompany Bulgaria, ou=Office No 5, o=MyCompany, L=Sofia, S=Sofia, c=BG"
    -validity 3650
    -v


(PKCS#12)

keytool
  -genkeypair
    -keystore mycompany.root.ca.p12
    -storetype pkcs12
    -storepass "mycompany.root.ca"
    -alias "mycompany.root.ca"
    -keypass "mycompany.root.ca"
    -keyalg RSA
    -keysize 2048
    -sigalg SHA1withRSA
    -dname "cn=MyCompany Bulgaria, ou=Office No 5, o=MyCompany, L=Sofia, S=Sofia, c=BG"
    -validity 3650
    -v




Problem No 1
Keytool cannot sign CSRs. Period.

Now what do we do?

I went to OpenSSL.

In order to sign with OpenSSL I needed the root certificate in the PEM format.
P12 (PKCS#12) -> PEM:
openssl
  pkcs12
    -in mycompany.root.ca.p12
    -out mycompany.root.ca.pem

Sign the CSR with OpenSSL:
openssl
  x509
    -req
    -in mihail.stoynov.csr
    -CA mycompany.root.ca.pem
    -out mihail.stoynov.signed.cer
    -days 3650
    -CAcreateserial

(I don't know what -CAcreateserial is but it works)

So now I have mihail.stoynov.signed.cer.

The last step is to import it to mihail.stoynov.p12 (or .jks) in order to override the self-signed certificate with the one signed by the MyCompany Root CA.

A Prerequisite step to that is to import mycompany.root.ca.cer into mihail.stoynov.p12 (or .jks) because every certificate in the chain must be contained in the certificate chain of mihail.stoynov.



Problem No 2
Importing mycompany.root.ca.cer into mihail.stoynov.p12 fails but importing it into mihail.stoynov.jks works?!

JKS:
keytool
  -importcert
    -keystore mihail.stoynov.jks
    -storepass mihail.stoynov
    -alias mycompany.root.ca
    -keypass
mycompany.root.ca
    -file mycompany.root.ca.cer
    -v
(this one works)

PKCS#12
keytool
  -importcert
    -keystore mihail.stoynov.p12
    -storetype pkcs12
    -storepass mihail.stoynov
    -alias mycompany.root.ca
    -keypass
mycompany.root.ca
    -file mycompany.root.ca.cer
    -v
this one fails with:
Owner: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Issuer: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Serial number: 49b8c365
Valid from: Thu Mar 12 08:12:13 GMT+00:02 2009 until: Sun Mar 10 08:12:13 GMT+00:02 2019
Certificate fingerprints:
     MD5:  1C:0C:82:0D:35:C8:1E:48:74:9F:13:43:C9:AE:D0:F7
     SHA1: DB:BB:D7:DB:8C:33:AA:06:6D:CF:D2:5C:EB:64:01:D5:AD:AB:94:38
     Signature algorithm name: SHA1withRSA
     Version: 3
Trust this certificate? [no]:  y

keytool error: java.security.KeyStoreException: TrustedCertEntry not supported
java.security.KeyStoreException: TrustedCertEntry not supported
    at com.sun.net.ssl.internal.pkcs12.PKCS12KeyStore.engineSetCertificateEntry(PKCS12KeyStore.java:620)
    at java.security.KeyStore.setCertificateEntry(KeyStore.java:941)
    at sun.security.tools.KeyTool.addTrustedCert(KeyTool.java:1958)
    at sun.security.tools.KeyTool.doCommands(KeyTool.java:818)
    at sun.security.tools.KeyTool.run(KeyTool.java:172)
    at sun.security.tools.KeyTool.main(KeyTool.java:166)

Actually P12 format does not permit trusted certificates. It is inteded to contain key/pairs only. So importing mycompany.root.ca.cer into mihail.stoynov.p12 failed.


I tried several things:

1) Importing mihail.stoynov.signed.cer directly into mihail.stoynov.p12:
keytool
  -importcert
    -keystore mihail.stoynov.p12
    -storetype pkcs12

    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -file mihail.stoynov.signed.cer
    -v
and the response was:
keytool error: java.lang.Exception: Failed to establish chain from reply
java.lang.Exception: Failed to establish chain from reply
    at sun.security.tools.KeyTool.establishCertChain(KeyTool.java:2662)
    at sun.security.tools.KeyTool.installReply(KeyTool.java:1870)
    at sun.security.tools.KeyTool.doCommands(KeyTool.java:807)
    at sun.security.tools.KeyTool.run(KeyTool.java:172)
    at sun.security.tools.KeyTool.main(KeyTool.java:166)

2) Importing mycompany.root.ca.cer into cacerts:
keytool -importcert -trustcacerts -file mycompany.root.ca.cer
This again didn't fix the problem.



Solution to Problem No 2:
Transform P12 to JKS, import the root certificate and the signed certificate into JKS keystore, transform the modified JKS back to P12.

1) Transform P12 to JKS
keytool
  -importkeystore
    -srckeystore mihail.stoynov.p12
    -destkeystore mihail.stoynov.jks
    -srcstoretype pkcs12
    -srcstorepass mihail.stoynov
    -deststorepass mihail.stoynov
2) import the root certificate into the JKS keystore
keytool
  -importcert
    -keystore mihail.stoynov.jks
    -storepass mihail.stoynov
    -alias mycompany.root.ca
    -keypass mycompany.root.ca
    -file mycompany.root.ca.cer
    -v
3) import signed certificate into JKS keystore
keytool
  -importcert
    -keystore mihail.stoynov.jks
    -storepass mihail.stoynov
    -alias mihail.stoynov
    -keypass mihail.stoynov
    -file mihail.stoynov.signed.cer
    -v
4) transform the modified JKS back to P12
keytool
  -importkeystore
    -srckeystore mihail.stoynov.jks
    -destkeystore mihail.stoynov.p12
    -deststoretype pkcs12
    -srcstorepass mihail.stoynov
    -deststorepass mihail.stoynov
it said something like:
Entry for alias mihail.stoynov successfully imported.
Problem importing entry for alias mycompany.root.ca: java.security.KeyStoreException: TrustedCertEntry not supported.
Entry for alias mycompany.root.ca not imported.
Do you want to quit the import process? [no]:  n
Import command completed:  1 entries successfully imported, 1 entries failed or cancelled
I clicked yes, and it worked.


Now let's see what's the difference between mihail.stoynov.jks and mihail.stoynov.p12:
JKS:
$ keytool -list -keystore mihail.stoynov.jks -storetype jks -storepass mihail.stoynov -v

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 2 entries

Alias name: mihail.stoynov
Creation date: Mar 12, 2009
Entry type: PrivateKeyEntry
Certificate chain length: 2
Certificate[1]:
Owner: CN=Mihail Stoynov, OU=MyCompany Sofia, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Issuer: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Serial number: f0e465bb77420e30
Valid from: Thu Mar 12 09:29:19 GMT+00:02 2009 until: Sun Mar 10 09:29:19 GMT+00:02 2019
Certificate fingerprints:
     MD5:  40:9D:C2:DE:AE:11:1E:01:92:F9:C8:01:C5:92:69:CB
     SHA1: D2:D0:03:5C:50:BC:F8:6C:EB:C0:36:B6:B0:8D:A8:3B:9E:B6:7B:B4
     Signature algorithm name: SHA1withRSA
     Version: 1
Certificate[2]:
Owner: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Issuer: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Serial number: 49b8c365
Valid from: Thu Mar 12 08:12:13 GMT+00:02 2009 until: Sun Mar 10 08:12:13 GMT+00:02 2019
Certificate fingerprints:
     MD5:  1C:0C:82:0D:35:C8:1E:48:74:9F:13:43:C9:AE:D0:F7
     SHA1: DB:BB:D7:DB:8C:33:AA:06:6D:CF:D2:5C:EB:64:01:D5:AD:AB:94:38
     Signature algorithm name: SHA1withRSA
     Version: 3


*******************************************
*******************************************


Alias name: mycompany.root.ca
Creation date: Mar 12, 2009
Entry type: trustedCertEntry

Owner: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Issuer: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Serial number: 49b8c365
Valid from: Thu Mar 12 08:12:13 GMT+00:02 2009 until: Sun Mar 10 08:12:13 GMT+00:02 2019
Certificate fingerprints:
     MD5:  1C:0C:82:0D:35:C8:1E:48:74:9F:13:43:C9:AE:D0:F7
     SHA1: DB:BB:D7:DB:8C:33:AA:06:6D:CF:D2:5C:EB:64:01:D5:AD:AB:94:38
     Signature algorithm name: SHA1withRSA
     Version: 3


*******************************************
*******************************************





P12 (PKCS#12)
$ keytool -list -keystore mihail.stoynov.p12 -storetype pkcs12 -storepass mihail.stoynov -v

Keystore type: PKCS12
Keystore provider: SunJSSE

Your keystore contains 1 entry

Alias name: mihail.stoynov
Creation date: Mar 12, 2009
Entry type: PrivateKeyEntry
Certificate chain length: 2
Certificate[1]:
Owner: CN=Mihail Stoynov, OU=MyCompany Sofia, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Issuer: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Serial number: f0e465bb77420e30
Valid from: Thu Mar 12 09:29:19 GMT+00:02 2009 until: Sun Mar 10 09:29:19 GMT+00:02 2019
Certificate fingerprints:
     MD5:  40:9D:C2:DE:AE:11:1E:01:92:F9:C8:01:C5:92:69:CB
     SHA1: D2:D0:03:5C:50:BC:F8:6C:EB:C0:36:B6:B0:8D:A8:3B:9E:B6:7B:B4
     Signature algorithm name: SHA1withRSA
     Version: 1
Certificate[2]:
Owner: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Issuer: CN=MyCompany Bulgaria, OU=Office No 5, O=MyCompany, L=Sofia, ST=Sofia, C=BG
Serial number: 49b8c365
Valid from: Thu Mar 12 08:12:13 GMT+00:02 2009 until: Sun Mar 10 08:12:13 GMT+00:02 2019
Certificate fingerprints:
     MD5:  1C:0C:82:0D:35:C8:1E:48:74:9F:13:43:C9:AE:D0:F7
     SHA1: DB:BB:D7:DB:8C:33:AA:06:6D:CF:D2:5C:EB:64:01:D5:AD:AB:94:38
     Signature algorithm name: SHA1withRSA
     Version: 3


*******************************************
*******************************************






Do you see the difference?
It's in italic - JKS format keeps an extra trusted certificate of MyCompany Root CA.

Anyway both mihail.stoynov.jks and mihail.stoynov.p12 work perfectly.


P.S.
Does someone know better solutions to Problem No 1 and Problem No 2?
Does someone know how to sign certificates but without the cumbersome CSR step?
# Tuesday, March 03, 2009

The "Introduction to Programming with Java" is out

The book "Introduction to Programming with Java" I coauthored is out.



The book is in Bulgarian and it's free.

For now it's only in electronic form, but we're planning to print it. We're not planning on making profit from the printed book, so we're looking for sponsors.

I co-wrote the Exceptions chapter and authored the Object-oriented programming (OOP) chapter and the Qualitative programming code chapter.